Decision 086/2021: Infections and deaths linked to Covid-19 in Caithness
Public authority: Highland Health Board
Case Ref: 202001387
Summary
NHS Highland was asked for the total number of infections and deaths attributed to Covid-19 in the Caithness area over a specified period.
NHS Highland disclosed some information, but refused to disclose the precise figures. It disclosed the precise figures during the course of the investigation.
The Commissioner found that NHS Highland had not been entitled to withhold the information and that NHS Highland did not respond to the Applicant's request for review within the timescales set down by FOISA.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 21(1) (Review by a Scottish public authority); 38(1)(b), (1)(d), (2A)(a), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing", "health record" and "the UK GDPR") and (5A) (Personal information)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14) (Terms relating to the processing of personal data)
Coronavirus (Scotland) Act 2020, Schedule 6, Part 2, paragraph (6) (Commissioner's ability to take account of the impact of coronavirus)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 23 August 2020, the Applicant made a request for information to Highland Health Board (NHS Highland). The information requested was:
a) the total number of Covid-19 cases recorded in Caithness between 1 March 2020 and 23 August 2020 and
b) the total number of deaths attributed to Covid-19, that occurred in Caithness, between 1 March 2020 and 23 August 2020.
2. NHS Highland responded on 2 October 2020. In response, NHS Highland disclosed banded figures to the Applicant for parts a) and b) of his request, indicating that the precise figure was less than that quoted. NHS Highland explained that it was relying on the exemption in section 38(1)(b) of FOISA as it considered the precise numbers to be third party personal data, disclosure of which would contravene the data protection principles.
3. On 3 October 2020, the Applicant wrote to NHS Highland requesting a review of its decision, on the basis that he had not requested any information which, either directly or in oblique terms, could be deemed to be personal data. The Applicant also submitted that no data protection principles would be breached by disclosure of the requested information.
4. NHS Highland notified the Applicant of the outcome of its review on 19 November 2020, upholding its original response. NHS Highland also referred the Applicant to information available on the Public Health Scotland and National Records of Scotland websites, which disclosed the number of infections at neighbourhood levels, and crude rates of deaths involving Covid-19 respectively. Links were provided to enable the Applicant to access this information.
5. On 22 November 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of NHS Highland's review for the following reasons:
(i) it did not respond to his requirement for review within 20 working days and no explanation was provided for the delay in issuing this response.
(ii) he did not agree that the information requested by him was exempt under section 38(1)(b) of FOISA.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 25 November 2020, NHS Highland was notified in writing that the Applicant had made a valid application. NHS Highland was asked to send the Commissioner the information withheld from the Applicant. NHS Highland provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Highland was invited to comment on this application and to answer specific questions. These related to why it considered the requested information to constitute third party personal data, disclosure of which would breach any of the data protection principles. Comments were also sought from NHS Highland on the reasons for the delay in its response to the Applicant's request for review.
9. During the investigation, NHS Highland reconsidered the withheld information and disclosed the precise figures requested to the Applicant.
10. The Applicant confirmed that he received this information.
11. During the investigation, NHS Highland also acknowledged that it had incorrectly applied the exemption in section 38(1)(b) of FOISA to information covered by part (b) of the Applicant's request. It stated that, in the case of records of deaths, the correct exemption to apply would be section 38(1)(d) of FOISA.
Commissioner's analysis and findings
12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and NHS Highland. He is satisfied that no matter of relevance has been overlooked.
13. As mentioned already, during the investigation, NHS Highland reviewed its position over the precise figures covered by the Applicant's request and disclosed this information to him. However, the matter the Commissioner has to consider in this decision is the circumstances relating to this request at the time NHS Highland responded to the requirement for review on 19 November 2020.
14. Because NHS Highland has confirmed that it was seeking to rely on the exemption in section 38(1)(b) of FOISA for information covered by part (a) of the Applicant's request and the exemption in section 38(1)(d) of FOISA for information covered by part (b) of the Applicant's request, it is these exemptions that will be considered in this Decision Notice.
