Decision 080/2008 | Scottish Information Commissioner

Home Decisions

Decision 080/2008

Decision 080/2008 Mr Frank French and Scottish Public Services Ombudsman

Service complaints

Reference No: 200700372
Decision Date: 14 July 2008

Summary

Mr French requested copies of service complaints received by the Scottish Public Services Ombudsman (SPSO) along with copies of any investigative reports arising out of those complaints. The SPSO withheld the information on the basis that it was exempt from disclosure under Part 2 of the Freedom of Information (Scotland) Act 2002 (FOISA).

Following an investigation, the Commissioner found that the SPSO had partially failed to deal with Mr French's request for information in accordance with Part 1 of FOISA. The Commissioner found that the SPSO had been correct to withhold the majority of the service complaints made to the SPSO, but generally found that information showing how the complaints had been dealt with should be released, provided that information which identified the complainants, some of the staff complained about and information which the SPSO had received under section 19 of the Scottish Public Services Ombudsman Act 2002, was redacted.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA): sections 1(1) (General entitlement); 2(1), (2)(b), (c) and (e)(ii) (Effect of exemptions); 26(a) (Prohibitions on disclosure); 30(c) (Prejudice to effective conduct of public affairs); 36(2) (Confidentiality); 38(1)(b), (2)(a)(i) and (b) (Personal information) and section 65 (Offence of altering etc. records with intent to prevent disclosure)

Scottish Public Services Ombudsman Act 2002 (SPSO Act): sections 2(1) and (2) (Power of investigation); 19 (Confidentiality of information) and 23(1) (Interpretation) (definition of "complaint" and "request")

Data Protection Act 1998: section 1 (Basic interpretative provisions) (definition of "personal data"); section 2 (Sensitive personal data); 7(1)(c)(i) (Rights of access to personal data); Schedule 1, Part 1, paragraph 1 (The first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of personal data) (condition 6)

Human Rights Act 1998: section 6 (Acts of public authorities)

European Convention on Human Rights and Fundamental Freedoms:Article 8

The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 11 November 2006, Mr French wrote to the SPSO requesting the following information:

All investigation reports for the 56 complaints about service provided by the SPSO in the last 3 years as referenced in a previous FOI response dated 12 June 2006 (request (a))

The number of complaints the SPSO received about the service it provides, and the investigation reports for these complaints, since April 2006 (request (b))

Statistical information regarding the complaints about the SPSO (request (c))

Sections of the SPSO's annual report where statistical information about complaints is included (request (d))

Details of every "shortcoming" with the SPSO service identified and the action taken by the SPSO to prevent the recurrence (request (e))

2.On 12 December 2006, the SPSO wrote to Mr French and provided the following response to his requests for information:

In response to request (a), the SPSO advised him that it does not produce investigative reports on complaints about service

In response to request (b), the SPSO provided figures detailing the number of complaints it had received, whether these had been upheld etc., and explained (as with request (a)) that it does not produce investigative reports on complaints about service

In response to request (c), the SPSO provided a copy of the statistical information it publishes on its website, and also provided a link to its website

In response to request (d), the SPSO provided tabular information which contained a breakdown of the different types of complaints about service it had received

In response to request (e), the SPSO advised Mr French that information resulting from complaints about its service is used to inform its internal improvement process on a ongoing basis

3.On 22 December 2006, Mr French wrote to the SPSO requesting a review of its decision. In particular, Mr French drew the SPSO's attention to his dissatisfaction that no paperwork was available in respect of the SPSO's handling of service complaints (requests (a) and (b)). Mr French also made two new information requests:

Copies of all complaints made by the public regarding the service provided by the SPSO from the date of its establishment in 2002 until 22 December 2006 (request (f))

All letters, emails and record of correspondence between MSPs and the SPSO relating to his own complaints to the SPSO (request (g))

4.On 30 January 2007, the SPSO notified Mr French of the outcome of its review. The SPSO confirmed that it does not produce formal investigation reports into complaints about its service and that there is no provision in the Scottish Public Services Ombudsman Act 2002 (the SPSO Act) requiring the SPSO to consider complaints about its service. It explained that the outcome of consideration of any complaint about its service would be set out in a letter to the complainer. The SPSO added that as these letters contain personal data, it would not provide Mr French (or any third party) with copies of these documents.

5.On the same day, the SPSO wrote a second letter to Mr French in response to his two additional requests for information (requests (f) and (g)). The SPSO informed Mr French that:

The information he sought in request (f) was exempt in terms of the DPA and the duty of confidentiality owed by the SPSO under the SPSO Act to the respective complainers prevented disclosure;

Although the information he sought in request (g) was exempt from disclosure under FOISA (as it constituted his own personal data) the SPSO provided him with copies of the correspondence he requested under section 7 of the DPA.

6.On 6 February 2007, Mr French wrote to the SPSO requesting a review of its decision in respect of request (f). In particular, Mr French drew attention to his dissatisfaction that the SPSO maintained that all of the information he sought contained personal data.Mr French suggested that the SPSO could disclose the correspondence with the personal data redacted.

7.On 7 March 2007, the SPSO notified Mr French of the outcome of its review in respect of request (f). The SPSO reiterated that it does not produce formal investigation reports into complaints about its service. It explained that in terms of the SPSO Act, it had a duty of confidentiality to any complainer, and any member of staff about which it received a complaint. The SPSO also advised Mr French that it considered his request for redacted copies of correspondence relating to complaints about its service to be exempt in terms of section 30(c) of FOISA, since disclosure would be likely to prejudice the effective conduct of the SPSO in the future.

