Decision 101/2019: Looked after children in care (in and from other areas)

Public authority: Orkney Islands Council
Case Ref: 201900326

Summary

The Council was asked for five years of statistical data concerning looked after children, both placed in the Orkney area by other local authorities and placed by the Council in other local authority areas.

The Council withheld the information under section 38(1)(b) of FOISA, believing disclosure would contravene the first data protection principle. During the investigation, it disclosed some data but continued to withhold the remainder.

By the end of this investigation, the Commissioner was satisfied that the remaining data was correctly withheld.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b), (2A)(a), (5) (definitions of "the data protection principles", "data subject", "the GDPR", "personal data" and "processing") and (5A) (Personal information)

General Data Protection Regulation (the GDPR) articles 4(11) (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(a) and (f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 3 December 2018, Ms H made a request for information to Orkney Islands Council (the Council). Ms H stipulated the period "during the past five financial years (2013/14, 2014/15, 2015/16, 2016/17, and 2017/18)" in her request and asked for "information about looked-after children placed in care":

(a) inthe Council's area, by other local authoritiesand

(b) from the Council's area, in other local authority areas.

For each year, Ms H asked for both a list of all the authorities that had placed children in the Council's area/had children placed in their areas, and the number of children involved in each case.

2. The Council responded on 7 December 2018,refusing the information in terms of section 38(1)(b) of FOISA (which relates to personal data). The Council submitted that disclosure would be unfair and contrary to the first data protection principle, given the low numbers involved.

3. On 14 December 2018, Ms H wrote to the Council requesting a review of its decision: she did not accept that the data in question were personal data, as she believed they were incapable of identifying anyone.

4. The Council notified Ms H of the outcome of its review on 14 January 2019, upholding its original decision without modification.

5. On 20 February 2019, Ms H wrote to the Commissioner's office. She applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Ms H stated she was dissatisfied with the outcome of the Council's review because, even if there were small numbers involved, she did not consider it possible to identify anyone from the information.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Ms H made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 15 March 2019, the Council was notified in writing that Ms H had made a valid application. The Council was asked to send the Commissioner the information withheld from Ms H and it did so. The case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions, focusing on the risks of identifying the children concerned and other aspects of section 38(1)(b) of FOISA. The Council provided submissions in response.

9. On 10 June 2019, the Council wrote to Ms H, confirming that there were no children placed in its care by other councils. It also confirmed that it placed eight or fewer children per annum in the care of other authorities, maintaining its position that specific numbers were exempt under section 38(1)(b) of FOISA. Following receipt of this information, Ms H continued to seek a decision on the Council's application of section 38(1)(b).

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Ms H and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) (Personal information)

11. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.

12. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

13. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.

Is the withheld information personal data?

14. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. (The definition is set out in full in Appendix 1.)

15. The Commissioner's briefing on section 38 (Personal information)[1] notes that the two main elements of personal data are that:

(i) the information must "relate to" a living person; and

(ii) the living individual must be identifiable.

16. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

17. An "identifiable living individual" is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).

18. The information withheld by the Council comprises numbers of looked-after children placed in care by the Council in other local authority areas.

19. In her application, Ms H submitted that the data she specified in her request was essentially statistical and in summary form. She did not accept that her request captured sufficient detail to identify anyone.

20. The Council provided submissions relative to the specific situations in Orkney, given the low numbers involved and the dispersal of the children. It explained how it believed identification would be a realistic prospect, particularly in an area where (in its view) "retaining the privacy of individuals is more challenging than in larger population centres". In the circumstances, it submitted that it "would not take more than reasonably enquiry" for parents (and others) to identify the (invariably vulnerable) children concerned. The Commissioner cannot set out these arguments in any further detail without focusing on the withheld information itself.

21. Having considered the Council's arguments, which are to a large extent specific to its own particular circumstances, the Commissioner is satisfied that the information captured by Ms H's request would, if disclosed, offer a realistic prospect of identifying the children concerned. It relates to key aspects of the personal lives of those children and therefore must be said to relate to them. It must therefore be their personal data for the purposes of section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles?

