Decision 116/2007 Mrs B and Moray Council
Request for copies of letters of complaint relating to the applicant's provision of foster care
Applicant: Mrs B
Authority: Moray Council
Case No: 200601592
Decision Date: 18 July 2007
Kevin Dunion
Scottish Information Commissioner
Request for copies of two letters of complaint relating to the applicant submitted to Moray Council-information withheld.
Relevant Statutory Provisions and Other Sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General Entitlement) and 38(1)(a) and (b) and (2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 sections 1(1) (Basic interpretative provisions) (definition of personal data) and 2 (Sensitive personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for the purposes of the first principle: processing of any personal data) (condition 6(1)).
The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Facts
Mrs B requested copies of two letters of complaint relating to her and her husband's provision of foster care held by Moray Council (the Council). The Council responded by withholding the letters requested on the basis that the documents contained personal information which was exempt under FOISA. Mrs B was not satisfied with this response and asked the Council to review its decision. The Council carried out a review and, as a result, notified Mrs B that it upheld its original decision to withhold the information. Mrs B remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Council had dealt with Mrs B's request for information in accordance with Part 1 of FOISA.
Background
1. On 14 August 2006, Mrs B wrote to the Council requesting copies of two specific letters of complaint dated 7 and 9 June 2005 relating to her and her husband's provision of foster care.
2. On 27 September 2006, the Council wrote to Mrs B in response to her request for information. The Council refused to supply Mrs B with the documents, explaining that it had dealt with her request as a subject access request under the Data Protection Act 1998 (the DPA) and was refusing to provide the information as the documents contained third party personal data.
3. On 16 October 2006, Mrs B wrote to the Council requesting a review of its decision. In particular, Mrs B felt that the documents contained information relating to her and her husband's provision of care and she was therefore entitled to be provided with the information.
4. On 17 October 2006, the Council wrote to notify Mrs B of the outcome of its review. The Council upheld its original decision to withhold the information and again explaining that it had dealt with her request under the terms of the DPA.
5. On 28 September 2006, Mrs B wrote to my Office, stating that she was dissatisfied with the outcome of the Council's review and applying to me for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Mrs B had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to that request.
7. On 29 November 2006, the Council was notified in writing that an application had been received from Mrs B and was asked to provide my Office with specified items of information required for the purposes of the investigation. The Council responded with the information requested and the case was then allocated to an investigating officer.
The Investigation
8. In its submissions the Council confirmed that it had originally dealt with Mrs B's request under the terms of the DPA but acknowledged that, on reflection, having considered the wording of the request, it may have been more appropriate to deal with Mrs B's request under FOISA.
9. In light of the above, the Council cited sections 38(1)(a) and 38(1)(b) (Personal information) of FOISA in withholding the information requested by Mrs B within its submissions to my Office.
The Commissioner's Analysis and Findings
10. In coming to a decision on this matter, I have considered all of the information and the submissions that have been presented to me by both Mrs B and the Council and I am satisfied that no matter of relevance has been overlooked.
11. The Council applied sections 38(1)(a) and 38(1)(b) of FOISA in withholding both documents requested by Mrs B.
Section 38(1)(a)-personal information of which the applicant is the data subject
12. Section 38(1)(a) provides that information is exempt information if it constitutes personal data of which the applicant is the data subject. This exemption exists under FOISA because of the separate right individuals have to make requests for their own personal information (known as a subject access request) under section 7 of the DPA. The rules under the DPA will therefore usually determine whether the person has a right to information about themselves. Therefore, the effect of the exemption in section 38(1)(a) is not to deny individuals a right to access information about themselves, but to ensure the right is exercised under the DPA and not under FOISA.
13. I must therefore consider whether the information in question is the personal data of Mrs B, as defined in section 1(1) of the DPA. Given the nature of these letters they understandably contain personal information about Mrs B, her foster care and a foster child. I am satisfied that this information is biographical in nature and reflects Mrs B's personal undertakings, thus constituting her personal information. Information which amounts to Mrs B's personal data, falls outwith the scope of FOISA by virtue of section 38(1)(a) and instead is required to be considered under DPA.
14. The Council submit that, on 24 October 2005, Mrs B made a subject access request seeking amongst other items, the letters that are the basis of this investigation. The request was responded to and a Schedule of documents was released. The two letters currently being requested were listed, but the Council refused to provide Mrs B with the letters on the basis of section 7(4) of the DPA, which allows a public authority to withhold information in certain circumstances where releasing the information would disclose the personal information of another individual.