Section 38(1)(b) - Third party personal information
15. When responding to the Applicant's requirement for review, NHS Highland relied on the exemption in section 38(1)(b) for withholding the precise numbers of infections and deaths caused by Covid-19 in the Caithness area between 1 March 2020 and 23 August 2020.
16. NHS Highland submitted that the precise number of infections and deaths was personal data because disclosure could lead to the names of those affected being identified. NHS Highland did not explain which principle(s) in the DPA 2018 it considered would be breached by disclosure.
17. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
18. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the withheld information personal data?
19. The first question the Commissioner must address is whether the withheld information covered by part (a) of the Applicant's request is personal data for the purposes of section 3(2) of the DPA 2018.
20. "Personal data" is defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to -
(i) an identifier such as a name, an identification number, location data, or an online identifier, or
(ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
21. NHS Highland submitted that, at the time of responding to the Applicant, it considered that there would be a risk that release of exact numbers could lead to the names of those affected being identified.
22. NHS Highland explained that Caithness has a low population (approximately 24,000) spread over small villages and communities. Thurso has approximately 8,000 people and Wick 7,000. It was NHS Highland's view that, given the national and local anxieties and intense interest in Covid-19, it would be easy to identify locally the names of those affected.
23. In the case of Breyer v Bundesrepublik Deutschland[1], the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is a realistic prospect of someone being identified. When making that determination, account can be taken of the information in the hands of a third party. However, there must be a realistic casual chain - if the risk of identification is insignificant, the information will not be personal data.
24. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner considers that the same rules will apply.
25. The two main elements of personal data are that the information must "relate" to a living person; and that person must be identified - or identifiable - from the data, or from the data and other information.
26. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
27. An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals. There might be a slight hypothetical possibility that someone might be able to reconstruct the data in such a way that identified the individual, but this is not necessarily sufficient to make the individual identifiable.
28. The Commissioner has considered NHS Highland's submissions, together with the withheld information covering part (a) of the request. He is not satisfied that he has been provided with sufficiently persuasive arguments to conclude that disclosure would lead to the identification of individuals.
29. NHS Highland argued that disclosure of the exact number of those infected with Covid-19 could lead to their identification, due to the low population of the Caithness region and its geographical spread. The Commissioner considers the number of cases to be relatively small, even in comparison with the population of 24,000 in Caithness, which NHS Highland has submitted is spread over small villages and communities. The Commissioner therefore considers the likelihood of being able to identify the individuals concerned with any level of accuracy to be remote.
30. The Commissioner accepts that those who have been infected with Covid-19 will obviously know and it is likely that their relations would know, and perhaps close friends or near neighbours. However, given that the track and trace facility used by NHS Scotland to inform potential contacts does not reveal who the person was in contact with or exactly when the contact took place, the Commissioner does not consider the identity of the individuals would be known more widely than that of direct relations, close friends and near neighbours. Therefore, the Commissioner does not agree that those individuals would be identified or identifiable as a consequence of disclosure of the exact figure covered by part (a) of the Applicant's request. As such, the Commissioner does not agree that this is personal data as defined in section 3(2) of the DPA.
31. As the Commissioner is not satisfied that the information covering part (a) of the Applicant's request is personal data, he must find that NHS Highland was not entitled to withhold the information under section 38(1)(b) of FOISA.
32. As NHS Highland has now disclosed the information covering part (a) to the Applicant, the Commissioner does not require it to take any action in relation to this breach.
Section 38(1)(d) - Deceased person's health record
33. As mentioned, NHS Highland explained, during the investigation that it was incorrect to rely on the exemption in section 38(1)(b) of FOISA for the information covered by part (b) of the request, arguing that the exemption in section 38(1)(d) may apply to this information.
34. Section 38(1)(d) exempts information from disclosure if it constitutes a deceased person's health record. Under section 2(2)(e)(i) of FOISA, section 38(1)(d) is an absolute exemption and so a public authority is not required to consider the public interest test for information which falls within its terms.
