Decision 113/2021: Vulnerable Person Database
Public authority: The Chief Constable of the Police Service of Scotland
Case Ref: 202001488
Summary
Police Scotland were asked to list all other parties they shared concern reports with since the inception of the VPD system. Police Scotland told the Applicant they did not hold the information requested, and issued a notice in terms of section 17(1) of FOISA.
The Commissioner investigated and found that the information was held, but accepted that the cost of complying with the request would exceed the cost limit and that Police Scotland were not obliged to comply.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 12(1) (Excessive cost of compliance); 17(1) (Notice that information is not held)
The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost - prescribed amount)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 13 October 2020, the Applicant made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). In relation to routinely sharing information with an iVPD and VPD identifier with Social Work and Education, the Applicant asked Police Scotland to list all "other parties" with which they shared concern reports, since the inception of their VPD system.
2. Police Scotland responded on 20 October 2020. They advised that they did not hold a list of "other parties" and issued a notice in terms of section 17(1) of FOISA.
3. Police Scotland explained that information from any police system could be shared with any individual or organisation where there was a lawful basis to do so, and this was assessed on a case by case basis. They provided a link to their Privacy Notices, available to view on the Police Scotland website.
4. On 20 October 2020, the Applicant wrote to Police Scotland, requesting a review of their decision as she disagreed with the notice given in terms of section 17(1) of FOISA.
5. Police Scotland notified the Applicant of the outcome of their review on 17 November 2020. They maintained that they did not hold a list of other parties that concern reports were shared with. They reiterated that any personal data held on any system could be shared with any individual or organisation where there was a lawful basis for doing so in terms of the Data Protection Act 2018. They stated that they did not hold a list, as each decision was made on a case by case basis, and details of any information sharing would be recorded in different places, depending on the nature of the request/response.
6. On 11 December 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated she was were dissatisfied with the outcome of Police Scotland's review because she did not agree with the notice given in terms of section 17(1) of FOISA.
Investigation
7. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
8. On 2 February 2021, Police Scotland were notified in writing that the Applicant had made a valid application and the case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 14 April 2021, Police Scotland were invited to comment on this application and to answer specific questions, focusing on the steps they had taken to identify and locate any information falling within the scope of the request.
10. In relation to the interpretation of the request, while Police Scotland advised the Applicant in their response and review outcome that they did not hold "a list" of the other parties referred to, the investigating officer suggested that the request might better be interpreted as the Applicant asking Police Scotland "to list" other relevant parties, rather than seeking an existing list.
11. It was also noted that Police Scotland had provided the Applicant with a link to their Privacy Notices, without further explanation. In fact, the Privacy Notice Protection and Wellbeing appeared relevant to the request, in that it concerned: Collection for, and creation of Concern Reports relating to Children and Adults, including update to the interim Vulnerable Persons Database (iVPD). The investigating officer noted that, within that Privacy Notice, Police Scotland listed organisations or individuals they might share information with, and that this information appeared to fall within the scope of the Applicant's request.
12. Police Scotland responded on 28 April 2021. Police Scotland accepted that the request could equally be interpreted as the Applicant seeking details of all other parties with whom Police Scotland had shared concern reports. Police Scotland confirmed that they held information falling within the scope of the request, and provided submissions to the effect that the cost of complying with the request would exceed the cost limit set by section 12(1) of FOISA.
13. On 10 May 2021, Police Scotland wrote to the Applicant and confirmed that they did hold information falling within the request and referred to the information contained in the Privacy Notice - Protection and Wellbeing, mentioned above. Police Scotland advised the Applicant, however, that the cost of retrieving and providing the information held within its systems would exceed the cost limit, with an explanation (see below). Consequently, they were applying section 12(1) of FOISA.
14. The Applicant acknowledged receipt of the response of 10 May 2021, but wished the Commissioner to come to a decision on the application of section 12(1) of FOISA, not being satisfied that this was engaged.
Commissioner's analysis and findings
15. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and Police Scotland. He is satisfied that no matter of relevance has been overlooked.
Information held by Police Scotland
16. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.
17. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the authority should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.
18. As outlined above, during the investigation, Police Scotland confirmed that they held information falling within the scope of the request and provided a further response to the Applicant. The Commissioner agrees with this changed position and therefore finds that Police Scotland were not been entitled to issue the Applicant with a response in terms of section 17(1) of FOISA.