22. Article 5(1)(a) of the GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."

23. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". For the purposes of FOISA, personal data are processed when disclosed in response to a request. This means that the personal data can only be disclosed if disclosure would be both lawful (i.e. it would meet one of the conditions for lawful processing listed in Article 6(1) of the GDPR) and fair.

Lawful processing: Article 6(1)(a) and (f) of the GDPR

24. The Commissioner considers conditions (a) and (f) of Article 6(1) of the GDPR are the only ones which could potentially apply in the circumstances of this case.

25. Condition (a) states that processing will be lawful if the data subject has given consent to the processing of the data for one or more specific purposes. "Consent" is defined in Article 4 of the GDPR as:

"…any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her"

26. In its submissions, the Council explained that the children concerned had not been asked (and by implication had not given) permission to disclose these data. The Commissioner is satisfied that there was no requirement on the Council to seek consent. In the absence of consent, condition (a) cannot be met.

27. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child."

28. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

29. The tests which must be met before Article 6(1)(f) can be met are as follows:

a) Does Ms H have a legitimate interest in obtaining the personal data?

b) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

c) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the person making this request have a legitimate interest in obtaining the personal data?

30. The Council stated that it must assume any information disclosed under FOISA might be published, but did not question Ms H having a legitimate interest in obtaining the personal data.

31. In her correspondence, Ms H has not stated exactly what here legitimate interest in these data might be, although it is apparent from the terms of the request that she is undertaking research of the situation across local authorities in Scotland. The Commissioner also notes Ms H's statements to the effect her intention is to obtain what she believes to be anonymised statistical data.

32. It is clear the data captured by this request is capable of informing both Ms H and the wider public Scotland-wide, on a geographical basis (based on local authority boundaries) and over a recent period of time, and so is more than just local interest. The Commissioner accepts that Ms H, as a journalist or as an interested member of the public, has a legitimate interest in seeking the information in question.

Is disclosure of the personal data necessary to achieve that legitimate interest?

33. The Commissioner has given consideration to whether Ms H's legitimate interest can be satisfied other than by disclosure of all of these particular personal data.

34. The Council stated that these children are removed from their parents to protect their wellbeing and to promote their interests. It must, therefore, take all reasonable steps to ensure that no information is disclosed which could identify the children and thus put them at risk. The Council also highlighted its duties of care as corporate parent of the children concerned, under the Children and Young People (Scotland) Act 2014, and also the need to respect the children's key rights under the United Nations Convention on the Rights of the Child.

35. To be "necessary" in this context, disclosure would need to proportionate as a means (of achieving Ms H's legitimate interest) and fairly balanced as to ends, and it is relevant to consider whether these interests be achieved by means which interfere less with the privacy of the data subjects. In assessing this, having concluded that the information in question is the personal data of the children concerned, the Commissioner considers it important to take account of the children's particular circumstances, including their vulnerability and the consequent duties owed to them by the Council and society more widely.

36. In all the circumstances, the Commissioner is not satisfied that disclosure of precise figures was necessary to meet Ms H's legitimate interests in this particular case, with the result that the condition in Article 6(1)(f) could not be met. Accordingly, disclosure of the personal data sought by Ms H (the precise figures) would be unlawful and so contrary to Article 5(1)(a) of the GDPR.

37. The Commissioner notes that the Council wrote to Ms H (on 10 June 2019) to confirm that the number of children placed into care outside Orkney was eight or less per annum. The Commissioner is satisfied that this is sufficient information to address Ms H's interests in this case, although he also considers the Council should have provided these details in responding to the request or requirement for review.

Fairness

38. Given that the Commissioner's finding that processing would be unlawful, he is not required to go on to consider separately whether disclosure of the personal data would otherwise be fair or transparent in relation to the data subjects.

39. The Commissioner therefore finds that the withheld personal data are properly withheld under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that, in respect of the matters specified in the application, Orkney Islands Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Ms H.

Appeal

Should either Ms H or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
4 July 2019

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

…

(5) In this section-

"the data protection principles" means the principles set out in -

(a) Article 5(1) of the GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);

…

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

General Data Protection Regulation

4 Definitions

For the purposes of this Regulation:

…

11 "consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

…

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

…

f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -

…

(d) disclosure by transmission, dissemination or otherwise making available.

…

(subject to subsection (14)(c) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).

(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.

…

(10) "The GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

---