| Decision 109/2015: Mr Paul Hutcheon and the Chief Constable of the Police Service of Scotland
Statistics for covert surveillance
Reference No: 201402625
Decision Date: 9 July 2015
Summary
On 15 April 2014, Mr Hutcheon asked the Chief Constable of the Police Service of Scotland (Police Scotland) for statistical information on interception warrants and authorisations and notices for communications.
Police Scotland withheld some information, explaining that RIPA legislation prevented its disclosure. For the remaining requests, they submitted that the cost of compliance would exceed the ?600 cost limit (so they were not required to respond). Mr Hutcheon remained dissatisfied with the outcome and applied to the Commissioner for a decision.
The Commissioner investigated and found that Police Scotland were entitled to withhold the information about interception warrants under section 26(a) of FOISA.
However, she was not satisfied that the Police were entitled to refuse to comply with the requests about authorisations and notices on the basis of excessive cost. She also identified a failure in the time taken by Police Scotland to issue the review outcome.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(b) (Effect of exemptions); 12(1) (Excessive cost of compliance); 21(4)(b) (Review by Scottish public authority); 26(a) (Prohibitions on disclosure)
The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost - prescribed amount)
Regulation of Investigatory Powers Act 2000 (RIPA) section 19(1), (2)(e), (3) to (9) (Offence for unauthorised disclosures)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendices form part of this decision.
Background
1. Mr Hutcheon's request concerned statistical information relating to authorisations obtained for intercepting communication systems and gathering communications data. The Regulation of Investigatory Powers Act 2000[1] (RIPA) provides specified public authorities, including Police Scotland, with a regulatory framework within which they may undertake such activity lawfully.
2. On 15 April 2014, Mr Hutcheon made eight requests to Police Scotland. These are reproduced in full in Appendix 2 to this decision. The requests fall into two categories, relating to:
(i) interception warrants (for intercepting communication systems) and
(ii) authorisations and notices for communications (for obtaining/disclosing communications data).
3. Police Scotland responded on 14 May 2014.
(i) They withheld information for the requests in category (i), explaining why they considered this to be exempt under section 26(a) of FOISA.
(ii) For the requests in category (ii), Police Scotland referred to the provisions in section 18 of FOISA, neither confirming nor denying whether they held the information requested. When doing so, they made reference to exemptions in sections 31, 34, 35 and 39(1) of FOISA.
4. On 2 June 2014, Mr Hutcheon wrote to Police Scotland, requesting a review of their decision on the basis that:
(i) the information requested could not lead to the identification of individuals,
(ii) legacy forces (i.e. Police Scotland's statutory predecessors) had released such information in the past,
(iii) the Interception of Communications Commissioner (IC) already published figures for individual public bodies, and
(iv) there was a huge public interest in the scale of surveillance and interceptions.
5. Police Scotland emailed Mr Hutcheon on 6 June 2014, seeking clarification as to whether he required a review for the entire response, or just in relation to the requests in category (ii).
6. Mr Hutcheon confirmed to Police Scotland (on 22 July 2014) that he was seeking a review in relation to the entire response. He added that he did not accept section 26(a) applied to the information in category (i).
7. Police Scotland notified Mr Hutcheon of the outcome of their review on 6 November 2014. For the requests in category (i), they continued to rely upon section 26(a) of FOISA. For those in category (ii), Police Scotland provided information for full calendar years. They estimated that the cost of disclosing information for the periods specified by Mr Hutcheon would exceed the sum of ?600 prescribed for the purposes of section 12(1) of FOISA. Consequently, they took the view that they were not obliged to comply with these requests.
8. On 6 November 2015, Mr Hutcheon wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Hutcheon stated that he disagreed with Police Scotland's refusal to provide the information.
Investigation
9. The application was accepted as valid. The Commissioner confirmed that Mr Hutcheon made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
10. On 13 November 2014, Police Scotland were notified in writing that Mr Hutcheon had made a valid application. The case was allocated to an investigating officer.
11. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions on their reasons for relying upon sections 12 and 26(a) of FOISA. Police Scotland provided submissions in response.
Commissioner's analysis and findings
12. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to her by both Mr Hutcheon and Police Scotland. She is satisfied that no matter of relevance has been overlooked.
