Decision 121/2016: Mr X and South Lanarkshire Council Information about two persons Reference No: 201502441 Decision Date: 27 May 2016 Summary On 19 October 2015, Mr X asked South Lanarkshire Council (the Council) for information about two named persons, one of whom was deceased. The Council refused to confirm or deny whether it held any information. Following a review, Mr X remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that the Council had properly responded to Mr X's request for information in accordance with Part 1 of FOISA. In the circumstances of the case, the Council was entitled neither to confirm nor deny whether it held information which would address Mr X's request. She did not require the Council to take any action.

 Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); 2 (Sensitive personal data); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle), 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1)) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 19 October 2015, Mr X made a request for information to the Council. He asked for any information it held about a named person and also any information it held on the recent death of another named person (the deceased). Mr X explained why he wished to obtain the information.

2. The Council responded on 3 November 2015. The Council cited section 18(1) of FOISA and notified Mr X that it was unable to confirm or deny whether it held any information falling within the scope of his requests. The Council stated that if it held any such information it would be exempt from disclosure under section 38(1)(b) of FOISA (the exemption for personal data).

3. On 14 November 2015, Mr X wrote to the Council requesting a review of its decision on the basis that the decision would cause harm (which he described as "destitution").

4. The Council notified Mr X of the outcome of its review on 15 December 2015. The Council interpreted Mr X's requirement for review as not challenging its reliance on section 18 of FOISA in its initial response, but relating instead to the reasons why Mr X wanted the information. (Mr X's reasons were explained in his request, but are not included in this decision.) The Council's review upheld its initial response, but provided a consideration of the public interest in disclosing or withholding the information (if any information was held), which had not been done in its initial response. The Council thought the public interest in ensuring compliance with the DPA strongly outweighed the right to obtain information. The Council referred to the Commissioner's Decision 142/2015 Mr X and South Lanarkshire Council[1].

5. On 21 January 2016, Mr X applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of the Council's review because he wished the Council to supply him with the information he had asked for. Mr X explained in detail his personal interest in the information, and why he believed that the Council held information that was covered by his request.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr X made requests for information to a Scottish public authority and asked the authority to review its response to those requests before applying to her for a decision.

7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on Mr X's application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

8. The Council responded on 26 February 2016, confirming that it was relying on section 18 of FOISA for the same reasons given in its initial response and review response. The investigating officer contacted the Council on 11 March 2016 for further clarification, to which the Council responded on 4 April 2016.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to her by both Mr X and the Council. She is satisfied that no matter of relevance has been overlooked.

Section 18 of FOISA

10. Section 18 allows Scottish public authorities to refuse to reveal whether they hold information (or whether it exists) in the following limited circumstances:

? a request has been made to the authority for information which may or may not be held by it, and

? if the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA, and

? the authority considers that to reveal whether it holds the information, or whether it exists, would be contrary to the public interest.

11. Therefore, where a public authority has chosen to rely on section 18(1) of FOISA, the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions provided for by sections 28 to 35, 38, 39(1) or 41 of FOISA.

12. While doing this, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.

13. The Commissioner will first consider whether the Council could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and if the Council held it.

Section 38(1)(b) - Personal information

14. The Council stated that if it held the requested information, it would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

15. In order to rely on this exemption, the Council must show, firstly, that any such information would be personal data for the purposes of the DPA, and secondly, that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1.

Is the information personal data?

16. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1). "Sensitive personal data" is a special category of personal data under the DPA that is subject to stricter processing criteria.

17. The Council thought that the information requested would very likely be the sensitive personal data of at least one individual (if not more). The information sought by Mr X related to a named person and was about any investigations that had been carried out in relation to that person arising from the death of the deceased. The Council therefore explained why that the information would be sensitive personal data as defined by the DPA.

18. The Commissioner accepts that any relevant information - if held - would be defined as sensitive personal data, given the circumstances of this case and the nature of the information which would be covered by the request.

19. The Council accepted that information relating to the deceased (if held) could not be the personal data of the deceased: by definition, personal data must relate to living individuals. However, it argued that, in this situation, the information regarding the deceased would be the personal data of a living family member.

20. The Council referred to the Commissioner's Decision 063/2012 Mr Drew Cochrane and the Chief Constable of Strathclyde Police[2]. The Council explained that the deceased was survived by both the named person and a child. The information requested by Mr X - if held - would effectively identify the child. The child would be affected by the release of information regarding the deceased and so, following the Guidance of the UK Information Commissioner (the ICO) Determining what is Personal Data, the Council argued that the requested information in respect of the deceased would amount to the personal data of the child.

