|
Decision 105/2015: Mr Mark Howarth and the Chief Constable of the Police Service of Scotland
ICR report and related information
Reference No: 201500219
Decision Date: 7 July 2015
Summary
On 18 August 2015, Mr Howarth asked the Chief Constable of the Police Service of Scotland (Police Scotland) for the Initial Case Review (ICR) report concerning Daniel Welsh, with the reasons why this was not taken to a Significant Case Review (SCR).
Police Scotland responded by stating that the report was exempt from disclosure, on the basis it was personal information and related to a criminal investigation. Following a review, Mr Howarth remained dissatisfied and applied to the Commissioner for a decision.
The Commissioner investigated and found that Police Scotland partially failed to respond to Mr Howarth's request for information in accordance with Part 1 of FOISA. In particular, Police Scotland failed to identify all of the relevant information it held. The Commissioner accepted that all of the information was correctly withheld, however, on the basis that it was personal data and its disclosure would breach the first data protection principle.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); 2 (Sensitive personal data); Schedules 1 (The data protection principles) (the first data protection principle); 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 21 August 2014, Mr Howarth made a request for information to Police Scotland. The information requested was a copy of the ICR report in relation to Daniel Welsh (Request 1) and the reasons given by the Strategic Oversight Group (SOG) for not proceeding to a SCR (Request 2).
2. Police Scotland responded on 19 September 2015. Police Scotland stated that they were withholding information on the basis that sections 34(1) and 38(1)(b) of FOISA applied
3. On 13 November 2014, Mr Howarth wrote to Police Scotland requesting a review of their decision. He did not accept that the exemptions relied upon by Police Scotland applied in this case.
4. Police Scotland notified Mr Howarth of the outcome of their review on 9 December 2014, upholding the original decision without modification.
5. On 3 February 2015, Mr Howarth wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Howarth stated he was dissatisfied with the outcome of Police Scotland's review, explaining why he did not consider the exemptions relied upon to be applicable. He also questioned whether Police Scotland had considered Request 2.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr Howarth made requests for information to a Scottish public authority and asked the authority to review its response to those requests before applying to her for a decision.
7. On 17 February 2015, Police Scotland were notified in writing that Mr Howarth had made a valid application. They were asked to send the Commissioner the information withheld from him. Police Scotland provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions, with particular reference to the steps taken to identify and locate the relevant information, and the exemptions applied in their responses to Mr Howarth.
9. During the investigation, and following questioning by the investigating officer, Police Scotland identified documentation that fell within the scope of Request 2. Police Scotland sought to rely on sections 34(1) and 38(1)(b) of FOISA to withhold this information. Mr Howarth was provided with an opportunity to comment on this.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Howarth and Police Scotland. She is satisfied that no matter of relevance has been overlooked.
Information held by Police Scotland
11. In his application to the Commissioner, Mr Howarth argued that Request 2 had not been responded to by Police Scotland. When queried during the investigation, Police Scotland identified a document which recorded the reasons given by SOG for not proceeding to a full SCR in this case. Police Scotland sought to withhold this information on the same basis as the ICR report, applying sections 34(1) and 38(1)(b) of FOISA to withhold the information.
12. As Police Scotland failed to identify this information at the time it received Mr Howarth's request, or in carrying out a review, the Commissioner finds that it failed to comply with section 1(1) of FOISA in responding to his request.
13. The Commissioner will consider the application of section 38(1)(b) (to all of the withheld information) in the first instance.
Section 38(1)(b) - Personal information
14. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, (2)(b)) exempts personal data if their disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
Is the information under consideration personal data?
15. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).
16. The Commissioner has considered the submissions received from Police Scotland on this point, along with the withheld information. She is satisfied that the information withheld is personal data: it is possible to identify a living individual from the information itself, in line with the definition of personal data. The information is significantly biographical in relation to that individual, and therefore can be said to relate to him.
Is the withheld information sensitive personal data?
17. During the investigation, Police Scotland argued that the information comprised sensitive personal data.
18. The definition of sensitive personal data is contained in section 2 of the DPA (see Appendix 1).
19. The Commissioner has reviewed the information withheld. The Commissioner is satisfied that all of the personal data withheld in this case fall into at least one of the categories in section 2 of the DPA and therefore should be considered to be the sensitive personal data of Mr Welsh (the Commissioner is unable to confirm which of the categories of sensitive personal data are relevant here, without, in effect, disclosing sensitive personal data).
Would disclosure contravene the first data protection principle?
20. Police Scotland argued that the disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully and, in particular, are not processed unless at least one of the conditions in Schedule 2 to the DPA is met. For sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The processing in this case would be disclosure in response to Mr Howarth's information request.
The first data protection principle: sensitive personal data
21. Given the additional restrictions surrounding the disclosure of sensitive personal data, it is appropriate in this case to consider whether there are any conditions in Schedule 3 which would permit the data to be disclosed, before considering the Schedule 2 conditions. The conditions listed in Schedule 3 have been considered by the Commissioner, as have the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000.
22. Guidance issued by the Commissioner regarding the exemption in section 38(1)(b)[1] notes that, generally, only the first and fifth conditions are likely to be relevant when considering a request for sensitive personal data under FOISA. Condition 1 would allow personal data to be disclosed where the data subject has given explicit (i.e. specific, fully informed and freely given) consent to their release. Condition 5 would allow the personal data to be disclosed if the data had been made public as a result of steps deliberately taken by the data subject.
23. As far as the Commissioner is aware, Mr Welsh had not consented to the disclosure of the personal data. In the circumstances, she does not consider it appropriate to ask Police Scotland to seek consent from him. She does not consider the requirements for explicit consent to be capable of being fulfilled in the circumstances. She is also satisfied that Mr Welsh has not taken steps to place this information into the public domain, with the result that conditions 1 and 5 could not be met in this case.
24. Having reached this conclusion, and having concluded that no other condition in Schedule 3 applies in this case, the Commissioner finds that the disclosure of Mr Welsh's sensitive personal data would breach the first data protection principle. She therefore finds that Police Scotland were correct to withhold the information requested by Mr Howarth under section 38(1)() of FOISA. Consequently, she does not consider it necessary to go on to consider the application of section 34(1) of FOISA.
|
Decision
The Commissioner finds that the Chief Constable of Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Howarth.
The Commissioner finds that by withholding the information sought by Mr Howarth as personal information, in terms of section 38(1)(b) of FOISA, Police Scotland complied with Part 1.
However, by failing to identify all of the information falling within the scope of this request at the time of Mr Howarth's request, Police Scotland failed to comply with Part 1 of FOISA.
Given that Police Scotland identified the relevant information during the course of the investigation, which the Commissioner has accepted as correctly withheld under section 38(1)(b) of FOISA, the Commissioner does not require Police Scotland to take any action in respect of this failure.
|
Appeal
Should either Mr Howarth or the Chief Constable of the Police Service of Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
7 July 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
[1]