Section 26 of FOISA - prohibitions on disclosure
13. Police Scotland withheld information for category (i) (requests 1. to 4. inclusive) under section 26 of FOISA.
14. Section 26(a) of FOISA exempts information from disclosure under FOISA where that disclosure is prohibited by or under an enactment. This is an absolute exemption, in that it is not subject to the public interest test in section 2(1)(b) of FOISA. In this case, Police Scotland argued that such a prohibition was created by section 19 of RIPA.
15. In his requirement for review, Mr Hutcheon contended that the information he sought could not lead to the identification of individuals. He also suggested that, in the past, the legacy forces (predecessors of Police Scotland) had released the kind of information he requested. He noted that the IC already published figures for individual public bodies.
16. Police Scotland contended that it would be a criminal offence for it to disclose the information. In support of its position, Police Scotland referred to the IC's 2013 Annual Report, which states (at section 5.6 of the report) that:
"Section 19 [of RIPA] imposes a duty to keep secret the existence, content and details of interception warrants, everything in intercepted material and related communications data and related matters. Contravention of the statutory provisions is a criminal offence."[2]
17. In addition, Police Scotland explained that the IC's yearly report, which is published online, contains statistical information in the form of annual (but not monthly) totals. This data, they went on to explain, includes the numbers of interception warrants granted to intercepting agencies across the whole of the UK. They noted that the information is not broken down by agency.
18. Additional comments were received from Police Scotland in relation to these requests, but the Commissioner does not consider these relevant to the application of section 26(a) in this case. They address the public interest (as did Mr Hutcheon, in comments not set out at length here). As indicated above, the exemption in section 26(a) is absolute.
19. The Commissioner has considered the submissions for this case carefully. She understands why Mr Hutcheon might consider these statistics to be anonymous, but that does not address the prohibition in section 19 fully. Section 19 of RIPA clearly applies to Police Scotland and lists the categories of information which must be kept secret. These include the existence of any warrant. The Commissioner accepts that the publication of numbers (including numbers of renewals) will confirm the existence of the relevant warrants. She considers it immaterial whether like information was disclosed in the past by Police Scotland's predecessors. If she is satisfied that Police Scotland is correct now, it is not for her to revisit any decisions made on such information by other authorities in the past.
20. There are defences to disclosure listed in section 19 of RIPA, but the Commissioner does not consider any of them to be applicable here. She notes the provisions of section 19(9) in relation to disclosures authorised by the IC but, having considered the whole of paragraph 5.6 of the IC's report (referred to in paragraph 16 above), she does not consider it remotely likely that the IC would consider such authorisation to be applicable to the circumstances of this request.
21. In all the circumstances, therefore, the Commissioner finds that the disclosure of information falling within category (i) is (and was, at the time Police Scotland responded to Mr Hutcheon's request and requirement for review) prohibited by section 19 of RIPA. Accordingly, Police Scotland were entitled to apply section 26(a) of FOISA in relation to these requests. She will now go on to consider those requests (5. to 8. inclusive) falling within category (ii).
Section 12(1) - Excessive cost of compliance
22. Under Section 12 of FOISA, a Scottish public authority is not obliged to comply with a request for information where the estimated cost of doing so would exceed the amount prescribed for that purpose in the Fees Regulations. This amount is currently ?600 (regulation 5). Consequently, the Commissioner has no power to order a public authority to disclose information should she find that the cost of responding to a request for that information exceeds this sum.
23. The projected costs the public authority can take into account in relation to a request for information are, according to regulation 3 of the Fees Regulations, the total costs, whether direct or indirect, the authority reasonably estimates it is likely to incur in:
(i) locating
(ii) retrieving, and
(iii) providing
the information requested in accordance with Part 1 of FOISA. The maximum rate a Scottish public authority can charge for staff time is ?15 per hour.
24. Police Scotland explained the process which would be required to gather the relevant data. They explained that the data were to be found in nine legacy systems, one from each of the former Scottish forces. These remained in operation throughout the period covered by these requests (although they have since been replaced by a single system).
25. Police Scotland went on to explain that three of the systems were electronic, while six were paper-based. They explained that the IC required statistical data for each calendar year and the systems had been set up to address this business need. As there was no need for a further breakdown, none of the systems were set up to allow for one.
