Decision 086/2016: Mr X and the Scottish Prison Service Guidance relating to destruction of interview notes Reference No: 201502178 Decision Date: 18 April 2016 Summary On 3 July 2015, Mr X asked the Scottish Prison Service (the SPS) for protocols, policy, advice and guidance referred to by the SPS in a letter sent to him. The SPS disclosed some information. Following a review at which further information was disclosed, Mr X remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that the SPS partially complied with Part 1 of FOISA. Although the SPS disclosed to Mr X all the information that fell within his request, it did not meet its duty to provide reasonable advice and assistance. To do this the SPS should have informed Mr X that it held other, related information. As the SPS disclosed this information to Mr X during the investigation, the Commissioner did not require the SPS to take any action.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections (1) and (4) (General entitlement) and section 15(1) (Duty to provide advice and assistance)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 3 July 2015, Mr X made an information request to the SPS. He asked for "all and any information held by the SPS comprising the protocols, policy, advice and guidance" to which the SPS had referred in a response to a subject access request (SAR) made by Mr X under the Data Protection Act 1998 (the DPA), "insofar as that information relates to the application or interpretation by the SPS of the DPA". (As background to this request, it should be explained that Mr X had complained about the destruction of interview notes relating to an assessment.)

2. The SPS responded on 27 July 2015. The SPS said that it had not directly referred to any protocols, policy, etc. in the reply to the SAR, and that its data protection responsibilities came directly from the DPA. The SPS provided what it regarded as the relevant part of the DPA (i.e. Schedule 1, Part 1, principles 2 and 5). The SPS also provided Mr X with GMA [Governors and Managers: Action] 10A-12 - Information Security: Disposal of Documents and IT Equipment.

3. On 19 August 2015, Mr X wrote to the SPS requesting a review of its decision. He believed the SPS was withholding information that fell within his request: specifically, information showing that its data retention standard for Formulation Documents and Session/Assessment Notes is five years.

4. The SPS notified Mr X of the outcome of its review on 16 September 2015. It confirmed its initial decision with modification. As Mr X' request was for "all and any information", the SPS supplied two further documents which "provided identical advice, guidance on document destruction relative to Principle 5 of the DPA". These documents were section 10 of GMA 52A/03, which outlined the SPS's responsibilities under the fifth data protection principle, and page 8 of the Data Protection Handbook ("Retention and Destruction"), which related to the SPS's responsibility to destroy personal data when no longer required.

5. On 18 November 2015, Mr X applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He believed the SPS was withholding information that fell within his request.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SPS was invited to comment on this application and answer specific questions.

8. During the investigation, the SPS located and provided Mr X with additional information, even though it did not believe it fell within the terms of his request. This was GMA 74A/14 - Records Management: Prisoners Records Retention and Destruction.

9. Mr X acknowledged receipt of this information and provided his comments to the Commissioner by letters of 16 February and 3 March 2016.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr X and the SPS. She is satisfied that no matter of relevance has been overlooked.

Section 1(1) - General entitlement

11. Section 1(1) of FOISA states that a person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is the information held by the authority at the time the request is received. This is subject to qualifications, but these are not applicable in this case.

12. In his application to the Commissioner, Mr X accepted that the SPS appeared to have interpreted his request correctly, and had provided information which fell within the scope of his request. However, Mr X believed that the SPS had withheld information from him; specifically, information showing that psychologists' Formulation Documents and Session/Assessment Notes should be retained for five years. He based this belief on the terms of a written response he had received to a complaint. This response referred to GMA 10A-12 Disposal of Documents and IT equipment and, in that context, stated that psychologists' Formulation Documents and Session/Assessment Notes should be retained for five years. Mr X could find no mention of a five-year retention period in GMA 10A-12 or in the "Information Security Policy" also referred to in the complaint response.

13. The Commissioner must decide whether the SPS complied with Part 1 of FOISA in responding to Mr X's request. In doing so, she will consider whether the SPS disclosed all the information that it held at the time of the request and that fell within the request. She will therefore consider whether:

(i) the SPS's interpretation of Mr X's request was reasonable;

(ii) the SPS disclosed all information in GMA10A-12 that fell within the request;

(iii) any other information was covered by the request and should have been disclosed to Mr X.

14. The Commissioner will then go on to consider whether the SPS provided Mr X with reasonable advice and assistance under section 15 of FOISA.

Interpretation of the request

15. The Commissioner's view is that the words used in an information request should generally be given their plain, ordinary meaning and that requests should be interpreted in an objective manner, rather than with reference to what a public authority considers what a requester may have intended.

16. Mr X requested "all and any information held by the SPS comprising the protocols, policy, advice and guidance" to which the SPS had referred in its response to a SAR made by Mr X "insofar as that information relates to the application or interpretation by the SPS of the DPA". To interpret the request in a reasonable manner, the SPS would therefore have to look at the wording of the SAR response.