8.On 8 March 2007, Mr French wrote to the Commissioner stating that he was dissatisfied with the outcome of the SPSO's review of requests (a), (b) and (f) and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. In his application, Mr French drew the Commissioner's attention to the fact that he believed the service complaint statistics produced by the SPSO did not include the complaints that he had submitted to the SPSO.Mr French submitted that disclosure of the complaints and investigative reports would reveal that the SPSO was not counting his service complaints and was actually receiving more complaints about its service than it was publicly acknowledging.

9.The application was validated by establishing that Mr French had made requests for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its responses to those requests.

Investigation

10.On 20 March 2007, the SPSO was notified in writing that a valid application had been received from Mr French and was asked to provide the Commissioner with specified items of information required for the purposes of the investigation, including copies of the information which had been withheld from Mr French. The SPSO responded with a sample of the information requested (the SPSO was later asked to provide all of the information withheld from Mr French), and the case was then allocated to an investigating officer.

11.The SPSO wrote to the Commissioner on 5 June 2007 and submitted that in addition to withholding the information from Mr French in terms of sections 30(c) and 38 of FOISA, it also wished to apply the exemptions contained in section 26(a) and 36(2) of FOISA to the correspondence sought by Mr French.

12.The investigating officer subsequently contacted the SPSO, inviting its comments on the application and asking it to respond to specific questions on the application.

13.In later correspondence, the SPSO also provided a brief overview of its complaints handling procedures.The SPSO explained that it differentiates between "service quality" complaints and "comeback" complaints.The SPSO classes complaints as "comeback" when it focuses on disagreement with the SPSO's outcome of an investigation rather than the service the complainant received from the SPSO or the way in which the SPSO handled their complaint.The SPSO submitted that, in this case, the complaints submitted by Mr French were not deemed to be "service quality" complaints, but were considered to be "comeback" and therefore they had not fallen under the scope of his request and were not provided to the Commissioner.

Commissioner's analysis and findings

14.In coming to a decision on this matter, the Commissioner has considered all of the information and the submissions that have been presented to him by Mr French and the SPSO and he is satisfied that no matter of relevance has been overlooked.

The scope of the Commissioner's investigation

15.This decision will consider Mr French's requests for copies of all complaints made by the public regarding the service provided by the SPSO since the new SPSO took up office in 2002 until 22 December 2006, as well as for copies of the responses to those complaints.

16.As noted above, Mr French asked the SPSO to provide him with copies of "investigative reports" prepared in response to service complaints.The SPSO has commented that it does not prepare formal investigative reports for such complaints.However, as part of the investigation, the SPSO provided the Commissioner with the responses which it had prepared to the service complaints.The Commissioner is satisfied that it is reasonable to treat these responses as falling within the definition of "investigative reports" in terms of Mr French's information requests.

17.It should be noted that some of the information which was provided to the Commissioner during the investigation fell outwith the terms of Mr French's request in that it was dated after 22 December 2006.The Commissioner has not, therefore, considered whether any of that information should be provided to Mr French.

Information held by the SPSO

18.As mentioned above, the investigating officer asked the SPSO to provide the Commissioner with copies of all of the information falling within the scope of Mr French's requests and the SPSO subsequently did so.At this point it became clear that the information initially supplied by the SPSO contained documents which were outwith the scope of Mr French's request (as they were dated after 22 December 2006) and that, once these documents were removed, the number of complaints remaining was fewer than was indicated in the SPSO's own complaint statistics.

19.When pressed on this matter, the SPSO identified other documentation which fell within the scope of Mr French's request.The SPSO also advised the Commissioner that, due to an administrative error, some of the information falling within the scope of Mr French's request had been deleted by a member of its staff.The SPSO submitted that this was a genuine oversight, which was due to an honest mistake, and that it had not sought deliberately to withhold information from the Commissioner.The SPSO explained that when the person handling Mr French's information requests was on annual leave, the person responsible for records management was working through a batch of records which were overdue for archiving and destruction, and it was at this time that information relevant to Mr French's requests was destroyed.

20.The SPSO has stressed that many of the documents which were deleted after the Commissioner's investigation began should not have been retained by the SPSO at that time, as they were overdue for destruction.The SPSO provided the Commissioner with the remaining documents it held in relation to Mr French's request for information.

21.Section 65 of FOISA states that it is a criminal offence for information to be destroyed after an information request has been made for it, if that destruction is carried out with the intention of preventing the information being disclosed.A person found guilty of such an offence is liable to a fine of up to ?5000.

22.The Commissioner notes the circumstances surrounding the deletion of the files and he accepts that, in this case, the destruction of materials was due to an administrative mix up and was not a deliberate attempt to destroy requested documents.The Commissioner also notes that if the SPSO had not had a backlog of files, the documents which were accidentally deleted would have been destroyed before Mr French submitted his request.

23.Nevertheless, the Commissioner cannot help but be concerned that documents requested by an applicant were destroyed by the public authority that held them, after it had received the request.A basic requirement of compliance with the legislation is to ensure that such an outcome does not occur. The Commissioner recommends that the SPSO reviews its procedures and staff training to safeguard against any repeat of this error.

24.The Commissioner will now turn to consider the exemptions which have been cited by the SPSO for withholding the information from Mr French.The exemptions cited by the SPSO have been applied to all of the information in its entirety.However, given the number of documents falling within the scope of Mr French's request, where the Commissioner finds that information is exempt under one exemption, he will not go on to consider whether that information is also exempt under one or more of the other exemptions cited by the SPSO.

