|
Decision 087/2015: Mr and Mrs M and the Scottish Prison Service
ICC discussion of a complaint
Reference No: 201402838
Decision Date: 19 June 2015
Summary
On 14 April 2014 Mr and Mrs M asked the Scottish Prison Service (the SPS) for information held in relation to the Internal Complaints Committee's (ICC's) discussion of a particular complaint.
The SPS responded, withholding the information as personal data whose disclosure would breach the data protection principles. Following a review, Mr and Mrs M remained dissatisfied and applied to the Commissioner for a decision.
The Commissioner investigated and found that the SPS had responded to Mr and Mrs M's request for information properly, in accordance with Part 1 of FOISA.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 14 April 2014, Mr and Mrs M made a request for information to the SPS. The information requested was:
"all and any information held by the SPS in relation to the discussion by the ICC at HMP Edinburgh of complaint ref [number supplied]".
2. The SPS responded on 9 May 2014, explaining that it considered the information requested to be the personal data of a third party (the complainer). It applied section 38(1)(b) of FOISA to the information. It explained how the information could be disclosed in compliance with the DPA.
3. On 31 May 2014, Mr and Mrs M wrote to the SPS and asked it to carry out a review of its decision. They did not agree that the information they had requested was the personal data of a third party.
4. The SPS notified Mr and Mrs M of the outcome of its review on 27 June 2014, upholding its original decision without modification.
5. On 12 December 2014, Mr and Mrs M wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. Mr and Mrs M stated they were dissatisfied with the outcome of the SPS's review. They did not believe the SPS had justified its application of section 38(1)(b) of FOISA, with reference to the relevant statutory tests and why the information was all considered to be personal data. They noted that some of the information might be their own personal data, although the SPS had not raised this.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr and Mrs M made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
7. On 18 December 2014, the SPS was notified in writing that Mr and Mrs M had made a valid application. It was asked to send the Commissioner the information withheld from Mr and Mrs M. The SPS provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SPS was invited to comment on this application and answer specific questions, justifying its reliance on any provisions of FOISA it considered applicable to the information requested.
9. In their application, Mr and Mrs M asked the Commissioner to offer them the opportunity to comment upon any submissions in the event that the SPS maintained its reliance on section 38. On 5 May 2015, the investigating officer wrote to Mr and Mrs M giving them the opportunity to comment further should they wish to do. They replied on 19 May 2015 with their comments. The complainer also wrote a letter to the Commissioner on 18 May 2015, with comments.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr and Mrs M and the SPS. She is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal Information
11. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data where disclosure of the data to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
12. In considering the application of this exemption, the Commissioner will consider firstly whether the information in question is personal data, as defined in section 1(1) of the DPA, and then (if it is) whether disclosure would breach the data protection principles as the SPS has claimed.
13. This is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
14. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
15. The Commissioner has considered the submissions received from the SPS on this point, along with the withheld information. She has also considered the terms of Mr and Mrs M's request and the other comments she has received from them (and the complainer, in relation to the request). In particular, she notes their expectation that the information would be generic in nature, rather than pertaining to a particular individual. They do not believe it would be "biographical" in any meaningful sense, or that anyone could be identified from it were names and personal details to be redacted.
16. Having considered the withheld information in this particular case, the Commissioner is satisfied that it relates to the complainer, focusing as it does on the complainer's personal activities. She is also satisfied that the complainer can be identified from the information, in line with the first limb of the definition of "personal data". Consequently, the Commissioner is satisfied that the information is the complainer's personal data. She does not consider it would be practicable, given its context, to render the information anonymous and thus deprive it of its status as personal data.
Would disclosure contravene the first data protection principle?
17. The SPS argued that disclosure of the withheld personal data would contravene the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 of the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing under consideration in this case is disclosure of the personal data into the public domain, in response to Mr and Mrs M's information request.
18. The SPS also argued that the withheld personal data should be considered sensitive personal data, as defined in section 2 of the DPA, because it related to the complainer's "family, legal and personal circumstances". Unfortunately, it does not automatically follow from the fact that data relates to any of these matters (which these data undoubtedly do) that they will be sensitive personal data. Section 2 lists a number of specific categories of data, none of which has been identified with sufficient precision by the SPS.