21. The ICO's Guidance[3], Information about the deceased, states, at paragraphs 7-8:

"The exemption for personal information only applies to living individuals. This means that the exemption cannot be used for information about, and which identifies, deceased individuals. However, there will be cases where a request for sensitive information about a deceased person also relates to personal information about another identifiable living individual.

A deceased person's medical and social care records are likely to contain information about other individuals, such as NHS and social services staff. On occasions, information about relatives of the deceased may also be included in such records."

22. The test to be applied is whether, in all the circumstances of the case, disclosure would make it reasonably likely that a living individual could be identified by any person, taking into account all of the means which are reasonably likely to be used to try to make that identification. The Commissioner is satisfied, given the circumstances - as explained by the Council and Mr X - that any information about the deceased would also be the personal data of the child. Given the close association, she accepts that, in the specific context of the Mr X's information request, the deceased's information (if held by the Council) would lead to identification of the child, when considered in conjunction with other information available in the public domain.

23. The Commissioner therefore accepts that the information requested by Mr X, if it exists, would be personal data.

Would disclosure contravene the first data protection principle?

24. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.

25. The processing under consideration in this case would be the disclosure of any personal data that might be held by the Council into the public domain, in response to Mr X's information request.

26. In its submissions, the Council argued that disclosure of the information, if held, would contravene the first data protection principle. The Council submitted that some of the information covered by request 1 would be sensitive personal data and that there were no conditions in Schedule 3 to the DPA which would permit disclosure. Consequently, disclosure would be unlawful.

27. Given the additional restrictions surrounding the disclosure of sensitive personal data, it makes sense to look at whether there are any conditions in Schedule 3 which would permit any relevant data to be disclosed, before considering the Schedule 2 conditions.

Can any of the conditions in Schedule 3 be met?

28. There are 10 conditions listed in Schedule 3 to the DPA. One of these, condition 10, allows sensitive personal data to be processed in circumstances specified in an order made by the Secretary of State. The Commissioner has therefore considered the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000. None of these are applicable in this case.

29. The Commissioner's guidance[4] on the section 38 exemptions concludes that (in practical terms) there are only two conditions in Schedule 3 which would allow sensitive personal data to be processed in the context of a request for information under FOISA, namely:

? the data subject has given explicit consent to the processing (condition 1); or

? the information contained in the personal data has been made public as a result of steps taken deliberately by the data subject (condition 5).

30. The Council identified these two conditions and found that neither applied in this case. In the circumstances, the Commissioner is satisfied that neither condition 1 nor condition 5 could be met in this case.

31. Having considered the other conditions in Schedule 3 and (as indicated above) the additional conditions contained in secondary legislation, the Commissioner has come to the conclusion that there is no condition which would permit disclosure of the type of sensitive personal data under consideration here, should any relevant data be held by the Council.

32. In the absence of a condition permitting disclosure, any such disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of any relevant sensitive personal data held by the Council would breach the first data protection principle and that the information, if held, would therefore be exempt from disclosure under section 38(1)(b) of FOISA.

Would disclosure of the information, if held, contravene the first data protection principle?

33. The Council accepted that not all information covered by Mr X's request would be sensitive personal data. The Commissioner will now consider whether disclosure of non-sensitive personal data would contravene the first data protection principle, if it exists and if the Council holds it.

34. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing under consideration in this case would be the disclosure into the public domain of any personal data that might be held by the Council in response to Mr X's information request.

35. If the Commissioner is satisfied that the disclosure of personal data, if it exists and is held, would not breach the first data protection principle, the Council could not give a refusal notice under section 16(1) of FOISA, as any information would not be exempt from disclosure under section 38(1)(b) of FOISA. In effect, this means that the Council would not be entitled to confirm or deny whether it holds the personal data in question.

36. On the other hand, if disclosure of personal data, would breach the first data protection principle, then the Council could give a refusal notice under section 16(1) of FOISA as any data would be exempt from disclosure under section 38(1)(b) of FOISA. If this is the case, the Commissioner will go on to consider whether it would be contrary to the public interest to reveal whether the information exists.

37. As the Council correctly identified, there are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits disclosure, it is likely that disclosure will also be fair and lawful.

Could any of the conditions in Schedule 2 be met?

38. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which could permit disclosure of the information, if it exists and is held. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

39. There are a number of different tests which must be satisfied before condition 6 can be met. These are:

? Is Mr X pursuing a legitimate interest or interests?

? If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of any data subjects?