17. The relevant SAR response referred to the deletion of source data once a Psychological Risk Assessment (PRA) report is submitted and stated that this was done "in line with the SPS's data protection responsibilities". The SAR response did not cite or otherwise make specific reference to any protocols, policy, or advice and guidance.

18. Mr X explained to the Commissioner that the SAR response "refers to a practice (being a regular course of conduct) ostensibly carried out 'in line with the SPS's data protection responsibilities'". He referred to a dictionary definition of a policy as "a course of action adopted", and pointed out that when he had complained about the destruction of the interview notes, the response was that this had been done "as per SPS Information Security Policy". He therefore believed that the SAR response referred to specific SPS policy as well as to its general data protection responsibilities.

19. Initially, the SPS supplied Mr X with principles 2 and 5 of the DPA and an extract from GMA 10A-12. The SPS did so because these principles - and the GMA giving effect to the principles - justified the destruction of source data from interviews, as referred to in the SAR response; not because the SAR response made any direct reference to principles 2 and 5 of the DPA or GMA 10A-12. The SPS disclosed more information at review, following similar reasoning.

20. The Commissioner accepts this is a reasonable line to take. The SAR response did not make any specific reference to guidance on compliance with data protection legislation, so the most reasonable interpretation of the request is that Mr X was seeking any recorded information which confirmed that, as a matter of policy and in line with the SPS's responsibilities under the DPA, source data from interviews is destroyed once a PRA report is submitted.

21. This appears to be in line with Mr X's own interpretation of his request, as explained in his letter to the Commissioner of 3 March 2016.

GMA10A-12 Information Security: Disposal of Documents and IT Equipment

22. During the investigation, the SPS supplied the Commissioner with a copy of GMA10A-12. The Commissioner is satisfied that this GMA does not contain any reference to a five-year retention period for psychologists' Formulation Documents and Session/Assessment Notes or any other type of information.

23. The only information in GMA 10A-12 which might be relevant to Mr X' request is the statement "Documents should be shredded as soon as they are no longer required". There is no explicit reference to the DPA in GMA 10A-12, but in his submission of 16 February 2016, Mr X accepted that GMA10A-12 was concerned with the implementation of the fifth data protection principle.

24. The Commissioner accepts the SPS's position that GMA10A/12 implements the DPA requirement that personal data should not be held longer than necessary. The Commissioner also accepts that the SPS disclosed to Mr X the information from GMA10A/12 which falls within the scope of his request. To that extent, the SPS complied with Part 1 of FOISA: there is no other information in GMA10A/12 which falls within Mr X's request.

GMA 74A/14 Records Management: Prisoners Records Retention and Destruction

25. During the investigation, the SPS provided Mr X with GMA 74A/14 - Records Management: Prisoners Records Retention and Destruction. This GMA provides that certain information (including psychologists' Formulation Documents and Session/Assessment Notes) should be retained for five years. The SPS did not believe that the information in this GMA fell within the scope of Mr X' request. Mr X disagreed.

26. The Commissioner will now consider whether the SPS's application of FOISA to the information in this GMA was correct.

27. The following is a summary of reasons why information in GMA 74A/14 might not fall within the request.

(i) GMA 74A/14 is not explicitly referred to in the SAR response to which Mr X refers in his request. Therefore, on a plain language reading of the request, the information in this GMA would not appear to fall within Mr X's request.

(ii) There is nothing in the GMA confirming that source material for PRA reports does not need to be retained (as indicated in the SAR response). Therefore, the SAR response is not based directly on the GMA.

(iii) There is no explicit reference to the DPA in the GMA.

(iv) The GMA stipulates actions to be undertaken by the SPS establishments by certain dates in respect of certain prisoner records, i.e. what should be retained and what should be destroyed. The SPS takes the view that the deleted source notes are not prisoner records, or indeed a record of any sort. The SPS has argued that the deleted source notes were therefore a type of information not covered by the GMA which relates to retention periods for prisoner records.

28. On the other hand, there are reasons why information in this GMA could be seen to fall within the request.

(i) The request stipulates information "insofar as that information [protocol, policy, etc.] relates to the application or interpretation by the SPS of the DPA". Whilst there is no explicit reference to the DPA in the GMA, it could be viewed as information that relates to the SPS's application or interpretation of the DPA. The SPS accepted that, in this respect, the GMA might be considered relevant to its obligations under the DPA.

(ii) The SAR response refers to source data from interviews being deleted once a PRA has been submitted. As this GMA concerns the SPS's practices in terms of retention periods and the destruction of information, it is arguable that it contains information which is relevant to the issue of the destruction of the interview notes.