19. Consequently, the Commissioner will consider the application of Schedule 2 only in the remainder of this decision.
20. The first Schedule 2 condition which might be relevant in this case is condition 1. This would apply where the data subject (in this case, the complainer) had given his or her consent to the processing. Amongst other things, consent under the DPA requires to be freely given and a positive indication of the data subject's wishes.
21. Letters from the complainer (18 May 2015) and Mr and Mrs M (19 May 2015) during this investigation demonstrate that they are well known to each other. The complainer appears to support Mr and Mrs M's views as to whether the withheld information is personal data and whether they have a legitimate interest in its disclosure (see below). What the complainer does not do is give consent to disclosure: not (as would be required for the purposes of the DPA) in the sense of giving a clear, positive indication that permission is being given for the information to be disclosed.
22. In any event, consent under the DPA also requires to be fully informed and specific to the circumstances. This would require an understanding of the data under consideration. In the circumstances of this particular case, the Commissioner does not consider herself to be in a position to determine whether the complainer possesses that understanding. Equally, she does not consider it to be a question she is required to pursue actively. She does not, therefore, consider the data subject to have consented to disclosure.
23. The only other Schedule 2 condition which could be relevant here, and to which Mr and Mrs M alluded in their application, is condition 6. This allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individual(s) to whom the data relate).
24. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
(i) Are Mr and Mrs M pursuing a legitimate interest or interests?
(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?
(iii) Even if the processing is necessary for Mr and Mrs M's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
25. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In the Commissioner's published guidance on section 38(1)(b)[1], it states:
In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
26. Mr and Mrs M were asked to comment on their legitimate interest in the withheld personal data. In their letter of 19 May 2015, they indicated they were attempting to prevent what they considered to be improper use of their own data. She does not believe it follows that they would have a legitimate interest in the data being disclosed into the public domain, which would be the effect of disclosure under FOISA. If there has been a breach of the DPA in relation to these data, that can be investigated by the Information Commissioner, who is responsible for enforcing the DPA across the United Kingdom. There is no reason why that should require disclosure of the data in question under FOISA: in fact, that could only make any potential breach worse.
27. In the absence of a legitimate interest, condition 6 cannot be met. As she can find no condition in Schedule 2 which would permit disclosure in this case, the Commissioner must also find that disclosure would be unlawful. This means that disclosure would breach the first data protection principle and that, as a result, the information is exempt from disclosure (and properly withheld by the SPS) under section 38(1)(b) of FOISA.
28. As Mr and Mrs M have observed, and the SPS has acknowledged, elements of the withheld information might also be considered to be their own personal data. Such information would be exempt under section 38(1)(a) of FOISA, but this is not a matter the Commissioner is required to consider in this case. She has found that all of the information is, in any event, the personal data of the complainer and therefore properly withheld under section 38(1)(b) of FOISA.
29. Mr and Mrs M may pursue their own personal data under the DPA, but their rights under that legislation are not within the remit of this Commissioner. She notes that the SPS has provided a form on which they might make a subject access request (although its use for that purpose might have been explained to them more clearly).
Handling of request - other issues
30. The Commissioner notes that Mr and Mrs M believe they should have been given more information on the nature of the withheld personal data, to enable them to make informed comments on the application of section 38(1)(b). Having considered the data in question, the Commissioner does not believe the SPS could have done this without disclosing (at least in part) the information it was justified in withholding. Equally, the Commissioner herself, or her staff, could not have done so without breaching section 45 of FOISA and thus committing a criminal offence.
31. Mr and Mrs M also believe the SPS should have explained the tests they were applying in withholding information under section 38(1)(b). The Commissioner has considered this also. She has identified no specific breach of the requirements of Part 1 of FOISA in the SPS's responses to Mr and Mrs M, but would draw the SPS's attention to the following, on page 12 of the published guidance on section 38(1)(b) referred to above:
When assessing whether an applicant has a legitimate interest, the Commissioner considers that it will be good practice for public authorities to ask the applicant why they want the information (unless it is already clear from the information request or from previous correspondence).
It might have been helpful if Mr and Mrs M had been asked about this at an early stage in the handling of their request.
|
Decision
The Commissioner finds that the Scottish Prison Service complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr and Mrs M.
|
Appeal
Should either Mr and Mrs M or the SPS wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Rosemary Agnew
Scottish Information Commissioner
19 June 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
...
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
[1]
