Decision 106/2011 Dr A and NHS Education for Scotland
Applicant's personal data
Reference No: 201100081
Decision Date: 31 May 2011
Summary
Dr A requested from NHS Education for Scotland (NES) certain information relating to himself.NES clarified Dr A's request and then responded by treating it as a subject access request under the Data Protection Act 1998 (the DPA).NES provided Dr A with some information under the DPA, while also notifying Dr A that the same information was not being disclosed under FOISA as it was exempt in terms of section 38(1)(a).Following a review, as a result of which NES upheld its reliance on section 38(1)(a) of FOISA, Dr A remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that NES had dealt with Dr A's request for information in accordance with Part 1 of FOISA, by withholding the information under FOISA as the applicant's personal data.He did not require NES to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(i) (Effect of exemptions) and 38(1)(a) and (5) (definitions of "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data")
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 1 November 2010, under a heading referring to a request for personal information under FOISA and the DPA, Dr A wrote to NES expressing his concern about remarks he understood to have been made by a named colleague at specified meetings.This was acknowledged by NES on 2 November 2010.
2.NES wrote to Dr A on 4 November 2010, asking him to clarify what information he was seeking.NES explained to Dr A that if his request was for his personal data it would be dealt with under the DPA: if this was what he intended, it required certain information from him to process the request.
3.Dr A responded to NES on 5 November 2010, indicating that he would provide the information requested by NES to enable it to process his request.Having received this information, NES responded on 25 November 2010. It provided Dr A with his personal data (under the DPA), confirming that the minutes of the meetings referred to in his initial request made no reference to him.Noting that he had also referred to FOISA in his initial request, NES also gave Dr A a refusal notice (under FOISA) in relation to the request, relying on the exemption in section 38(1)(a) (Personal information).
4.On 6 December 2010, Dr A wrote to NES requesting a review of its decision, on the basis that his request for information had been declined.
5.NES notified Dr A of the outcome of its review on 15 December 2010.NES upheld its initial decision that all Dr A's personal data had been supplied to him under the DPA, and that this information was exempt in terms of section 38(1)(a) of FOISA.
6.On 5 February 2011 Dr A wrote to the Commissioner, stating that he was dissatisfied with the outcome of NES's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
7.The application was validated by establishing that Dr A had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.The case was then allocated to an investigating officer.
Investigation
8.The investigating officer subsequently contacted NES, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.NES was asked to explain why it had dealt with Dr A's request as it had done.
9.The relevant submissions received from NES and Dr A will be considered more fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
10.In coming to a decision on this matter, the Commissioner has considered all the submissions made to him by both Dr A and NES and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(a) ? Personal information
11.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.The fact that it is absolute means that it is not subject to the public interest test set out in section 2(1) of FOISA.
12.This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a "subject access request") under section 7 of the DPA.This ensures that such information is disclosed to the data subject (rather than to the world at large, which is the effect of disclosure under FOISA) under a regime designed for such purposes.It is not one of the purposes of FOISA to give the data subject a more extensive right of access to their own personal data than they would enjoy under the regime primarily governing the processing of that data, even if the applicant might wish that to be the case.
13.Personal data are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
14.As part of the Commissioner's investigation, NES was asked why it considered Dr A had requested his personal data in his email of 1 November 2010.
15.NES explained that Dr A's email header described the request as "search for personal information".It also referred to remarks about himself and his colleagues.
16.Thirdly, NES sought clarification as follows (4 November 2010):
"? it is not exactly clear what information you are requesting.If you are requesting your own personal data under the Data Protection Act, to allow us to proceed with your request, we require payment of an administrative fee and proof of identity."
17.To this request for clarification, Dr A had responded in the affirmative, which NES accepted as a confirmation of its interpretation of the request as a request for his own personal data. NES commented that at no point in its subsequent correspondence with Dr A had he contradicted this interpretation of his request, or clarified it to include information other than his own personal data.
18.Finally, NES argued that Dr A was requesting data relating to an identifiable, living individual (himself), which was therefore clearly personal data under the DPA and disclosable to him under that Act.
19.Having considered all of the relevant communications, the Commissioner accepts as entirely reasonable in the circumstances NES's interpretation that Dr A made a request for his own personal data.The Commissioner has therefore concluded that NES was correct to withhold the information requested by Dr A under section 38(1)(a) of FOISA, while dealing with the request under the DPA.
20.As noted above, the exemption in section 38(1)(a) is an absolute one and the Commissioner is therefore not required (or entitled) to go on to consider whether the public interest lies in the information being disclosed or withheld.The fact that the information is the applicant's personal data means that it is exempt from disclosure under FOISA, and if that is the case the Commissioner must (even where the applicant has expressed a clear wish that disclosure should be under FOISA) accept that it should be withheld.As he has indicated in paragraph 12 above, the appropriate route for dealing with such a request is under the DPA and not under FOISA.
21.As has been mentioned to Dr A, if he believes that NES has not dealt with his request for his personal data in accordance with the DPA, his recourse is contact with the Information Commissioner's Office (ICO), which is responsible for the DPA.
DECISION
The Commissioner finds that NHS Education for Scotland (NES) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Dr A.
Appeal
Should either Dr A or NHS Education for Scotland wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
31 May 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
(i) paragraphs (a), (c) and (d); and
...
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
?.
(5) In this section-
?
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