19. As mentioned above, during the investigation, Police Scotland provided a further response to the Applicant, to the effect that the cost of complying would exceed the cost limit.
Section 12(1) - excessive cost of compliance
20. Section 12(1) provides that a Scottish public authority is not obliged to comply with a request for information where the estimated cost of doing so would exceed the relevant amount prescribed in the Fees Regulations. This amount is currently set at £600 (regulation 5 of the Fees Regulations). Consequently, the Commissioner has no power to require the disclosure of information should he find that the cost of responding to a request for that information would exceed this sum.
21. The projected costs an authority can take into account in relation to a request for information are, according to regulation 3 of the Fees Regulations, the total costs, whether direct or indirect, which the authority reasonably estimates it is likely to incur in locating, retrieving and providing the information requested in accordance with Part 1 of FOISA. The authority may not charge for the cost of determining (i) whether it actually holds the information requested or (ii) whether or not it should provide the information. The maximum rate a Scottish public authority can charge for staff time is £15 per hour.
22. Police Scotland submitted that section 12(1) applied to the Applicant's request. They confirmed that they held information falling within the scope of the request, but argued that the cost of locating, retrieving and providing that information would exceed the £600 cost limit.
23. The Applicant provided submissions to the effect that she could not accept that the requested information would not be readily accessible to the present owner of the iVPD/VPD database.
24. Police Scotland provided submissions to the effect that there would be information recorded on their iVPD system indicating that sharing took place, predominantly in partnership working between Police Scotland and local authority social work departments, NHS etc. They further submitted that information held on iVPD could be accessed and shared by a variety of force departments, with different parties, for different reasons, and that the sharing of such information would be recorded elsewhere, and not necessarily within the iVPD system.
25. Police Scotland provided examples of this, such examples also being contained in the further response they provided to the Applicant on 10 May 2021, as outlined above.
26. Police Scotland explained that there is no search functionality of the iVPD system which would allow them to extract whether concern reports had been shared with other parties. Accordingly, the only way to ascertain which other parties the reports had been shared with would be to examine each individual record.
27. Police Scotland advised that there were hundreds of thousands of individuals recorded on iVPD at any given time, explaining that, for example, there were in excess of 800,000 nominals recorded on the iVPD system as at June 2020,.
28. Applying the individual limit of £15 per hour, Police Scotland submitted that they could only spend 40 hours on the request before the £600 was reached. They submitted that the time taken to check each individual record would depend on the content of each record. While some might only take a few minutes, others would take longer. Police Scotland submitted that, if it took an average of 10 minutes for a staff member to check each record, they could only check around 240 individual records within the cost limit.
29. Police Scotland also included these calculations within their further response of 10 May 2021 and advised the Applicant that they could see no meaningful way in which the request could be refined in a way that would bring it within the cost provisions provided for by FOISA.
30. Having considered the explanations provided, the Commissioner accepts that the requested information could not readily be extracted from the systems used by Police Scotland, without examining all the individual files.
31. While the time it will take to examine each file is an unknown quantity, taking account of all the circumstances, the Commissioner is satisfied that Police Scotland have provided a reasonable estimate of the cost of complying with the Applicant's request for information. Even if it only took one minute to check each case file, the cost would far exceed the limit of £600.
32. The Commissioner also accepts that, even if the request was limited in some way, given the nature of the work required to locate and retrieve any information that would fall within the scope of the request (i.e. the examination of each individual file), the request could not have been responded to within the £600 limit.
33. Consequently, the Commissioner is satisfied that Police Scotland were entitled to rely on section 12(1) of FOISA in relation to the Applicant's information request, and therefore were under no obligation to comply with the request.
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that, by incorrectly advising the Applicant that they did not hold information falling within the scope of the request, Police Scotland failed to comply with section 1(1) of FOISA. However, the Commissioner is satisfied that it would cost Police Scotland more than £600 to comply with the request (and so, by virtue of section 12(1) of FOISA, they were not obliged to do so).
Appeal
Should either the Applicant or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
3 August 2021
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
(6) This section is subject to sections 2, 9, 12 and 14.
12 Excessive cost of compliance
(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
…
Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004
3 Projected costs
(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.
(2) In estimating projected costs-
(a) no account shall be taken of costs incurred in determining-
(i) whether the authority holds the information specified in the request; or
(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and
(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed £15 per hour per member of staff.
5 Excessive cost - prescribed amount
The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is £600.