35. The effect of section 38(1)(d) is to leave unchanged the more limited rights of access to health records of deceased persons provided by the Access to Health Records Act 1990 (AHRA). In particular, section 3(1)(f) of the AHRA gives the personal representative of a patient who has died a right to apply to access the patient's health record. The same right is given to any person who may have a claim arising out of a patient's death.
36. Disclosure under FOISA, on the other hand, is generally considered to be disclosure to the world at large.
37. Section 38(5) of FOISA states that "health record" has the meaning assigned to it by section 1(1) of the AHRA. This defines "health record" as a record which (a) consists of information relating to the physical or mental health of an individual who can be identified from that information, or from that and other information in the possession of the holder of the record and (b) has been made by or on behalf of a health professional in connection with the care of that individual.
38. By virtue of section 2 of the AHRA, "health professional" has the same meaning as in section 204 of the DPA 2018. Section 204 includes within the definition of "health professional" a registered medical practitioner and a registered nurse (section 204(1)(a)).
39. In its submissions, NHS Highland commented that, at the time of responding to the Applicant, it considered there would be a risk that release of exact numbers (especially of those who had died) could lead to the names of those who had died being identified, as it would be possible to validate this against death notices in the media. NHS Highland's submission regarding the low population numbers of individuals in Caithness and their geographical spread was also relied on here.
40. Having considered the withheld information, the precise number of deaths attributed to Covid-19 which occurred in the Caithness area between 1 March 2020 and 23 August 2020, the Commissioner does not accept that this falls within the definition of a deceased person's health record.
41. The Applicant has not asked for the death certificate that has been issued by a medical professional for each of the individuals who died as a consequence of Covid-19 in the regional area concerned. He simply asked for the precise number of deaths which occurred. Unlike in Decision 066/2008[2] this information does not identify a deceased individual or contain notes about their care and treatment. The precise number of deaths occurring in the regional area concerned which are attributed to Covid-19 is not information which has been made by or on behalf of a health professional in connection with the care of an individual.
42. Furthermore, the Commissioner does not agree that provision of a number of deaths is a record relating to the physical or mental health of an individual who can be identified from that information. The Commissioner recognises that NHS Highland is concerned that disclosure of the number of deaths would, in conjunction with information which is publicly available in death notices in the media, be capable of identifying those individuals. The Commissioner does not accept that there is a realistic prospect of this in this case. The Commissioner has accessed the local newspaper for the Caithness area: having considered the death notices published in this paper, he has not identified any notice which discloses the cause of death of an individual who has died. As the local newspaper is the most likely place that death notices would be published for anyone who had died as a consequence of Covid-19 in the Caithness area, the Commissioner considers the content of the death notices in this paper to be reflective of the nature and type of information shared publicly.
43. The Commissioner is therefore not satisfied that the precise number of deaths attributed to Covid-19 is a record consisting of information relating to the physical or mental health of an individual who can be identified from that information (or from that and other information in the possession of the holder of the record) and which has been made by or on behalf of a health professional in connection with the care of a deceased person.
44. As the Commissioner is not satisfied that the information covered by part (b) of the Applicant's request was a deceased person's health record, he must find that NHS Highland was not entitled to rely on the exemption in section 38(1)(d) of FOISA for withholding this information. In doing so, it failed to comply with section 1(1) of FOISA.
45. As NHS Highland has disclosed this information to the Applicant, the Commissioner does not require it to take any action in relation to this breach.
Timescale for compliance
46. As mentioned above, the Applicant expressed dissatisfaction with the time taken by NHS Highland to respond to his requirement for review.
47. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review. This is subject to qualifications which are not relevant in this case.
48. It is a matter of fact that NHS Highland did not provide a response to the Applicant's requirement for review within 20 working days.
49. In its submissions, NHS Highland explained that the delay in providing the response was caused by the need to seek clarification on what information could be disclosed, as well as work pressures during the pandemic.