26. Police Scotland told Mr Hutcheon that the data were collated on an annual basis. It may have helped to explain to Mr Hutcheon why the data were collated on an annual basis and the implications of this. The point does not appear to have been understood by Mr Hutcheon, as subsequent communications with the Commissioner state his concern that he was given information covering dates he did not ask for.
27. Police Scotland also gave details of the legacy systems used, and the tasks, skills and resources required to extract the required information. It explained that a staff member and/or police officer (suitably trained and vetted) would need to interrogate each system and examine each individual record in turn. This would require a degree of seniority, given the sensitivity of the information, with the result that the maximum hourly rate of ?15 would be engaged. Given that not all the staff who were familiar with the systems remained in post, the work would not necessarily be straightforward and some training might be required.
28. Police Scotland noted that there were more than 19,000 relevant applications annually, an average of approximately 1,500 per calendar month. It provided estimated times for retrieving the data, locating the relevant records and extracting the required figures. In support of these estimates costs, Police Scotland referred to a scoping exercise carried out by the IC for its 2013 Annual Report, to consider the provision of further statistical information.
29. The Commissioner notes that Mr Hutcheon was seeking data from April to December for both 2012 and 2013, in other words two separate periods of 9 months. She also notes that Police Scotland provided Mr Hutcheon with data for calendar years 2012 and 2013, which (although it was not what Mr Hutcheon asked for) appears to have been done with the intention of being helpful.
30. The Commissioner has considered Police Scotland's submissions fully, including their estimates for carrying out the necessary work. The Commissioner acknowledges the practical difficulties arising from the need to extract data from a number of diverse (and no longer current) systems. She acknowledges that Police Scotland have no specific business need to collate this information for the periods specified by Mr Hutcheon. The records may be poorly organised, but it remains possible that, on a reasonable estimate, the cost of compliance with each of these requests would exceed the ?600 limit.
31. The problem the Commissioner faces is that the calculations provided by Police Scotland lack both coherence and consistency. It is not clear from Police Scotland's submissions what work would be involved in identifying, locating and retrieving the information, either for a month or for the whole period covered by each request, especially in light of the fact they have already provided calendar year information.
32. The Commissioner is satisfied that Police Scotland have been given adequate opportunity to make a robust case for responding to each of these requests under section 12(1) of FOISA. She is not satisfied that they have done so. Therefore, she is not prepared to uphold their application of section 12(1) in this case. In respect of requests 5. to 8. inclusive, the Commissioner requires Police Scotland to substitute (in terms of section 21(4) of FOISA) their decision that section 12 applies with a different decision.
Timescales
33. Mr Hutcheon expressed concern at the time taken to respond to his requirement for review.
34. Police Scotland stated that a review was carried out and a response prepared, dated 11 August 2014. They acknowledged that Mr Hutcheon did not receive this, and did not do so until a further copy was sent on 6 November 2014. They could not establish that an earlier response was in fact sent, and apologised for the oversight.
35. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review. This is subject to qualifications which are not relevant in this case.
36. Police Scotland did not provide a response to Mr Hutcheon' s requirement for review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA.
37. As the review decision was issued on 6 November 2014, the Commissioner does not require Police Scotland to take any further action in respect of this failure.
|
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information requests made by Mr Hutcheon.
The Commissioner finds that Police Scotland:
(i) were entitled to apply the exemption in section 26(a) of FOISA to requests 1. to 4. inclusive
(ii) were not entitled to refuse to comply with requests 5. to 8. (inclusive) on the basis of section 12 of FOISA
(iii) failed to respond to Mr Hutcheon's requirement for review within the timescale set down in section 21(1) of FOISA.
In respect of the breach at (ii), the Commissioner requires Police Scotland to take the action referred to in paragraph 32.
|
Appeal
Should either Mr Hutcheon or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Rosemary Agnew
Scottish Information Commissioner
9 July 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
...
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(b) section 26;
?
12 Excessive cost of compliance
(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.
?
21 Review by Scottish public authority
...
(4) The authority may, as respects the request for information to which the requirement relates -
?
(b) substitute for any decision a different decision; ?