15. The DPA regime is managed and enforced by my counterpart, the (United Kingdom) Information Commissioner. Mrs B was provided with his contact details during the course of the investigation should she wish to pursue this matter with his Office.
16. Consequently, I am satisfied that the Council acted correctly in applying section 38(1)(a) to the personal information in the letters relating to Mrs B.
Section 38(1)(b)-personal information of third parties
17. The Council also applied section 38(1)(b) to the information which it considers to be the personal data of the third parties mentioned in the letter.
18. Section 38(1)(b), read in conjunction with either section 38(2)(a)(i) or (2)(b), exempts third party personal data from disclosure if the release of the information would contravene any of the data protection principles set out in Schedule 1 of the DPA.
19. I must therefore consider whether the information in question is personal data and, if so, whether the disclosure of the information would breach the data protection principles.
20. Having reviewed the content of these documents, I am satisfied that they contain the personal data of the third parties concerned. I also note that the documents contain some sensitive personal data relating to a foster child.
21. In this instance the Council asserted that release of the information would breach the first data protection principle. I must therefore consider whether the disclosure of the third party information (not just to Mrs B, but into the public domain, because that is the effect of FOISA) would be fair and lawful. I must also be satisfied that at least one of the conditions in schedule 2 to the DPA can be met (and, in addition, in the case of the sensitive personal information, that at least one of the conditions in schedule 3 to the DPA can be met).
22. I have firstly considered the conditions in schedule 2 to the DPA. Condition 6.1 (see the Appendix) would appear to be the only condition which might permit the disclosure of the information in this case, so I will look at that condition in more detail.
23. I can accept that Mrs B feels she has a legitimate interest in gaining access to information relating to expressions of concern about her and her husband's provision of foster care made to the Council, with a view to clarifying the nature of those concerns and (where appropriate) taking reasonable steps to set the record straight. Given that Mrs B has no other reasonable means of obtaining such information; I also accept that disclosure of the information held by the Council might be considered necessary for the purposes of that legitimate interest.
24. On the other hand, the persons to whom the information held by the Council relates have legitimate interests in being able to register their concerns with an authority and to expect to be able to do so without their personal information being then provided to the individual to which these concerns relate. Nor would they expect this information to be made publicly available. I am satisfied that the information withheld was provided to the Council in the expectation (which I accept was reasonable in the circumstances) that it would be regarded as confidential and would not be disclosed. Therefore, I am satisfied that those persons have a strong legitimate interest in the information not being disclosed.
25. In addition, the Council informed my Office that it had approached the third parties concerned and they had refused consent for the release of the information in question.
26. In all the circumstances of this case, having weighed the competing interests in disclosure and in the privacy of the individuals concerned, I am satisfied on balance that disclosure of the information under FOISA into the public domain is unwarranted by virtue of the rights, freedoms and legitimate interests of the individuals to whom the information relates and, therefore, that condition 6 cannot be met. Noting in particular that the individuals to whom the information relates have not consented to disclosure of the information, I can identify no other condition in Schedule 2 which might be relevant to the processing of the information withheld. I am satisfied therefore, that release of this information would amount to unfair processing and therefore that the exemption under section 38(1)(b) of FOISA applies to the information.
27. These documents also contain sensitive personal data of a child to which the comments of foster care relate and I can identify no condition within Schedule 3 which may be relevant to the processing of the information withheld.
28. In conclusion, I am satisfied that the Council acted correctly in withholding this information under section 38(1)(b) of FOISA.
Decision
I find that Moray Council (the Council) acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mrs B in withholding the information under sections 38(1)(a) and 38(1)(b) of FOISA.
Appeal
Should either Mrs B or the Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this decision notice.
Kevin Dunion
Scottish Information Commissioner
18 July 2007
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(?)
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(?)
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
(?)
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indications of the intentions of the data controller or any other person in respect of the individual
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual
Sensitive personal data
2 In this Act "sensitive personal data" means personal data consisting of information as to-
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
SCHEDULE 1
THE DATA PROTECTION PRINCIPLES
PART I
THE PRINCIPLES
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
SCHEDULE 2
CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF ANY PERSONAL DATA
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