50. In Part 2 of Schedule 6 of the Coronavirus (Scotland) Act 2020, paragraph 6 allows the Commissioner to find that a Scottish public authority has not failed to comply with section 21(1) of FOISA, where he is satisfied that the failure was due to, inter alia, the effect of coronavirus on the authority generally or its ability to carry out its functions, and was reasonable in all the circumstances. In considering what is reasonable, the primary consideration for the Commissioner is the public interest in responding promptly.
51. Guidance issued by the Commissioner[3], "Coronavirus (Scotland) Act 2020: Determining the effects of the Coronavirus on an authority's ability to respond to requests", makes it clear that public authorities will need to provide the Commissioner with evidence as to the effects of the Coronavirus on their ability to respond within the maximum 20 working day timescale to individual requests (paragraph 10). The guidance sets out what evidence the Commissioner will require from an authority to allow him to make a determination (paragraph 16) and makes a number of recommendations to authorities about what information they should document in order to record the effects of the coronavirus on their ability to respond to requests (paragraph 18).
52. The response from NHS Highland refers to work pressures during the pandemic affecting its ability to respond on time. In further submissions, it explained that this was specifically related to connectivity difficulties faced by staff involved in home working, which affected how quickly work was progressed.
53. In the absence of any evidence from NHS Highland relating specifically to the impact of the pandemic on its staff regarding its handling of this particular requirement for review, the Commissioner does not consider paragraph 6 of Part 2 of Schedule 6 to the 2000 Act applies in this case. As such, the Commissioner is not satisfied that NHS Highland's failure to respond to the requirement for review in this case was caused by the effects of the Coronavirus on its ability to carry out its functions.
54. The Commissioner therefore finds that, in failing to provide a response to the Applicant's requirement for review within 20 working days, NHS Highland failed to comply with section 21(1) of FOISA.
55. As NHS Highland provided the Applicant with a response to his requirement for review, the Commissioner does not require it to take any action in relation to this breach.
Decision
The Commissioner finds that Highland Health Board (NHS Highland) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
In particular, the Commissioner finds that NHS Highland was not entitled to withhold information under the exemptions in sections 38(1)(b) and 38(1)(d) (Personal information) of FOISA, and in doing so failed to comply with section 1(1) of FOISA. He also finds that NHS Highland failed to comply with section 21(1) by not responding to the Applicant's requirement for review within 20 working days.
Given that NHS Highland disclosed the precise figures covered by parts (a) and (b) of the Applicant's request during the investigation, the Commissioner does not require NHS Highland to take any action in response to these failures.
Appeal
Should either the Applicant or NHS Highland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
1 June 2021
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(d) a deceased person's health record.
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
…
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"health record" has the meaning assigned to that term by section 1(1) of the Access to Health Records Act 1990 (c.23); and
…
"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
…
(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided -
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
Coronavirus (Scotland) Act 2020
Schedule 6 - Functioning of public bodies
Part 2 - Freedom of Information
6 Commissioner's ability to take account of impact of coronavirus
(1) This paragraph applies in relation to an application made under section 47(1) (which is not excluded by section 48) in respect of which there is a failure of the Scottish public authority to comply with a relevant period.
(2) Despite section 49(6), the Commissioner may decide that the Scottish public authority has not failed to comply with Part 1 by reason only of its failure to comply with a relevant period if the Commissioner is satisfied that the failure was -
(a) due to
(i) the effect of coronavirus on the authority generally or its ability to carry out its functions (including any action it had to take to better utilise its resources to deal with the effect of coronavirus), or
(ii) the authority operating under requirements of Part 2 of this schedule that were subsequently repealed before the end of the period during which Part 1 of this Act is in force.
(b) reasonable in all the circumstances.
(2A) In considering whether the failure was reasonable in all the circumstances, the Commissioner must regard the public interest in section 1(1) being complied with promptly as the primary consideration.
(3) For the purposes of this paragraph, "relevant period", in relation to a request for information (or a subsequent requirement for review) means a period specified in section 10(1) or section 21(1), either as it has effect by virtue of paragraph 3 or otherwise.