26 Prohibitions on disclosure
Information is exempt information if its disclosure by a Scottish public authority (otherwise than under this Act)-
(a) is prohibited by or under an enactment;
?
Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004
3 Projected costs
(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.
(2) In estimating projected costs-
(a) no account shall be taken of costs incurred in determining-
(i) whether the authority holds the information specified in the request; or
(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and
(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed ?15 per hour per member of staff.
5 Excessive cost - prescribed amount
The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is ?600.
?
Regulation of Investigatory Powers Act 2000
19 Offence for unauthorised disclosures
(1) Where an interception warrant has been issued or renewed, it shall be the duty of every person falling within subsection (2) to keep secret all the matters mentioned in subsection (3).
(2) The persons falling within this subsection are-
?
(e) every person employed by or for the purposes of a police force;
?
(3) Those matters are-
(a) the existence and contents of the warrant and of any section 8(4) certificate in relation to the warrant;
(b) the details of the issue of the warrant and of any renewal or modification of the warrant or of any such certificate;
(c) the existence and contents of any requirement to provide assistance with giving effect to the warrant;
(d) the steps taken in pursuance of the warrant or of any such requirement; and
(e) everything in the intercepted material, together with any related communications data.
(4) A person who makes a disclosure to another of anything that he is required to keep secret under this section shall be guilty of an offence and liable-
(a) on conviction on indictment, to imprisonment for a term not exceeding five years or to a fine, or to both;
(b) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum, or to both.
(5) In proceedings against any person for an offence under this section in respect of any disclosure, it shall be a defence for that person to show that he could not reasonably have been expected, after first becoming aware of the matter disclosed, to take steps to prevent the disclosure.
(6) In proceedings against any person for an offence under this section in respect of any disclosure, it shall be a defence for that person to show that-
(a) the disclosure was made by or to a professional legal adviser in connection with the giving, by the adviser to any client of his, of advice about the effect of provisions of this Chapter; and
(b) the person to whom or, as the case may be, by whom it was made was the client or a representative of the client.
(7) In proceedings against any person for an offence under this section in respect of any disclosure, it shall be a defence for that person to show that the disclosure was made by a legal adviser-
(a) in contemplation of, or in connection with, any legal proceedings; and
(b) for the purposes of those proceedings.
(8) Neither subsection (6) nor subsection (7) applies in the case of a disclosure made with a view to furthering any criminal purpose.
(9) In proceedings against any person for an offence under this section in respect of any disclosure, it shall be a defence for that person to show that the disclosure was confined to a disclosure made to the Interception of Communications Commissioner or authorised -
(a) by that Commissioner
(b) by the warrant or the person to whom the warrant is or was addressed;
(c) by the terms of the requirement to provide assistance; or
(d) by section 11(9).
Appendix 2: Mr Hutcheon's request
"Please consider the following as individual questions under FOI
1. How many applications for an interception warrant were made by the old legacy forces/chief constables of the legacy forces between April 1st 2012 and December 31st 2012? Of these, how many were approved?
2. How many applications for an interception warrant were made by Police Scotland chief constable Stephen House between April 1st 2013 and December 31st 2013? Of these, how many were approved?
3. How many applications for an interception warrant renewal were made by the old legacy forces/chief constables of the legacy forces between April 1st 2012 and December 31st 2012? Of these, how many were approved?
4. How many applications for an interception warrant renewal were made by the old legacy forces/chief constables of the legacy forces between April 1st 2013 and December 31st 2013? Of these, how many were approved?
5. How many authorisations and notices for communications under RIPA 2000 Part I Chapter II 2011 were granted/given by the legacy forces between April 1st 2012 and December 31st 2012? The figure should exclude those that are "urgent oral".
6. How many authorisations and notices for communications under RIPA 2000 Part I Chapter II 2011 were granted/given by Police Scotland between April 1st 2013 and December 31st 2013? The figure should exclude those that are "urgent oral".
7. How many "urgent oral" authorisations and notices for communications under RIPA 2000 Part I Chapter II 2011 were granted/given by the legacy forces between April 1st 2012 and December 31st 2012?
8. How many "urgent oral" authorisations and notices for communications under RIPA 2000 Part I Chapter II 2011 were granted/given by Police Scotland between April 1
st 2013 and December 31
st 2013?"
[1]
[2] .