Consideration of section 38(1)(b)

25.Under section 38(1)(b) of FOISA (read in conjunction with section 38(2)(a)(i) or 38(2)(b)), information is exempt information if it constitutes personal data and the disclosure of the information to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in schedule 1 to the DPA.

26.In this case, the SPSO has stated that disclosure under FOISA of the information requested by Mr French would breach the first data protection principle.

27.In considering this exemption, the Commissioner is required to consider two separate matters: firstly, whether the information under consideration is personal data and, if so, whether the release of the information to Mr French would indeed breach the first data protection principle.

28.It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

29."Personal data" are defined in section 1(1) of the DPA as follows:

"data which relate to a living individual who can be identified ?

a)from those data, or

b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

30.The correspondence requested by Mr French varies in content.Roughly half of the correspondence is from complainants to the SPSO (including a small number of file notes where the SPSO has noted complaints made over the telephone), with the remainder constituting the SPSO's response to those complaints.It is clear that all of the letters from individuals to the SPSO are comprised of the personal views of that individual, and many of the complaints contain biographical information relating to the complainant or other third parties.On many occasions, this includes detailed information about a person's medical condition.The Commissioner is satisfied that the content of all of the letters written to the SPSO by individuals constitute personal data, in that the information is comprised of data which relate to a living individual who can be identified from those data or from those data and other information which is in the possession of the data controller, i.e. the SPSO.In some cases (e.g. where there is a reference to medical information), the personal data is sensitive personal data as defined by section 2 of FOISA.

31.A small number of the complaints to the SPSO come from public authorities or other organisations which are being, or which have been, investigated by the SPSO.Some of the correspondence includes the names and/or addresses of the individuals who initially complained to the SPSO about the public authorities and, for the reasons set out above, the Commissioner is satisfied that this falls into the definition of personal data as defined by section 1(1) of FOISA.However, much of the remainder of the content of these documents is not personal data, given that the information relates to a public authority or other organisation rather than to a living individual (as required by section 1(1) of the DPA) and is therefore outwith the scope of the exemption contained in section 38(1)(b).As with the responses from the SPSO (see below), the correspondence contains the names of public authority staff members or people who work with the organisation who have, e.g., instituted the complaint and the Commissioner is satisfied, for the reasons given above, that that information constitutes personal data.

32.With regard to the written responses from the SPSO to the complainants, the Commissioner has noted that many of the responses refer to the personal views or biographical and/or medical information which featured in the complainant's initial letter.They also include the names of the SPSO staff members who have been involved with the complainant.As such, the Commissioner is satisfied that this information does constitute personal data.

33.In summary, the Commissioner is satisfied that all of the letters to the SPSO from individual complainants constitute personal data in their entirety; that parts of the complaints to the SPSO from public authorities or other organisations is personal data; and that parts of the SPSO's responses to the complainants comprise personal data.

The first data protection principle

34.The Commissioner will now consider whether disclosure of this personal data would breach the first data protection principle.

35.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (of the DPA) is met, and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (again, of the DPA) is also met.

36.Section 2 of the DPA defines "sensitive personal data".As noted above, some of the personal data withheld from Mr French is personal data consisting of information as to a data subject's physical or mental health or condition in line with section 2(e) of the DPA.Sensitive personal data appears both in the complaints to the SPSO and in the responses to the complaints.

37.The SPSO has not made any submissions which suggest that disclosure of the information requested by Mr French would be unlawful, other than by contravening the first data protection principle.In what follows below, the Commissioner will focus in turn whether disclosure of this information would be fair, and whether any of the conditions set out in Schedules 2 (and, firstly, where the personal data is sensitive personal data, Schedule 3) of the DPA can be met in this case.

Is it fair to release sensitive personal data?

38.The Commissioner has considered whether the disclosure of the sensitive personal data would be permitted by one of the conditions in Schedule 3.Sensitive personal data is afforded a level of protection through the DPA that goes beyond that provided to non-sensitive personal data.The Commissioner has examined all of the conditions in Schedule 3 of the DPA and has concluded that none of them permits disclosure of sensitive personal data in this case.

39.As a consequence, the Commissioner considers that disclosure of the sensitive personal data would breach the first data protection principle and that, as result, the sensitive personal data contained in the documents withheld from Mr French is exempt in terms of section 38(1)(b).

Is it fair to release non-sensitive personal data of the complainants or third parties?

40.The Information Commissioner, who is responsible for enforcing and regulating the DPA throughout the UK, has published guidance which assists in coming to a decision as to whether the disclosure of information is fair: "Freedom of Information Act Awareness Guidance No 1", which can be viewed at:http://www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/awareness_guidance%20_1_%20personal_information_v2.pdf).

41.According to this guidance, the assessment of fairness includes looking at whether the disclosure would cause unnecessary or unjustified distress or damage to the person whom the information is about, whether the third party would expect that his/her information might be disclosed to others and/or whether the third party would expect that his/her information would be kept private. In addition, this guidance also states that:

"Information which is about the home or family life of an individual, his or her personal finances, or consists of personal references, is likely to deserve protection. By contrast, information which is about someone acting in an official or work capacity should normally be provided on request unless there is some risk to the individual concerned."

42.The guidance goes on to indicate, however, "that these are not hard and fast rules". It states that: "While names of officials in public facing roles would normally be provided on request, it may not be fair processing to provide the name of a member of staff in a junior role? It may also be relevant to think about the seniority of staff generally: the more senior a person is the less likely it will be that to disclose information about him or her acting in an official capacity would be unfair".

43.In its submissions to the Commissioner, the SPSO has argued, quite correctly, that personal data encompasses more than just names and addresses and that the correspondence in question includes other personal data relating to complainants and other third parties.The SPSO has also argued that it has to consider whether any other party could identify an individual as a result of the content of the correspondence being published.The SPSO has argued that none of the conditions in Schedule 2 of the DPA would permit release of the information sought in this case.

