Decision 098/2010 George Foulkes MSP and East Renfrewshire Council
Reports relating to the medical condition of Abdelbaset Ali Mohmed Al-Megrahi
Reference No: 201000737
Decision Date: 15 June 2010
Summary
Mr George Foulkes MSP requested from East Renfrewshire Council (the Council) copies of the reports on his medical condition that Abdelbaset Ali Mohmed Al-Megrahi was required to provide to the Council on a monthly basis in accordance with one of the conditions in the licence governing his release from prison. The Council responded by withholding the information as it considered it to be exempt under section 38(1)(b) of FOISA. Following a review, Mr Foulkes remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Council had dealt with Mr Foulkes' request for information in accordance with Part 1 of FOISA.He did not require the Council to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b) and (2)(a)(i) Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); 2(e) (Sensitive personal data); Schedule 1 The data protection principles Part 1 The Principles (first data protection principle); Schedule 3 (Conditions relevant for the purposes of the first principle; processing of sensitive personal data)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 9 February 2010, Mr Foulkes wrote to the Council requesting copies of the monthly reports on Mr Al-Megrahi's medical condition that he was required to provide to his supervising officer as a condition of the licence governing his release from prison.
2.The Council responded on 16 February 2010 refusing to disclose the information as it considered it to be exempt from disclosure under section 38 of FOISA.
3.On 24 February 2010, Mr Foulkes wrote to the Council requesting a review of its decision indicating that the case was one of major public interest.
4.The Council notified Mr Foulkes of the outcome of its review, which upheld the original decision on 17 March 2010. The Council clarified that it was relying on the exemption in section 38(1)(b) of FOISA to withhold the information as it considered disclosure would breach the first and second principles of the Data Protection Act 1998.
5.On 31 March 2010, Mr Foulkes wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Foulkes had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.The Council was notified in writing that an application had been received from Mr Foulkes and its comments were invited on the application in terms of section 49(3)(a) of FOISA.In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
8.The Council responded confirming that it considered the exemption in section 38(1)(b) of FOISA to be applicable, indicating that it considered the release of the sensitive personal data contained in the medical reports would breach the data protection principles.
Commissioner's analysis and findings
9.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by both Mr Foulkes and the Council and is satisfied that no matter of relevance has been overlooked.
Consideration of section 38(1)(b) ? personal information
10.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i), exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
11.The Council has maintained that the information is personal data (and also sensitive personal data), disclosure of which would breach the first and second data protection principles.
Sensitive personal data
12.Section 1(1) of the DPA defines personal data as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession or, or is likely to come into the possession of, the data controller(the full definition is set out in the Appendix).
13.The Commissioner is satisfied that the information under consideration is personal data ? it relates to Mr Al-Megrahi who could be identified from the information therein either alone or in conjunction with other information in the possession of the Council.
14.Section 2 of the DPA defines sensitive personal data.This includes at section 2(e), personal data consisting of information as to the data subject's physical or mental health or condition.The Commissioner is satisfied that the information under consideration, by relating to Mr Al-Megrahi's medical condition, is also sensitive personal data.
Consideration of the first data protection principle
15.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.Given the additional restrictions surrounding the disclosure of sensitive personal data, it makes sense to look firstly at whether there are any conditions in schedule 3 which would permit the sensitive personal data to be disclosed.
Schedule 3 of the DPA
16.There are 10 conditions listed in Schedule 3 to the DPA.One of these conditions, condition 10, also allows sensitive personal data to be processed in circumstances specified in an order made by the Secretary of State and, in addition to the conditions in Schedule 3, the Commissioner has also considered the additional conditions for processing sensitive personal data as contained in legislation such as the Data Protection (Processing of Sensitive Personal Data) Order 2000.
17.The Commissioner's guidance[1] on the section 38 exemption identifies that in practical terms there are only two conditions in schedule 3 that would allow sensitive personal data to be processed in relation to a request for information under FOISA, namely:
a.Condition 1 ? the data subject has given explicit consent to the release of the information; or,
b.Condition 5 ? the information contained in the personal data has been made public as a result of steps taken deliberately by the data subject.
18.The Council informed the Commissioner that when conducting its review of the original refusal it contacted Mr Al-Megrahi's legal representatives in order to ascertain whether Mr Al-Megrahi would consent to the disclosure of the reports. After consulting with him, the legal representatives confirmed that Mr Al-Megrahi did not consent to the release of the reports. The Council provided the Commissioner with copies of the relevant correspondence. The Commissioner is therefore satisfied that condition 1 of schedule 3 cannot be met.
19.The Commissioner also asked the Council to confirm whether it was aware of any steps taken by Mr Al-Megrahi, in this country or abroad, to make public the information contained in the monthly reports he provided to the Council. The Council provided the Commissioner with details of how the reports were made available to it and confirmed that it had no knowledge of any steps taken by Mr Megrahi to make that information publicly available. The Commissioner is satisfied that the method of transferring the reports to the Council does not involve any of the information entering the public domain. He is content that the Council does not have any knowledge of Mr Al-Megrahi having taken steps to make the information public.
20.The Commissioner must also consider the information relating to Mr Al-Megrahi that is already in the public domain in order to try and ascertain a) if that information is the information contained in the monthly reports submitted to the Council, and b) if it is, whether Mr Al-Megrahi deliberately took steps to make that information public.
21.The Commissioner is aware that there has been much reporting in the world's media about Mr Al-Megrahi's condition since his release. However, research undertaken on behalf of the Commissioner indicates that press and media reports contain generic information regarding Mr Al-Megrahi's condition along with speculation that the condition is either worsening or improving. The media reporting of his condition does not contain any specific clinical information.
22.Even if the information reported publicly about Mr Al-Megrahi's condition did match that contained in the reports requested by Mr Foulkes, there is no indication that the source of the published health related information is Mr Al-Megrahi himself. In the absence of any information either suggesting or positively confirming that Mr Megrahi has taken steps himself to deliberately make the information contained in the monthly reports of his condition submitted to the Council, the Commissioner concludes that condition 5 of schedule 3 cannot met.
23.Having also considered the other conditions in Schedule 3, the Commissioner has come to the conclusion that there are no conditions in Schedule 3 which would permit the sensitive personal data under consideration in this case to be processed via disclosure in response to Mr Foulkes' information request. He therefore finds that disclosure of the monthly reports on Mr Al-Megrahi's medical condition would breach the first data protection principle and that the information is therefore exempt from disclosure under section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i).
24.Having found that the information under consideration is exempt under section 38(1)(b) on the basis that disclosure would breach the first data protection principle,, the Commissioner is not required to consider whether disclosure would also breach the second data protection principle.
DECISION
The Commissioner finds that East Renfrewshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by George Foulkes MSP.
Appeal
Should either Mr Foulkes or the Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
15 June 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
?
(e)his physical or mental health or condition,
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
...
Schedule 3 ? Conditions relevant for purposes of the first principle: processing of sensitive personal data
1.The data subject has given his explicit consent to the processing of the personal data.
...
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
?
