Decision 081/2020: Looked after children

Public authority: North Ayrshire Council
Case Ref: 201901181

Summary

The Council was asked for statistical data covering a five year period 2013-2018, concerning looked after children (a) placed into North Ayrshire by other local authorities and (b) placed outwith North Ayrshire by the Council.

The Council responded by disclosing some information, but it withheld some low figures (less than 10) under section 38(1)(b) of FOISA in case of identification of the children concerned.

The Commissioner was not satisfied that the Council's submissions demonstrated any link with other data in the public domain to enable identification of these children. He ordered disclosure of the withheld data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b) and (5) (definition "data subject", "the GDPR", "personal data") (Personal information)

Data Protection Act 2018 (the DPA 2018) sections 3(2) and (3) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 3 December 2018, the Applicant made a request for information to North Ayrshire Council (the Council) for the period "during the past five financial years (2013/14, 2014/15, 2015/16, 2016/17, and 2017/18)" and asked for information about looked-after children placed in care

(a) in the Council's area, by other local authorities, and

(b) from the Council's area, in other local authority areas.

For each year, the Applicant asked for both a list of all the authorities that had placed children in the Council's area/had children placed in their areas, and the number of children involved in each case.

2. The Council responded on 24 December 2018, to the effect that for part (a) no information was held. For part (b), the Council disclosed some information but also withheld some. It stated that any figures less than 10 risked identifying individuals. The Council applied section 38(1)(b) of FOISA (Personal information) to this withheld information.

3. On 12 February 2019, the Applicant wrote to the Council, requesting a review of its decision not to disclose figures less than 10. She contended that the Council had not used the correct tests in concluding that the information was personal data and did not agree with the Council's application of section 38(1)(b) to that information. The Applicant also subsequently appealed to the Commissioner (16 May 2019) on the grounds that the Council had failed to conduct a review within the required statutory timescale.

4. Following the Commissioner's intervention, the Council accepted that it had not dealt with the requirement for review on time. It notified the Applicant of its review decision on 4 July 2019, upholding the application of the exemption under section 38(1)(b) and apologising for not conducting the review timeously.

5. On 9 July 2019, the Applicant wrote to the Commissioner. She applied to the Commissioner for a decision in terms of section 47(1) of FOISA. The Applicant stated she was dissatisfied with the outcome of the Council's review as, in her view, the Council had not demonstrated any realistic means of identifying individuals using the withheld information. She believed the statistics she sought were not personal data.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 19 September 2019, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. The questions related to the Council's application of section 38(1)(b) of FOISA, with particular reference to how exactly identification would be possible using the withheld information.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) (Personal information)

10. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.

11. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

12. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.

Is the withheld information personal data?

13. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. The definition is set out in full in Appendix 1.

14. The Commissioner's briefing on section 38 (Personal information)[1] notes that the two main elements of personal data are that:

(i) the information must "relate to" a living person; and

(ii) the living individual must be identifiable.

15. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

16. An "identifiable living individual" is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018). The Commissioner will first consider whether the children to whom the withheld information relates are identifiable.

17. The Applicant submitted that the data described in this request was summarised data, not including any personal identifiers and relating to large enough population sizes that it would not be possible to identify anyone directly. She did not believe any realistic causal chain had been put forward which would allow a third party to identify anyone

18. The Council submitted that there was "more than a realistic possibility of data subjects [i.e. the children concerned] being identified", not only because of the low numbers but due to the way the Council might, for example, place a family of siblings. It was concerned as to how other available information (for example, accents or other known characteristics) could be used in combination with the withheld information could be used by family members to locate them, or potentially identify the wrong location and children.

19. The Council noted that FOI responses are effectively placed in the public domain. It emphasised the vulnerability of the children concerned.

20. The Commissioner has considered carefully the submissions for this case, noting the Council's central concern is whether the data is sufficiently anonymous for publication under FOISA. Clearly, these are vulnerable children and a precautionary approach to their personal data will generally be appropriate. The Commissioner must first of all be satisfied that the information under consideration does constitute personal data, however, before he can explore the application of the exemption any further.

21. Having taken account of the arguments presented by both the Council and the Applicant, the Commissioner does not accept that the Council has demonstrated there is a real risk of identification using this particular withheld information, by itself or with information reasonably likely to be available to even a motivated third party. By the Council's own admission, the examples it has offered are theoretical arguments. The Commissioner is not satisfied that they are sufficiently realistic to substantiate the required risk of identification. It cannot be deduced from the information that any of the cells represent a sibling group, for example, and it is relatively unusual to find people so attuned to local accents as to be able to identify the user of that accent with a particular local authority area (even assuming the child in question has an accent associated with that area, which cannot be regarded as given).

22. Even the Council appears to acknowledge that the information would not add much to a search by way of certainty (as it appears to see the risk being as much one of misidentification as identifying anyone correctly) and it appears to the Commissioner that, even with the withheld information, the person conducting the search would still be proceeding essentially by way of speculation and guesswork. The information must have a part to play in the identification process and the Commissioner is not persuaded that this can realistically be said to be the case here.

23. Consequently, the Commissioner finds that this withheld information does not fall within the definition of personal data.

24. As the Commissioner is not satisfied that this information is personal data, he must find that the Council was not entitled to withhold the information under section 38(1)(b) of FOISA.

25. The Commissioner therefore requires the Council to disclose the information to the Applicant.

Decision

The Commissioner finds that North Ayrshire Council (the Council) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. The Council wrongly withheld information under section 38(1)(b) on the basis that it was personal data, thereby failing to comply with section 1(1).

The Commissioner therefore requires the Council to provide the Applicant with the information withheld by 4 August 2020.

Appeal

Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

18 June 2020

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(5) In this section-

"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

…

---