44.The SPSO has also submitted that it would be unfair to disclose negative, derogatory or unjustified comments made by complainants about individual SPSO staff members.The SPSO has argued that while some complaints may be justified, the majority are simply individuals expressing dissatisfaction with the outcome of the SPSO investigation into their complaint.The SPSO has argued that publication of these comments would be detrimental to staff morale and may influence complainants to discriminate against specific members of SPSO staff.In addition, the SPSO has submitted that any complaint regarding the professional conduct or performance of a member of staff could be noted on their personnel record and would be deemed confidential and not made public.The SPSO has argued that its own investigative reports do not name individual members of staff within the authorities it deals with, and therefore it would not be prepared to name them by releasing the information withheld in this case.

45.The SPSO has submitted that if it were to release the requested documents, they would have to be anonymised to the same degree as the investigative reports it produces, which would be an extremely time-consuming process and would involve, in some cases, an almost complete re-write to enable them to make sense. The SPSO has argued that simply redacting the personal data contained within the correspondence would render many of the documents incomprehensible.

46.The Commissioner has considered all of the SPSO's submissions and has concluded that disclosure of the personal data relating to complainants (or any third parties mentioned by complainants) in this case would not be fair to the individuals concerned.In reaching this conclusion, the Commissioner has taken into account the fact that the complainants (and any third parties named by the complainants) had no reasonable expectation that the content of their correspondence would be placed in the public domain.In many cases, complainants have reiterated, in some detail, the very personal experiences which led them to seek the assistance from the SPSO.The Commissioner believes that the complainants only wrote so candidly because they were under the impression that the information they were imparting would be protected by the SPSO and would not be publicly disclosed.

47.In relation to the names of SPSO staff members, it will normally be the case that the higher the position and the greater the authority of an individual, the greater is the argument for openness, transparency and accountability and the more likely it is that disclosure of their names, etc. would be fair.In this case, the correspondence makes reference to more junior SPSO staff (such as investigative officers and personal assistants), senior SPSO staff (such as the Service Quality Manager) and officeholders including the Ombudsman herself and the (then) Deputy Ombudsmen.

48.The Commissioner has concluded that it would be unfair to disclose the names of junior members of SPSO staff (such as investigative officers, personal assistants or complaints managers), as they would have no expectation that they would be identified in relation to the type of correspondence in question.However, the Commissioner does not consider that it would be unfair to disclose the names of senior SPSO staff or officeholders in the SPSO.The Ombudsman herself is the public face of the SPSO and consequently has little expectation of privacy in relation to her public post.In addition, as it is the Ombudsman who signs all of the SPSO investigative reports, it is the Commissioner's view that it would not be unfair to disclose mention of her name in the sought correspondence. While the (then) Deputy Ombudsmen and Service Quality Manager do not have the same level of public exposure as the Ombudsman, they do have a public facing role and have responsibility for responding to complainants in relation to service issues.In light of this, the Commissioner is of the view that it would be reasonable for them to expect their names to be published in the context of service complaints and responses, and that disclosure of their names in this context would be fair.

49.As the Commissioner has determined that it would be unfair to disclose the personal data of complainants (and any third parties named by the complainants) and the names of junior members of SPSO staff, and the first principle requires the processing to be both fair and lawful, he is satisfied that disclosure of this personal data would breach the first data protection principle and, accordingly, that the personal data is exempt in terms of section 38(1)(b) of FOISA.

50.However, as the Commissioner has determined that it would be fair to disclose the names of office holders and senior members of SPSO staff, he has considered whether any of the conditions set out in Schedule 2 of the DPA might be met in this case.

51.It is the Commissioner's view that condition 6(1) of Schedule 2 of the DPA is the only condition which might be considered to apply in this case. Condition 6(1) allows personal data to be processed (in this case, disclosed in line with an information request made under section 1(1) of FOISA) if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

52.The application of condition 6(1) involves a balance between competing interests broadly comparable, but not identical, to the balance that applies when considering the public interest test in section 2 of FOISA.Condition 6(1) requires a consideration of the balance between (i) the legitimate interests of Mr French and (ii) prejudice to the rights, freedoms and legitimate interests of the data subjects, which, in this case, are senior members and office holders in the SPSO.However, because the processing must be "necessary" for the legitimate interests of members of the public to apply, only where (i) outweighs or is greater than (ii) should the personal data be disclosed.

53.In considering the legitimate interests of Mr French, the Commissioner accepts that there is a legitimate and significant interest in knowing the names of the office holders and senior staff within the SPSO who have responsibility for handling service complaints within the SPSO and for communicating the outcome of those complaints to the individual complainants. The Commissioner is satisfied that this interest legitimately extends beyond knowing the numbers of complaints handled and whether they were upheld or not, to knowing the names of those responsible for investigating such complaints.

54.The Commissioner has considered whether these interests might be met equally effectively by a means other than by disclosure of the information requested by Mr French, and he has concluded that they cannot.

55.Turning to consider any prejudice to the rights, freedoms and legitimate interests of the data subjects, the Commissioner is aware that this disclosure will lead to their identification as SPSO officeholders and staff who have (or, at the time of dealing with the service complaint, had) a responsibility for handling service complaints.This could, he accepts, lead to communications being directed to these individuals by complainants who wish to complain directly to them instead of following SPSO procedures for submitting service complaints. However, he is satisfied that any such intrusion following from this disclosure would be of a nature and extent which would be expected by those working at a high level in the SPSO and procedures can be put in place by the SPSO to deal with such an eventuality .

