Decision 078/2020: Looked after children in care

Public authority: East Dunbartonshire Council
Case Ref: 201900758

Summary

The Council was asked for statistical data covering a five year period 2013-2018, concerning looked-after children (a) placed into the East Dunbartonshire area by other local authorities and (b) placed outwith the East Dunbartonshire area by the Council.

The Council disclosed some information but not the low numbers which could, in the Council's view, enable identification of living individuals. The Council cited the exemption under section 38(1)(b) of FOISA, believing disclosure of these low numbers would contravene the first data protection principle.

In this case, the Commissioner did not accept that the Council had demonstrated a realistic link which would, or would be likely to, result in identification of living individuals from the withheld information. This meant that the withheld information was not personal data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b) and (5) (definition of "personal data")

Data Protection Act 2018 (the DPA 2018) sections 3(2) and (3) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 28 December 2018, the Applicant made a request for information to East Dunbartonshire Council (the Council), asking for information for "the past five financial years (2013/14, 2014/15, 2015/16, 2016/17, and 2017/18)" about looked-after children placed in care:

(a) in the Council's area, by other local authorities, and

(b) from the Council's area, in other local authority areas.

For each year, the Applicant asked for both a list of all the authorities that had placed children in the Council's area/had children placed in their areas by the Council, and the number of children involved in each case.

2. The Council responded on 3 January 2019, disclosing data for each authority where the number was five or more. Where the relevant number was less than five, it withheld information under section 38(1)(b) of FOISA, arguing that disclosure would be likely to allow the identification of living individuals.

3. On 12 February 2019, the Applicant wrote to the Council, requesting a review of its decision as she was not satisfied that the withheld information fell within the definition of personal data.

4. The Council notified the Applicant of the outcome of its review on 12 March 2019, upholding its earlier decision without modification.

5. On 8 May 2019, the Applicant wrote to the Commissioner. The Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA, explaining why she did not consider the withheld information to be personal data.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 2 July 2019, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. The questions related to the application of section 38(1)(b) of FOISA, including the Council's reasons for claiming the withheld information to be personal data.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) (Personal information)

10. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.

11. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

12. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.

Is the withheld information personal data?

13. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. The definition is set out in full in Appendix 1.

14. The Commissioner's briefing on section 38 (Personal information)[1] notes that the two main elements of personal data are that:

(i) the information must "relate to" a living individual, and

(ii) the living individual must be identifiable.

15. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

16. An "identifiable living individual" is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).

17. The Applicant submitted that the data described in this request was summarised data, not including any personal identifiers and relating to large enough population sizes that it would not be possible to identify anyone directly. She did not believe any realistic causal chain had been put forward which would allow a third party to identify anyone

18. The Council submitted that its key consideration was the fact that the withheld data related to vulnerable children. It also emphasised that it did not apply the section 38 exemption as a blanket response, but rather had taken a case by case approach. The Council considered the likelihood of an individual being identified if this particular withheld information were published to be sufficient to bring it within the ambit of the exemption.

19. The Council noted the two parts to the request and that disclosure in response must be regarded as making the information available to the wider public. In this context, it submitted that the wider public would include residents of East Dunbartonshire and those residing where local children might be looked after. The Council stated that "there is a clear and realistic prospect that vulnerable children could be identified within relevant communities" and, on that basis, believed it would be completely inappropriate to provide the requested information. The Council argued that it was wrong to take a view on how identifiable these children were from amongst the population of East Dunbartonshire, or that of any other local authority, in its entirely. It explained that such children will be drawn from a smaller group within local communities, and the manner in which they are "accommodated" restricts this further.

20. The Council noted that it was not a single, bustling metropolis, but rather a collection of small towns and villages and two prosperous Glasgow suburbs. It submitted that individuals from one part of the authority's area would be likely to stand out in another part, never mind children from outside the area. It also noted that it was home to a residential unit, taking children from a wide area who were often visible members of communities.

21. Regarding placements outwith the area, the Council noted that these would reflect the specific needs of the child and would be specialist placements, making the child easily identifiable. Those who might be able to identify the children would include individuals within the communities where they were placed and also, potentially, the children's parents (some of whom would have a particular drive to identify where they were looked after).

22. The Council also highlighted that statistics relating to other groups of vulnerable children were not routinely published.

23. The Commissioner has considered the Council's submissions for both elements of the request. Clearly, the information relates to vulnerable children, who are subject to particular risks and who may stand out in whatever community they are placed. If there is a realistic prospect of their being identified from information held by a public authority, a precautionary approach to disclosure of that information is likely to be appropriate. However, the question the Commissioner must address at this stage is whether there is such a prospect - whether (bearing in mind some people will be more motivated to seek out the individuals in question than others) the information is capable of making a useful contribution to identifying those children.

24. In this case, for either part of the request, the Commissioner is not satisfied that the Council has shown how the withheld information adds anything of value to what already exists in the public domain. Assuming children circulate and communicate in the communities in which they are placed, it is not possible to maintain a veil of secrecy in relation to their backgrounds. Equally, while they must maintain case-specific confidentiality, it will not generally be a secret that particular adults in a community are foster carers.

25. Beyond these factors, there may well be speculation, but the Commissioner cannot see how the numbers in question - which each simply place a small number of children in an area with a population of tens of thousands, in some cases of considerable geographical extent - can make a meaningful contribution to adding any certainty to such speculation. For example, an unfamiliar accent may make a child "stand out" in a particular community, but the Commissioner has difficulty believing that even a particularly motivated individual will be likely to be so attuned to local accents as to identify the child in question with any degree of certainty as coming from the area of any of the authorities under consideration here (even assuming an accent is always a reliable guide to where the child has been placed from, which cannot be the case). The parents, obviously, will know where the child has come from, but placing them in a particular authority's area (assuming that is not known already) will add very little to the process of finding the child within that area and population.

26. Having taken all the Council's submissions into consideration, therefore, the Commissioner finds them too hypothetical and unsubstantiated to offer a real likelihood of children being identified using the withheld information. As a result, he is not satisfied that the withheld information can properly be regarded as personal data. Consequently, he must find that the Council was not entitled to withhold the information under section 38(1)(b) of FOISA.

27. The Commissioner therefore requires the Council to disclose the information to the Applicant.

Decision

The Commissioner finds that East Dunbartonshire Council (the Council) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. The Council wrongly withheld information under section 38(1)(b) on the basis that it was personal data, thereby failing to comply with section 1(1).

The Commissioner therefore requires the Council to provide the Applicant with the withheld information, by 4 August 2020.

Appeal

Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

18 June 2020

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(5) In this section-

…

"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

…

---