Decision 095/2020: Ambulance Codes and Priority
Public authority: Scottish Ambulance Service Board
Case Ref: 201901946
Summary
The SASB was asked for the dispatch details of 15 ambulances and for the procedures to be followed in failing to meet a doctor's one-hour request for an ambulance. The SASB withheld some of the information, arguing it was personal data.
The Commissioner investigated and found that the SASB had wrongly withheld the information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "the GDPR", "personal data" and "processing") and (5A) (Personal information)
General Data Protection Regulation (the GDPR) Articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. The Applicant had raised a complaint with the Scottish Ambulance Service Board (the SASB) regarding the failure of the SASB to meet a one-hour ambulance attendance target following a call from his GP.
2. On 6 June 2019,the Applicant received a response from the SASB regarding the complaint he had raised. In that response the SASB advised that 15 other calls for ambulances had been received over the relevant period.
3. On 8 June 2019, the Applicant wrote to the SASB and, in relation to the previous communication, asked the SASB for information. The information sought in the request included:
a) The times the ambulances were dispatched and what code/priority status had been assigned to these 15 patients (part a)), and
b) A copy of the relevant SASB document which states procedures to be followed when the SASB is unable to meet a doctor's one-hour request for an ambulance due to operational workload (part b)).
4. The SASB responded on 8 July 2019, but only on the basis that the Applicant was seeking access to his own personal data under the GDPR.
5. On 13 July 2019, the Applicant wrote to the SASB and asked it to review its response. He emphasised that he was seeking a response to his request under FOISA.
6. On 12 August 2019, the Applicant wrote to the Commissioner, stating that he was dissatisfied with the SASB's failure to respond to his request for information and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. This resulted in the Commissioner issuing Decision 141/2019: The Applicant and Scottish Ambulance Service Board, which found the SASB had failed to comply with section 1(1) of FOISA. The SASB was required to respond to the Applicant's requirement for review by 14 November 2019.
7. The SASB notified the Applicant of the outcome of its review on 16 October 2019, now addressing the request under FOISA as well as the GDPR. The SASB found a number of areas where it could have handled his requests more efficiently as an organisation and apologised.
8. In relation to the information sought regarding the 15 ambulances (part a) of the request), the SASB explained the information held related to all emergency calls in the City of Edinburgh Council area between certain times on the date in question. It stated any further details of these incidents were the personal data of third parties and exempt in terms of section 38(1)(b) of FOISA (as disclosure would contravene any of the data protection principles in Article 5(1) and Article 21 - the right to object to processing - of the GDPR).
9. In relation to the request at part b), the SASB referred the Applicant to earlier correspondence it had provided him on 8 July 2019. The SASB explained that it no longer upgraded one-hour urgent calls automatically as it now (from 2016) operated a new clinical response model. The SASB provided a copy of the process to be followed.
10. On 20 October 2019, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the SASB's review, because he did not accept that the disclosure of the information requested at part a) of his request would lead to identifying individuals. In relation to part b), the Applicant submitted that he had been given an interpretation of the procedure, but not the document requested.
11. In earlier correspondence, the Applicant advised that he had been provided with a copy of the "Urgent Welfare Call Back Process", but this was not the document he requested as it made no mention of doctors' one-hour urgent requests. He advised the Commissioner he was in possession of an old copy of the requested document (SASB Operations Bulletin 08/07), which differed from the interpretation he had been given.
Investigation
12. In relation to parts a) and b) as outlined above, the application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision. The Applicant acknowledged that the investigation related to these parts only.
13. On 11 December 2019, the SASB was notified in writing that the Applicant had made a valid application. The case was allocated to an investigating officer.
14. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 23 January 2020, the SASB was invited to comment on this application and to answer specific questions, with a view to explaining its reliance on any provisions of FOISA it considered applicable to the information requested.
15. In particular the SASB was asked to explain how the disclosure of the information requested at part a) of the request would lead to the identification of individuals, thus making the information "personal data" in terms of the GDPR and the DPA 2018. In this regard, the SASB was referred to the guidance provided by the (UK) Information Commissioner - "What is personal data?"[1]
16. Following discussion with the investigating officer, the SASB responded on 10 February 2020, advising that it had provided the Applicant with what it considered to be de-identified information on 5 February 2020. It further advised the Commissioner that the document SASB Operations Bulletin 08/07, as held by the Applicant, was dated from 2007 and was no longer held by the SASB. It advised that the process followed was the "Urgent Welfare Callback Process", which had been provided to the Applicant on 16 October 2019.