56.Having balanced the two competing interests in this case, the Commissioner is satisfied that any prejudice to the rights, freedoms and legitimate interests of the data subjects (i.e. officeholders and senior staff of the SPSO) is outweighed (and so is not unwarranted) in this instance by the legitimate interests of Mr French.

57.He therefore finds that condition 6(1) of Schedule 2 of the DPA is met in this case.

58.As noted above, no separate arguments have been submitted to the Commissioner as to why disclosure of this information would otherwise be unlawful in terms of the first data protection principle.

59.The Commissioner therefore finds that the disclosure of the names of the senior members of staff and of the office holders would not breach any of the data protection principles and that, accordingly, this information is not exempt under section 38(1)(b).

60.The Commissioner will now consider the remainder of the information (which he has not deemed to be exempt under section 38(1)(b)) in conjunction with the other exemptions the SPSO has applied in this case.

Consideration of section 26(a)

61.Section 26(a) of FOISA exempts information under FOISA where disclosure of the information is prohibited by or under any enactment. This is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.

62.The SPSO has argued that the disclosure of the information requested by Mr French is prohibited by two other pieces of legislation, i.e. the Human Rights Act 1998 (HRA) and the Scottish Public Services Ombudsman Act 2002 (the SPSO Act).

The Human Rights Act 1998

63.The SPSO has argued that disclosure of the information requested by Mr French is prohibited by the HRA. In particular, the SPSO has asserted that release of the correspondence requested by Mr French would breach the privacy rights of the complainants and would consequently breach article 6(1) of the HRA, which provides that it is unlawful for a public authority to act in a way that is incompatible with European Convention on Human Rights("the ECHR").

64.It is clear that the SPSO falls within the definition of "public authority" in the HRA.In this case, the SPSO considered that making an individual's correspondence generally available to the public (especially where its content is highly personal and biographical) is not compatible with Article 8 of the ECHR, which confers a right to respect for private and family life, home and correspondence.

65.Article 8 of the ECHR states that "everyone has the right to respect for his private and family life, his home and his correspondence".Article 8 goes on to say that "there shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others".

66.In terms of Article 8 of the ECHR, everyone has the right to respect for their private and family life, home and correspondence.In this case, the correspondence which has been sought (and which includes details of individual's private and family life) has already been excluded from disclosure by the Commissioner's decision to uphold the application of 38(1)(b) to the personal data contained within the correspondence.The Commissioner is therefore not required to go on to consider whether the disclosure of the information would breach the HRA and, consequently, whether the disclosure of this information is exempt in terms of section 26(a) of FOISA.

The Scottish Public Services Ombudsman Act 2002

67.Section 19 of the SPSO Act sets out specific conditions under which information obtained by the SPSO can be disclosed (section 19 is set out in full in the decision).The SPSO has asserted that, as the information in this case is not being requested for any of the reasons set out in section 19 of the SPSO Act, the information sought by Mr French is exempt from disclosure in terms of section 26(a) of FOISA.

68.On the other hand, Mr French has argued that the SPSO Act does not prohibit the SPSO from disclosing any information regarding complaints it has received into the services it provides.Mr French has asserted that section 19 of the SPSO Act, and in particular section 19(3),actually indicates that the SPSO can disclose any information in relation to a matter it has investigated.

69.Section 19(1) of the SPSO Act states that:

"Information obtained by the Ombudsman or any of the Ombudsman's advisers in connection with any matter in respect of which a complaint or a request has been made must not be disclosed except for any of the purposes specified in subsection (2) or as permitted by subsection (3)".

70.Sections 19(2) and (3) go on to set out the very limited purposes for which information can be disclosed.

71.Mr French has requested information on complaints made to the SPSO, and so, on an initial reading of section 19, it might appear that all of the information which he has requested is confidential in terms of section 19 and, accordingly, exempt under section 26(a) of FOISA.

72.However, there are some difficulties with this approach, and it is necessary to consider what exactly is meant by the term "complaint" in section 19(1) and (2) of the SPSO Act and whether the type of complaint Mr French has asked for information about is the same type of complaint envisaged by section 19(1).The Commissioner takes a different view on this from the SPSO.

73.Section 2 of the SPSO Act sets out the types of matters which the SPSO is entitled to investigate.An investigation may come about as a result of a complaint to the SPSO or where a person who is liable to be investigated has requested the SPSO to investigate a matter.However, in both of these cases, it is clear from section 2 that the power of the SPSO to carry out an investigation is limited to matters consisting of action taken by or on behalf of a person liable to investigation under the SPSO Act and matters which the SPSO is entitled to investigate.Schedule 2 to the SPSO Act lists the authorities which are liable to investigation by the SPSO, but, perhaps for obvious reasons, the SPSO does not appear in this list.

74.This gives credence to the view taken by the Commissioner that section 19 is not designed to prevent information regarding service complaints made to the SPSO about the way in which it carried out investigations etc. being made available.

75.This view is further supported by the fact that section 23 of the SPSO Act defines the word "complaint" as a complaint made to the SPSO rather than about the SPSO and also by the fact that the SPSO has recognised that it has no statutory requirement to carry out investigations into complaints made about its level of service etc. (see the discussion on the section 30 exemption below).

76.As a result, the Commissioner is satisfied that section 19 of the SPSO Act does not prohibit the disclosure of information relating to complaints made to the SPSO about its service, whether the information has been received from the person making the complaint (on the basis that a service complaint about the SPSO is not covered by section 19) or the information is the response by the SPSO to the complaint (the information must, in terms of section 19(1), have been obtained by the SPSO).

