Decision 079/2020: Looked after children

Public authority: Moray Council
Case Ref: 201900760

Summary

The Council was asked for statistical data covering a five year period 2013-2018, concerning looked-after children (a) placed into the Moray area by other local authorities and (b) placed outwith the Moray area by the Council.

The Council responded by stating it did not hold data for all the years specified. It disclosed some data but withheld some low figures (less than five) under section 38(1)(b) of FOISA explaining that disclosure would contravene the first data protection principle as it believed identification of living individuals was possible from these data.

The Commissioner was not satisfied from the Council's submissions that children could be identified from the information. Consequently, he did not accept that the information was personal data and ordered disclosure.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b) and (5) (definition of "personal data"`) (Personal information)

Data Protection Act 2018 (the DPA 2018) sections 3(2) and (3) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 3 December 2019, the Applicant made a request for information to Moray Council (the Council) asking for information for "the past five financial years (2013/14, 2014/15, 2015/16, 2016/17, and 2017/18)" about looked-after children placed in care:

(a) in the Council's area, by other local authorities, and

(b) from the Council's area, in other local authority areas.

For each year, the Applicant asked for both a list of all the authorities that had placed children in the Council's area/had children placed in their areas by the Council, and the number of children involved in each case.

2. The Council acknowledged receipt of the request (6 December 2019) and issued a holding letter (14 January 2019) to the effect that it could not meet the twenty working day deadline. The Council stated it intended to respond no later than 28 January 2019 and explained how to ask for a review of the failure to respond.

3. On 30 January 2019, the Council issued a substantive response to the request, disclosing information to the Applicant but also explaining that it did not hold a full set of information for part (a) of the request. The Council also stated it was withholding some information and cited section 38(1)(b) of FOISA as it believed the numbers in question (less than five) were so low as to enable identification of living individuals.

4. The Applicant wrote to the Council on 19 February 2019, requesting a review of the Council's application of section 38(1)(b) as, in her view, the Council had not shown how identification would be possible. She did not express dissatisfaction with the Council's claim that certain information was not held.

5. On 20 March 2019, the Council notified the Applicant of the outcome of its review, maintaining that identification may be possible by those with some knowledge of the children, using the withheld data.

6. On 8 May 2019, the Applicant wrote to the Commissioner. The Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA, explaining why she did not consider the withheld information to be personal data.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

8. On 5 June 2019, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant and did so on 19 June 2019. The case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. These related to the application of section 38(1)(b) of FOISA, specifically how exactly identification would be possible using the information held.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

11. Given that the Applicant did not express dissatisfaction in her requirement for review, or in her application, with the Council's notice to the effect that information was not held for part (a) of the request, the Commissioner can only consider the information to which the Council applied section 38(1)(b) of FOISA. So far as information was disclosed or withheld in relation to part (a), it related to the situation at the time of the time of the Council's response and therefore cannot be considered to fall within the scope of the request. Therefore, the Commissioner is concerned with the authorities and numbers withheld in relation to part (b) of the request.

Section 38(1)(b) (Personal information)

12. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.

13. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

14. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.

Is the withheld information personal data?

15. The first question the Commissioner must address, therefore, is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. The definition is set out in full in Appendix 1.

16. The Commissioner's briefing on section 38 (Personal information)[1] notes that the two main elements of personal data are that:

(i) the information must "relate to" a living person; and

(ii) the living individual must be identifiable.

17. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

18. An "identifiable living individual" is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).

19. The information withheld by the Council comprises exact numbers and names of authorities attributable to looked-after children placed by the Council in other local authority areas.

20. The Applicant submitted that the information described in this request was essentially summarised and did not include any personal identifiers. In her view, it related to a large enough population that it would not be possible to identify anyone directly from it. She believed the Council had not applied the correct legal tests here and referred to the Breyer v Bundesrepublik Deutschland case, as cited by the Commissioner in his Decision 019/2019: Ms R and Lothian Health Board[2], where the Court of Justice of the European Union took the view that the correct test was whether there was a realistic prospect of someone being identified.

21. The Applicant acknowledged that, when making such a determination, account should be taken of information in the hands of third parties, including those with a particular motivation to trace the individual in question. However, she submitted that there must always be a realistic causal chain - if the risk of identification (using the withheld information) were insignificant, the information would not be personal data - and was not satisfied that there was such a chain in this case.

22. In its submissions, the Council stated that the withheld information related to the location of the child, which was their personal data. In particular, the Council held the view that a determined individual could use the low numbers, in combination with other personal data they would be likely to know already, to work out where a given child was.

23. The Council noted the Applicant's comments on the Beyer v Bundesrepublik Deutschland but stating that it had concluded there was a realistic prospect of these children being identified from the withheld information. If a person, such as a parent, knew the child and had particular reasons for actively looking for them, it submitted, they would already be intimate with the child's personal details and background, and especially determined to glean any more details from wherever they could to help accomplish their goal. The likelihood of identification would be far greater than with an individual who did not know the child at all, and it was a scenario of this nature which the Council believed must be considered when evaluating realistic prospects of identification.

24. The Council also explained that where there were fewer than five individuals either going to or coming from a particular [local authority] area, the circumstances were generally highly unusual. It provided a number of illustrative examples.

25. The Commissioner has considered the Council's arguments and whether these are sufficiently relevant to the information under consideration and the definition of personal data. He acknowledges that the information relates to vulnerable children and that a precautionary approach is likely to be appropriate, should there be the required realistic prospect of identification from that information. However, he is not satisfied that there is such a prospect in this case.

26. Parents, and possibly others, may have strong motivation to seek out certain children and will know something about them already. To be personal data, however, the withheld information would still need to add something of value to the search for the child. Even after consideration of the Council's examples, the Commissioner is not satisfied that this can realistically be said to be the case here. At its most specific, the information would simply locate one (unidentified) child in an area with a population of tens of thousands, in some cases of considerable geographic extent. Even with the more unusual of the Council's scenarios, it does not appear to the Commissioner that such information would be capable of adding real certainty to what would otherwise be speculation and guesswork. If the child were to be identifiable, it is likely that the key to that identification would be what is already known to the third party rather than the information under consideration here.

27. Consequently, the Commissioner does not accept that the withheld information is personal data for the purposes of section 3(2) of the DPA 2018. As a result, the Commissioner finds that the Council was incorrect in applying section 38(1)(b) to the withheld information.

28. Given this finding, the Commissioner concludes that this data is capable of disclosure under FOISA and requires the Council to disclose it to the Applicant.

Decision

The Commissioner finds that, in respect of the matters specified in the application, Moray Council (the Council) failed to comply with Part 1 (and in particular section 1(1)) of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner does not accept that the information withheld falls within the definition of personal data and so finds the Council incorrectly withheld this data under section 38(1)(b) of FOISA.

The Commissioner therefore requires the Council to disclose the withheld information by 4 August 2020.

Appeal

Should either the Applicant or Moray Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If Moray Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that Moray Council has failed to comply. The Court has the right to inquire into the matter and may deal with Moray Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

18 June 2020

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(5) In this section-

"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

…

---