17. The Applicant acknowledged receipt of the information that was provided to him on 5 February 2020, but was dissatisfied as the SASB had failed to disclose the codes that he had requested, and had made no attempt to provide him with the document requested at part b) of his request.
18. Following further discussion with the investigating officer, the SASB stated that it no longer considered the disclosure of the codes would lead to the identification of individuals and that it intended to provide the Applicant with the information held by 19 March 2020. The Applicant was updated by the investigating officer to that effect.
19. On 22 April 2020, the Applicant wrote to the Commissioner advising that, given the situation regarding the Coronavirus, he had allowed the SASB extra time. He now believed the delay was becoming excessive.
20. On 17 June 2020, the SASB wrote to the Applicant and provided him with the remainder of the information he had requested in part a) of his request. In relation to part b), the SASB explained that the document entitled "Urgent Welfare Callback Process", which had been provided to him previously, set out the process to be followed when an ambulance was delayed. It advised the document Operations Bulletin 08/07 was a legacy document and no longer in use.
21. The Applicant acknowledged receipt of the information provided. The Applicant remained dissatisfied with the response provided and made comments from his analysis of the information provided.
Commissioner's analysis and findings
22. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the SASB. He is satisfied that no matter of relevance has been overlooked.
Information held by the SASB
23. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable in this case.
24. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the authority should hold, although the applicant's reasons may be relevant to the investigation of what is actually held.
25. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority.
26. The Commissioner has taken account of the submissions provided by the Applicant, in which he expresses dissatisfaction with the SASB's response and in which he questions the completeness of the information disclosed during the investigation, aspects of its interpretation and how that correlates with the other correspondence that he has had with the SASB. The Commissioner cannot comment on the accuracy or the completeness of the information provided, but can only consider whether the authority provided the Applicant with all the information falling within the scope of the request that it actually held.
27. The SASB described the steps it took to ascertain what information it held falling within the scope of the Applicant's request. It explained why a specific code was not recorded, confirming that the Applicant had been provided with all of the relevant information it held by the close of the investigation. The SASB confirmed that the "Urgent Welfare Callback Process" was the only relevant current process, the SASB Operations Bulletin 08/07, as provided by the Applicant, no longer being in use.
28. Having considered all relevant submissions and the terms of the Applicant's request, the Commissioner is satisfied that the SASB interpreted the Applicant's request reasonably and took adequate, proportionate steps to establish what information it held in this case. Given the explanations provided, the Commissioner is satisfied - on the balance of probabilities - that the SASB holds no further information falling within the scope of the Applicant's request, in addition to that eventually provided to him. .
29. The Commissioner also notes that the SASB should have provided a full explanation to the Applicant that it did not hold, or have, a process that was specific to its failure to meet a doctor's one-hour request for an ambulance. This could probably be inferred from the review outcome, but a clearer explanation might have addressed the Applicant's dissatisfaction regarding part b) of his request.
Section 38(1)(b) of FOISA - Personal information
30. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR or (where relevant) in the DPA 2018.
31. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
32. To rely on this exemption, the SASB must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the GDPR.
33. As mentioned above, during the investigation the SASB made no submissions as to why it considered section 38(1)(b) of FOISA was engaged when applied to withhold information, but advised that it no longer considered disclosure would lead to the identification of individuals. In the absence of submissions from the SASB as to why the information was initially considered to be exempt from disclosure, the Commissioner must conclude that the information in question was not properly exempt under section 38(1)(b) of FOISA and was therefore incorrectly withheld by the SASB. In withholding the information, the SASB breached section 1(1) of FOISA.
34. Given that the information concerned was provided to the Applicant during the investigation, the Commissioner does not require the SASB to take any action in respect of this failure.
Decision
The Commissioner finds that the Scottish Ambulance Service Board (the SASB) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. The Commissioner finds that the SASB was not entitled to withhold the information relating to part a) as personal data and, by doing so, failed to comply with section 1(1) of FOISA.
Given that the information held by the SASB has now been provided to the Applicant, the Commissioner does not require the SASB to take any action in respect of this failure, in response to the application.
Appeal
Should either the Applicant or the SASB wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
26 August 2020
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);
…
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available.
…
(subject to subsection 14(c ) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
…
(10) "The GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