77.However, that is not the end of the matter.The Commissioner accepts that, under section 19 of the SPSO Act, the SPSO has no power to disclose information which was originally obtained by it in respect of a complaint or a request made to it under section 2 of the SPSO Act.As is to be expected, in many cases the service complaints made to the SPSO (which the Commissioner has found, except in a very limited number of cases, to be exempt from disclosure under section 38(1)(b) in any event) repeat information which was provided to the SPSO in the initial complaint.Similarly, it is common for the response to the service complaint to contain information which was provided to the SPSO in the initial complaint.In both of these cases, the Commissioner is satisfied that disclosure of the information is prohibited by section 19(1) and is, accordingly, exempt from disclosure under section 26(a) of FOISA.

78.As noted above, Mr French is of the view that sections 19 of the SPSO Act permits the SPSO to disclose the information to him and that, as a result, section 19 of the SPSO does not act as a prohibition on disclosure in terms of section 26(a) of FOISA.However, the Commissioner disagrees with Mr French to the extent that the information relates to information which was provided to the SPSO in relation to a complaint under section 2 of the SPSO Act.The Commissioner also disagrees that section 19(3) permits the SPSO to disclose information to him.Section 19(3) does permit the SPSO to disclose information in the interests of the health and safety of patients, but the information which the SPSO is entitled to disclose is very limited and the Commissioner does not consider that section 19(3) has any relevance to this case.

79.To summarise the position, therefore, the Commissioner is satisfied that any information obtained by the SPSO in relation to an investigation under section 2 of the SPSO Act is prohibited from disclosure and is accordingly exempt in terms of section 26(a) of FOISA.However, given that the Commissioner does not consider, for the reasons set out above, that service complaints fall within the definition of "complaint" in section 19(1) of the SPSO Act, any information contained within the service complaint (and the response thereto) which was not provided to the SPSO in relation to a complaint under section 2 of the SPSO Act is not subject to the prohibition of disclosure under section 19(1) of the SPSO Act and, accordingly, is not exempt under section 26(a) of FOISA.It may of course be exempt under one or more of the other exemptions in FOISA.

Consideration of section 36(2)

80.The Commissioner will now consider whether the remainder of the information (i.e. the information which he has not already found to be exempt in terms of section 26 or 38(1)(b) of FOISA) is exempt under section 36(2) of FOISA.In effect, this means that the Commissioner is considering whether the following information is exempt under section 36(2):

Service complaints made by public authorities or organisations to the SPSO (minus any personal data, the disclosure of which would breach the first data protection principle)

The responses by the SPSO to all of the service complaints (minus any personal data, the disclosure of which would breach the first data protection principle, and any information which was obtained by the SPSO in connection with a complaint made under section 2 of the SPSO Act).

81.It should be noted that the submissions made by the SPSO related to the information in its entirety, rather than to the narrow set of information now being considered by the Commissioner.

82.Section 36(2) of FOISA states that information is exempt information if it was obtained by a Scottish public authority from a third party and its disclosure by that authority would constitute a breach of confidence actionable by that person or any other person.The exemption is absolute in that it is not subject to the public interest test required by section 2(1)(b) of FOISA.However, it is generally accepted in common law that an obligation of confidence will not be enforced to restrain the disclosure of information which is in the public interest.

83.Section 36(2) therefore contains a two stage test, both parts of which must be fulfilled before the exemption can be relied upon. Firstly, the information must have been obtained by a Scottish public authority from another person. "Person" is defined widely and includes another individual, another Scottish public authority or any other legal entity.

84.The SPSO has argued that as the documents sought by Mr French were obtained by the SPSO from another person, their disclosure would constitute an actionable breach of confidence.It has reiterated that section 19 of the SPSO Act gives assurances to complainants that their correspondence will not be made available to the general public (the Commissioner's views on section 19 are set out above).

85.Given that this exemption only applies to information which the SPSO has obtained from a third party (and the consideration of this exemption has been limited to service complaints from public authorities), then the Commissioner considers that this exemption cannot apply to information which originated from the SPSO itself and not from a third party.Therefore, while it is possible that the service complaints from the public authorities would all pass this first test, it is not the case that the entire response from the SPSO, containing as they do information which originates from the SPSO itself, will do the same.

86.The second part of the test associated with 36(2) is that the disclosure of the information by the public authority would constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person.The Commissioner takes the view that actionable means that the basic requirements for a successful action must appear to be fulfilled.

87.In order for information to be confidential, it must at least be clear that the information was imparted in circumstances which gave rise to a reasonable expectation of privacy.

88.The complaints under consideration originate from individuals within authorities or organisations and the Commissioner considers that the author is representing the views of the authority/organisation.There is nothing in the letters to suggest that the body submitting the complaint wants the information to be kept confidential or private or to suggest that the SPSO received the information in circumstances from which an obligation on it to maintain confidentiality could be inferred.Furthermore, the Commissioner is of the view that authorities which choose to submit complaints to another public body will, in general, have fewer expectations of privacy (relating to the correspondence) than individuals, particularly where, as with the majority of the bodies which submitted a complaint, the body is itself a Scottish public authority for the purposes of FOISA.

89.The Commissioner therefore does not consider that the information in question is exempt in terms of section 36(2) of FOISA.

90.The Commissioner will now consider the remainder of the information (which he has not already exempted in terms of section 26 or 38(1)(b) of FOISA) in terms of section 30(c) of FOISA, which the SPSO has also applied to all of the withheld information in this case.The information to be considered, therefore, is that summarised in paragraph 80 above.