? Even if the processing is necessary for Mr X's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of any data subjects?

40. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr X must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit disclosure. If the two are evenly balanced, the Commissioner must find that the Council would be able to refuse to disclose the requested information to Mr X (if it exists and is held).

Is Mr X pursuing a legitimate interest or interests?

41. In his request, Mr X explained why he required the information. The Council did not doubt that Mr X has a legitimate interest in the information, if it exists and is held. The Commissioner agrees.

Would disclosure of the information be necessary to achieve those legitimate interests?

42. Having concluded that Mr X has a legitimate interest in obtaining the personal data under consideration (if it exists and is held), the Commissioner must now consider whether disclosure of the personal data would be necessary in order to satisfy his legitimate interest. In doing so, she must consider whether his legitimate interest might be reasonably met by any alternative means.

43. The Council's initial response acknowledged that disclosure of any information (if held) would be necessary to achieve Mr X's legitimate interests.

44. "Necessary" in condition 6(1) of Schedule 2 implies the existence of a pressing social need. Whilst it does not mean indispensable, neither does it mean "useful", "reasonable" or "desirable."

45. The Commissioner does not doubt that Mr X wants the information for the reasons he stated. She accepts that it would be necessary for any withheld personal data to be disclosed to Mr X in order to achieve his legitimate interests. The Commissioner is not aware of any other viable means of meeting the Mr X's interests which would interfere less with the privacy of the data subjects than providing the withheld personal data, if it exists and is held by the Council. For this reason, the Commissioner is satisfied that disclosure of the information would be necessary for the purposes of Mr X.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

46. The Commissioner must consider whether disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects. This involves a balancing exercise between the legitimate interests of Mr X and those of the data subjects. Only if the legitimate interests of Mr X outweigh those of the data subjects could the information be disclosed without breaching the first data protection principle.

47. In the Commissioner's published guidance on section 38 of FOISA, the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise. These include:

? whether the information relates the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

? the potential harm or distress that may be caused by the disclosure;

? whether the data subjects have objected to the disclosure; and

? the reasonable expectations of the individual as to whether the information would be disclosed.

48. The information (if it exists and is held) would pertain to the private life of the data subjects. The Commissioner has considered the potential harm or distress that may be caused by its disclosure. Given that the information would relate to the circumstances of the deceased's death, and that one of the data subjects is the child of the deceased, the Commissioner accepts there would be potential harm or distress to that data subject.

49. The Commissioner finds that the child's right to privacy outweighs Mr X's legitimate interests. On balance, the Commissioner takes the view that the Mr X's legitimate interests do not outweigh the prejudice that would be caused by disclosure to the data subjects' rights and freedoms or legitimate interests. Consequently, she finds that such prejudice would be unwarranted. The Commissioner is satisfied that condition 6(1) of Schedule 2 is not met in relation to such personal data, if it exists and is held. The Commissioner therefore finds that disclosure of such information, if it exists and is held, would not be fair and lawful and that the Council would be entitled to withhold such information under section 38(1)(b) of FOISA, if it exists and is held.

50. Having accepted that the Council could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if it exists and is held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner must consider whether the Council was entitled to conclude that it would be contrary to the public interest to reveal whether the information exists or is held.

Section 18 - Public interest test

51. The Council recognised that there is a public interest in allowing the public to be able to obtain information under FOISA, and that there is a general public interest in openness and transparency in relation to the actions of the Council. However, it contended that there is a greater public interest in ensuring that it complies with the provisions of the DPA.

52. Mr X's public interest arguments were broadly in terms of the public interest in protecting children.

53. Having considered the submissions of both parties, and the circumstances of this case, the Commissioner is satisfied that it would have been contrary to the public interest for the Council to reveal whether it holds the information requested by Mr X or whether the information exists. It would not be possible to confirm whether the information exists without disclosing sensitive and non-sensitive personal data in breach of the DPA. The Commissioner accepts that this would not be in the public interest.

54. As a result, the Commissioner is satisfied that the Council was entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether it held the information requested by Mr X, or whether such information existed.

Decision The Commissioner finds that the South Lanarkshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr X.

 Appeal

Should either Mr X or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
27 May 2016

  Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

(a) the racial or ethnic origin of the data subject,

(b) his political opinions,

(c) his religious beliefs or other beliefs of a similar nature,

(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),

(e) his physical or mental health or condition,

(f) his sexual life,

(g) the commission or alleged commission by him of any offence, or

(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data

1. The data subject has given his explicit consent to the processing of the personal data.

?

5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.