Decision 080/2020: Looked after children in care

Public authority: Dumfries and Galloway Council
Case Ref: 201900816

Summary

The Council was asked for statistical data covering a five year period 2013-2018, concerning looked-after children (a) placed in Dumfries and Galloway by other local authorities and (b) placed outwith Dumfries and Galloway by the Council.

To the extent that it held the information, the Council responded by disclosing some information but withholding some low figures (less than five) under section 38(1)(b) of FOISA. It claimed that disclosure would contravene the first data protection principle as it believed identification of living individuals was possible from this information.

The Commissioner was not satisfied from the Council's submissions that children could be identified from the information. Consequently, he did not accept that the information was personal data and ordered disclosure.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b) and (5) (definition of "personal data") (Personal information)

Data Protection Act 2018 (the DPA 2018) sections 3(2) and (3) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 3 December 2018, the Applicant made a request for information to Dumfries and Galloway Council (the Council), asking for information for "the past five financial years (2013/14, 2014/15, 2015/16, 2016/17, and 2017/18)" about looked-after children placed in care:

(a) in the Council's area, by other local authorities, and

(b) from the Council's area, in other local authority areas.

For each year, the Applicant asked for both a list of all the authorities that had placed children in the Council's area/had children placed in their areas by the Council, and the number of children involved in each case.

2. The Council responded on 18 February 2019, to the effect that the information for part (a) of the request was not held. It confirmed it held data for part (b) and for each year disclosed a list of the authorities concerned and the total number of children.

3. On 19 February 2019, the Applicant wrote to the Council, seeking a review of its decision on the basis that it had provided an incomplete response. She reiterated that she was seeking a breakdown of the number of children by authority.

4. The Council notified the Applicant of the outcome of its review on 26 February 2019, providing some information but withholding figures of less than five under section 38(1)(b) of FOISA (Personal information).

5. On 16 May 2019, the Applicant wrote to the Commissioner. The Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA, explaining why she did not consider the withheld information to be personal data.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 26 June 2019, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. The questions related to the application of section 38(1)(b) of FOISA, including the Council's reasons for claiming the withheld information to be personal data.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) (Personal information)

10. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the General Data Protection Regulation (the GDPR).

11. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

12. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.

Is the withheld information personal data?

13. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. The definition is set out in full in Appendix 1.

14. The Commissioner's briefing on section 38[1] notes that the two main elements of personal data are that:

(i) the information must "relate to" a living individual; and

(ii) the living individual must be identifiable.

15. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

16. An "identifiable living individual" is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).

17. The Applicant submitted that the data described in this request was summarised data, not including any personal identifiers and relating to large enough population sizes that it would not be possible to identify anyone directly. She did not believe any realistic causal chain had been put forward which would allow a third party to identify anyone

18. The Council acknowledged that it was not possible to directly identify an individual solely form the withheld information, but submitted that it still believed looked after children would be identifiable if this data were published. It explained that a combination of the low numbers, the specific circumstances and the rural nature of the region made this possible. The Council considered the likelihood of an individual being identified if this particular withheld information were published to be sufficient to enable identification of living individuals.

19. The Council submitted that new children would be readily recognisable in a rural region such as Dumfries and Galloway, particularly if they came from another region. It submitted that placing the information in the public domain would allow it to be shared in any way, including by social media, possibly facilitating speculation (an example was provided, relating to a similarly sensitive situation but not directly to looked after children).

20. The Commissioner has considered the Council's submissions. The Applicant did not challenge the Council's claim that information for part (a) of the request was not held, so the focus of this decision is part (b), relating to children placed by the Council in other areas. The Council's submissions do not relate directly to that situation, but the Commissioner will consider what relevance they can be considered to have in the circumstances: a number of the areas in which the Council has placed children would appear to be large rural ones, not dissimilar to Dumfries and Galloway.

21. From the Council's relatively sketchy submissions, it is not apparent how the withheld information would contribute meaningfully to identification. None of the areas concerned are exactly small in population terms, and neither are most of them small geographically. Undoubtedly, a new child will stand out in a small rural school and it may be obvious that they come from elsewhere. Inevitably, children will share some information about their personal circumstances with their peers, even if they understand that there is some information they should not share. Equally, in a small community, it is likely to be widely known that certain people (with whom children live) are foster carers. It is also entirely possible that people in a small community will speculate about where a particular "new" child has come from: it does not necessarily follow that disclosure of the withheld information will contribute to making that speculation something more concrete.

22. The question for the Commissioner is what the withheld information might conceivably add to information already available, making identification more likely (bearing in mind that there might be individuals sufficiently motivated to make such a connection). As indicated above, it is not apparent to the Commissioner that it would make a contribution of any significance. There are things that will be known about the children concerned within the community and there are things that may well be the subject of specification. The Commissioner has been offered nothing to persuade him that, even if the number for a given area were as low as one, knowing that fact would be remotely useful in identifying the child in question in any of the areas covered by part (b) of the request: it is not clear how it would help make curious speculation anything more than curious speculation.

23. Having taken account of the arguments presented by both parties, therefore, the Commissioner does not accept that the Council has demonstrated there is a real risk of identification using the withheld information. In the circumstances, he is not satisfied that this withheld information falls within the definition of personal data.

24. As the Commissioner is not satisfied that this information is personal data, he must find that the Council was not entitled to withhold the information under section 38(1)(b) of FOISA.

25. The Commissioner therefore requires the Council to disclose the information to the Applicant.

Decision

The Commissioner finds that Dumfries and Galloway Council (the Council) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. The Council wrongly withheld information under section 38(1)(b) of FOISA on the basis that it was personal data, thereby failing to comply with section 1(1) of FOISA.

The Commissioner therefore requires the Council to provide the Applicant with the withheld information by 4 August 2020.

Appeal

Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

18 June 2020

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(5) In this section-

…

"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

…

---