Consideration of section 30(c)

91.Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs". (The word "otherwise" is used here to differentiate this particular exemption from the other types of substantial prejudice ? such as substantial inhibition to the free and frank provision of advice or exchange of views ? envisaged by other parts of section 30.) Section 30(c) is a qualified exemption and, if it is found to apply to information, is subject to the public interest test required by section 2(1)(b) of FOISA.

92.There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers that in order to claim this exemption, the damage caused by disclosing information would have to be very real or very likely, not hypothetical. The harm caused must be significant, not marginal and it would have to occur in the very near future, not in some distant time. If a public authority is applying this exemption, he would expect it to be able to show what kind of harm would result and why this would be the expected outcome if the information in question was released.

93.Again, it should be noted that the submissions from the SPSO which are summarised below were made in relation to the information withheld from Mr French in its entirety.While the Commissioner considers that it is likely that at least part of the information withheld from Mr French would have been exempt under this exemption, he will only consider the exemption as it relates to the information which he has not already found to be exempt.

94.The SPSO has argued that release of the information is likely to prejudice substantially the effective conduct of public affairs, due to the effect it would have on its future handling of complaints about its service.The SPSO maintains that its main concern is that members of the public would be dissuaded from writing to the SPSO if they knew that their correspondence would be publicly disclosed.Additionally, the SPSO has argued that even if members of the public continued to contact them, it is likely that the possibility of their correspondence being made public would result in letters which are less frank and less open.The SPSO has concluded that the effects of it having to publish service quality complaint correspondence would be likely to make the process either so unmanageable or so uninformative that it would have to consider withdrawing the process altogether.

95.In his submissions, Mr French has suggested that by not disclosing the information he has requested, the SPSO is not following the same rigorous system of complaints handling that it is advising other bodies to offer.Mr French has asserted that public disclosure of the information he seeks would ensure that the SPSO is working to the same fundamental principles that it expects all other public bodies under its jurisdiction to work to.

96.The Commissioner has considered the submissions by both parties and he is not persuaded that disclosure of the restricted amount of information which he is now considering in line with section 30(c) would, or would be likely to, prejudice substantially the effective conduct of public affairs.The Commissioner does not accept (and he has been provided with no evidence to persuade him otherwise) that disclosure of SPSO's responses to service complaints (with personal data and information which is prohibited from disclosure redacted) would dissuade any future member of the public from complaining to the SPSO.The SPSO has argued that if it was forced to publish its own responses to complaints, it would have to adopt new procedures for complaints handling, and that any future responses it produced would be written with publication in mind.The SPSO has also argued that if this occurred, the responses would be less personal, less open and less descriptive and would consequently be less relevant to the complainant.

97.However, as the Commissioner has already found that the personal data of complainants should not be disclosed, and that neither should information relating to any previous SPSO investigation, the Commissioner sees no reason why the SPSO's future responses to service complaints should be so impersonal as to be irrelevant to the individual who submitted the complaint.The Commissioner would expect the content of future responses by the SPSO to continue to be relevant and appropriate in content regardless of whether it may have to publish redacted versions of its responses.

98.In its submissions, the SPSO has also stressed that the SPSO Act does not oblige it to operate a system for dealing with complaints about its own service.It has argued that if it was obliged to publish service quality correspondence, it would become such an unmanageable or uninformative process that it would have to consider withdrawing a service complaints service altogether.

99.The Commissioner cannot accept this argument. He finds it unlikely that a body which was established to investigate complaints against organisations providing public services in Scotland would threaten to withdraw its own service complaints handling service if it is required to publish redacted responses to complainants.He does not believe that the SPSO would withdraw its service complaints handling service, nor does he accept that it is appropriate for it to do so.

100.In summary, the Commissioner concludes that disclosure of the content of the correspondence (which has not already been found exempt in terms of section 38(1)(b) or 26(a)) in this case would not, or would not be likely to, prejudice substantially the effective conduct of public affairs, and consequently he does not uphold the application of section 30(c) of FOISA. As the Commissioner has not upheld the exemption contained in section 30(c) of FOISA, he is not required to consider the public interest test.

Redaction of information

101.The Commissioner notes the concerns raised by the SPSO that redacting information from the correspondence would be extremely time consuming and would involve, in some cases, an almost complete re-write to enable them to make sense.However, the Commissioner has redacted the information which he considers to be exempt from disclosure under FOISA from the correspondence provided to him by the SPSO and finds that the basis of the complaint made to the SPSO (and the way in which the complaint was responded to) remains clear from the non-redacted information.The Commissioner will provide the SPSO with a copy of the information which he considers requires to be redacted in line with his decision.

DECISION

The Commissioner finds that the Scottish Public Services Ombudsman (SPSO) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr French.

The Commissioner finds that by withholding the personal data of complainants (and any third parties mentioned by complainants) and the names of SPSO junior staff in terms of section 38(1)(b) of FOISA, the SPSO complied with Part 1.The Commissioner also finds that the SPSO was correct to withhold some of the information supplied to it under section 19 of the Scottish Public Services Ombudsman Act 2002 in terms of section 26(a) of FOISA.

However, by withholding the remaining information in terms of section 26(a), 30(c), 36(2) and 38(1)(b) the SPSO failed to comply with Part 1 of FOISA.

The Commissioner therefore requires the SPSO to release to Mr French copies of all of its responses to service complaints (minus information redacted in terms of 38(1)(b) and 26(a) as outlined above) along with copies of complaints from authorities to the SPSO (minus information redacted in terms of section 38(1)(b) and section 26(a) as outlined above) that fall within the scope of Mr French's request by Friday 29 August 2008.