(iii) The GMA classifies PRAs as a key prisoner record and specifies retention periods for them, dependent on the prisoner's sentence. The SAR response refers to PRAs in context of retention/destruction (albeit the reference is to source notes being destroyed once the PRA is submitted).

(iv) Mr X takes the view that the deleted source notes are prisoner records and therefore covered by the GMA, which is about the management of prisoner records. The SPS disagrees with this view.

(v) Mr X has argued that the content and subject matter of the GMA are "closely aligned" with those of GMA 10A/12, which was disclosed.

29. Mr X and the SPS therefore differ in how they regard the destroyed source notes.

(i) The SPS's view is that the notes were not covered by the term "Formulation Documents and Session/Assessment Notes", but were working notes. The decision to destroy the notes was made in accordance with principles 2 and 5 of Schedule 1 to the DPA. Therefore, the SPS did not need to retain the notes for five years in order to comply with its own records retention policy; such notes are not covered by GMA74A/14. In that sense, GMA74A/14 is not relevant to the SAR response as that SAR response did not rely on GMA74A/14.

(ii) In contrast, Mr X believes that the notes made in interviews with staff whose personal views were relied upon in reaching one of the Formulations set out in the PRA must be considered as "Formulation Documents" or "Session/Assessment Notes" as referred to in GMA 74A/14.

30. While the Commissioner accepts that GMA 74A/14 could be seen to relate to the SPS's compliance with the DPA (in that having a formal records management and retention policy will help ensure that it complies with the requirement to keep personal data only as long as it is required), there is nothing in GMA 74A/14 that matches the SAR response about source notes for PRAs. Nor is this GMA referred to in the SAR response.

31. Having considered the competing arguments, on balance, the Commissioner is of the view that it was reasonable for the SPS to conclude that information in GMA 74A/14 was out of scope. There is nothing in GMA 74A/14 which lays down a retention period for the type of interview notes which were destroyed. Similarly, there is nothing in the GMA which confirms that, as a matter of policy and in line with the SPS's responsibilities under the DPA, these interview notes can or should be destroyed once a PRA report is submitted. So far as the Commissioner can discern, this information is not actually held by the SPS.

Section 15 - Duty to provide reasonable advice and assistance

32. Section 15(1) of FOISA requires a public authority, so far as it reasonable to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

33. Mr X's requirement for review explicitly raised the issue of the retention period of five years. He also referred to a separate communication from the SPS that seems to suggest that GMA10A/12 provides that Psychologists' Formulation Documents and Session/Assessment Notes should be retained for five years. The Commissioner believes that the SPS should have addressed this point at review, by way of advice and assistance.

34. The Scottish Ministers' Code of Practice on the discharge of Functions by Scottish public authorities under FOISA and the EIRs ("the Section 60 Code[1]") provides (at paragraph 1.10, Providing additional information):

"The duty to provide advice and assistance does not extend to providing additional information which falls outside the scope of the information request, or locating information held by other public authorities. However, in some situations it may be helpful to provide some form of clarification or context to their response to avoid the information disclosed being misunderstood or misinterpreted."

35. The Section 60 Code acknowledges (at paragraph 1.3) that authorities should take into account the circumstances of each individual case in deciding what advice and assistance, if any, is required.

36. Users of FOI, however experienced they are, cannot have knowledge of the information held by a public authority equal to that of the public authority itself. In this case, when Mr X raised the issue of the five-year retention period at review, it would have assisted him if the SPS had explained that there was no recorded information showing that source notes should be retained for this period. The SPS could have alerted him to the existence of GMA74A/14, which states that Psychologists' Formulation Documents and Session/Assessment Notes should be retained for five years, and explained that the source notes were regarded as a different type of information. The SPS could have provided GMA 74A/14, even though it was not covered by Mr X's request, or suggested that he make another request for that GMA. The SPS did neither at review.

37. Accordingly, the Commissioner has concluded that the SPS failed to comply with section 15 of FOISA, in failing to provide reasonable advice and assistance to Mr X.

38. During the investigation, the SPS provided GMA 74A/14 to Mr X and explained why it did not apply to the source notes in question. Therefore, the Commissioner does not require any action.

Decision The Commissioner finds that the Scottish Prison Service (the SPS) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr X. The Commissioner accepts that the SPS disclosed to Mr X the information which it held and which was covered by his request. However, the Commissioner finds that the SPS failed to provide Mr X with reasonable advice and assistance, as required by section 15(1) of FOISA. Given the explanation provided in this decision, the Commissioner does not require the SPS to take any action in relation to this failure.

Appeal

Should either Mr X or the SPS wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner

18 April 2016

 

 Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

15 Duty to provide advice and assistance

(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

?

---