Given that information which fell within the scope of Mr French's request was deleted by the SPSO during the Commissioner's investigation, the Commissioner also recommends that the SPSO reviews its procedures and staff training to safeguard against any repeat of this error.

Appeal

Should either Mr French or the SPSO wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
14 July 2008

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection (1), the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

(b) section 26

(e) in subsection (1) of section 38 ?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

26 Prohibitions on disclosure

Information is exempt information if its disclosure by a Scottish public authority (otherwise than under this Act) -

(a) is prohibited by or under an enactment;

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

36 Confidentiality

(2) Information is exempt information if-

(a) it was obtained by a Scottish public authority from another person (including another such authority); and

(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.

38 Personal information

(1) Information is exempt information if it constitutes-

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

65 Offence of altering etc. records with intent to prevent disclosure

(1) Where ?

(a) a request for information is made to a Scottish public authority; and

(b) the applicant is, under section 1, entitled to be given the information or any part of it,

a person to whom this subsection applies who, with the intention of preventing the disclosure by the authority of the information, or part, to which the entitlement relates, alters, defaces, blocks, erases, destroys or conceals a record held by the authority is guilty of an offence.

(2) Subsection (1) applies to the authority and to any person who is employed by, is an officer of, or is subject to the direction of, the authority.

(3) A person guilty of an offence under subsection (1) is liable, on summary conviction, to a fine not exceeding level 5 on the standard scale.

Scottish Public Services Ombudsman Act 2002

2 Power of investigation

(1) The Ombudsman may investigate any matter, whenever arising, if ?

(a) the matter consists of action taken by or on behalf of a person liable to investigation under this Act;

(b) the matter is one which the Ombudsman is entitled to investigate, and

(2) The Ombudsman may investigate any matter, whenever arising, if ?

(a) paragraphs (a) and (b) of subsection (1) are satisfied, and

(b) the person liable to investigation has requested the Ombudsman to investigate the matter.

19 Confidentiality of information

(1) Information obtained by the Ombudsman or any of the Ombudsman's advisers in connection with any matter in respect of which a complaint or a request has been made must not be disclosed except for any of the purposes specified in subsection (2) or as permitted by subsection (3).

(2) Those purposes are -

(a) the purposes of?

(i) any consideration of the complaint or request (including any statement under section 11),

(ii) any investigation of the matter (including any report of such an investigation),

(b) the purposes of any proceedings for?

(i) an offence under the Official Secrets Acts 1911 to 1989 alleged to have been committed in respect of information obtained by the Ombudsman,

(ii) an offence of perjury alleged to have been committed in the course of any investigation of the matter,

(d) the purposes of any proceedings under section 14.

(3) Where information referred to in subsection (1) is to the effect that any person is likely to constitute a threat to the health or safety of patients, the Ombudsman may disclose the information to any person to whom the Ombudsman thinks it should be disclosed in the interests of the health and safety of patients.

(4) In relation to information disclosed under subsection (3), the Ombudsman must?

(a) where the Ombudsman knows the identity of the person to whom the information relates, inform that person of the disclosure of the information and of the identity of the person to whom it has been disclosed, and

(b) inform the person from whom the information was obtained of the disclosure.

(5) It is not competent to call upon the Ombudsman or the Ombudsman's advisers to give evidence in any proceedings (other than proceedings referred to in subsection (2)) of matters coming to the knowledge of the Ombudsman or advisers in connection with any matter in respect of which a complaint or request has been made.

(6) A member of the Scottish Executive may give notice in writing to the Ombudsman with respect to?

(a) any document or information specified in the notice, or

(b) any class of document or information so specified,

that, in the opinion of the member of the Scottish Executive, the disclosure of the document or information, or of documents or information of that class, would be contrary to the public interest.

(7) Where such a notice is given nothing in this Act is to be construed as authorising or requiring the Ombudsman or any of the Ombudsman's advisers to communicate to any person or for any purpose any document or information specified in the notice, or any document or information of a class so specified.

(8) Information obtained from the Information Commissioner by virtue of section 76 of the Freedom of Information Act 2000 (c. 36) is to be treated for the purposes of subsection (1) as obtained in connection with any matter in respect of which a complaint or request has been made.

(9) In relation to such information, subsection (2)(a) has effect as if?

(a) the reference in sub-paragraph (i) to the complaint or request were a reference to any complaint or request, and

(b) the reference in sub-paragraph (ii) to the matter were a reference to any matter.

(10) In this section and section 20 references to the Ombudsman's advisers are to persons from whom the Ombudsman obtains advice under paragraph 10 of schedule 1.

23 Interpretation

(1) In this Act, unless the context otherwise requires ?

"complaint" means a complaint to the Ombudsman

"request" means a request for an investigation under section 2(2).

Data Protection Act 1998

1 Basic interpretative provisions

In this Act, unless the context otherwise requires ?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

(a) the racial or ethnic origin of the data subject,

(b) his political opinions,

(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),

(e) his physical or mental health or condition,

(f) his sexual life,

(g) the commission or alleged commission by him of any offence, or

(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

7 Right of access to personal data

(1) Subject to the following provisions of this section and to sections 8, 9, and 9A, an individual is entitled ?

(i) the information constituting any personal data of which that individual is the data subject ?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

...

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6.(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Human Rights Act 1998

6 Acts of public authorities

(1) It is unlawful for a public authority to act in a way which is incompatible with a Convention right.

European Convention on Human Rights and Fundamental Freedoms

Article 8

(1) Everyone has the right to respect for his private and family life, his home and his correspondence.

(2) There shall be no interference by a public authority with this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.