Mr X is WF Ian Beggs. Mr Beggs appealed this decision to the Court of Session. The Court of Session issued its Opinion on 22 March 2016 and upheld the Commissioner?s decision. The Opinion can be read here:
https://www.scotcourts.gov.uk/search-judgments/judgment?id=e4260ea7-8980-69d2-b500-ff0000d74aa7
Decision 127/2014 Mr X and the Police Investigations and Review Commissioner
Information contained in a review file
Reference No: 201400026
Decision Date: 13 June 2014
Summary
On 7 March 2013, Mr X asked the Police Investigations and Review Commissioner (PIRC) for information contained in a review file. PIRC disclosed Mr X's own personal data to him in terms of its obligations under the DPA. PIRC withheld the remaining information under the exemptions in sections 30(b)(i) and 38(1)(b) of FOISA.
The Commissioner found that PIRC was entitled to withhold the information under the exemptions in sections 30(b)(i) and 38(1)(b).
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 30(b)(i) (Prejudice to effective conduct of public affairs); 38(1)(b) and (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for the purposes of the first principle: processing of any personal data: condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 7 March 2013, Mr X wrote to PIRC requesting information relating to a review that he had asked PIRC to carry out. The review concerned a named police constabulary's handling of complaints made by Mr X.
2. PIRC responded on 4 April 2013. PIRC disclosed information to Mr X in terms of his obligations under the DPA. This information comprised Mr X's own personal data and is not the subject of this decision. PIRC informed Mr X that the remaining information he had requested (i.e. the information that did not comprise his own personal data) was exempt from disclosure under FOISA.
3. On 29 May 2013, Mr X wrote to PIRC requesting a review of his decision. Mr X did not consider that PIRC had justified his application of the exemptions cited in his initial response to him.
4. PIRC notified Mr X of the outcome of his review on 25 June 2013. PIRC upheld his original decision without modification.
5. On 20 December 2013, Mr X wrote to the Commissioner, stating that he was dissatisfied with the outcome of PIRC's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Mr X made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7. On 13 January 2014, PIRC was notified in writing that an application had been received from Mr X and was asked to provide the Commissioner with the information withheld from him. PIRC provided the information and the case was then allocated to an investigating officer.
8. The investigating officer subsequently contacted PIRC, giving him an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking him to respond to specific questions. PIRC was asked to justify his reliance on any provisions of FOISA he considered applicable to the information requested. PIRC was asked to clarify whether he was relying on the exemption in section 30(b)(i) or 30(b)(ii) of FOISA as it was unclear from his responses to Mr X which exemption was being applied.
9. PIRC responded on 10 February 2014, providing submissions on his application of the exemptions in sections 30(b)(i) and 38(1)(b) of FOISA.
10. During the investigation, the investigating officer also sought and received submissions from Mr X.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr X and PIRC. She is satisfied that no matter of relevance has been overlooked.
Section 30(b)(i) - free and frank provision of advice
12. PIRC withheld the information contained in two documents under section 30(b)(i) of FOISA. In order for PIRC to rely on this exemption, he must show that the disclosure of the information would, or would be likely to, inhibit substantially the free and frank provision of advice. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
13. PIRC explained that his role is to review the manner in which complaints are handled by a policing body. In order to do so, PIRC considered it essential that he had the co-operation of police bodies within his oversight remit, not only in what has been documented during a police investigation, but also in relation to the views and opinions of those involved. PIRC argued that those providing information for his review would not have done so had they known the information would be divulged to the general public.
14. PIRC submitted that there was a need for officials to have a private space within which to discuss issues and communicate freely in order to perform their functions properly. In PIRC's view, disclosure of the contents of such discussions would substantially inhibit the free and frank provision of advice in future, particularly while discussions are on-going and decisions have not been taken, and/or if those discussions relate to sensitive or controversial issues.
15. PIRC submitted that because the issue divulged was a live one at the time the request was made, the bodies that provided and received the advice contained in the withheld information would be substantially inhibited from providing such views in future if the information were to be disclosed. PIRC argued also that, though it was not explicitly stated, it was understood between the parties that such advice would be confidential in order that it could be provided freely.
16. Mr X argued that PIRC had not provided any evidence that disclosure of the information would cause the substantial inhibition to the provision of advice in the way that PIRC had claimed. In Mr X's view, it was perverse to suggest that the bodies concerned would not have explained their relative positions had they expected these to become public knowledge.
17. Mr X submitted that PIRC could not be said to have satisfied the test of substantial inhibition required in order for the exemption to apply. In his view, neither the Crown Office and Procurator Fiscal Service nor the police force could be expected to be inhibited from making any legitimate representations to PIRC.
18. In assessing whether the disclosure of the information would, or would be likely to, inhibit substantially the free and frank provision of advice, the Commissioner will take account of factors such as the subject matter, the content of the information and the circumstances existing at the time of the request.
19. The main consideration in determining whether the exemption in section 30(b)(i) of FOISA applies is whether the disclosure of the information would, or would be likely to, have a substantially inhibiting effect on the free and frank provision of advice.
20. As set out in her briefing on the exemptions in section 30 of FOISA[1], the Commissioner takes the view that, in order for the exemption in section 30(b)(i) to apply, the damage caused by disclosing the information must be both real and significant, as opposed to hypothetical or marginal. Also, the damage would have to occur in the near future, and not at some distant time. Furthermore, the harm in question should take the form of substantial inhibition from expressing advice in as free and frank a manner as would be the case if disclosure could not be expected to follow. The word "substantial" is important here: the degree to which a person will or is likely to be inhibited in expressing themselves has to be of some real and demonstrable significance.
21. In the Commissioner's view, where advice is communicated or received as part of an individual's expected day to day professional activities, then the risk of substantial inhibition resulting from the release of that information will be diminished.
22. The Commissioner has considered all of the submissions made by PIRC and Mr X along with the withheld information. She has considered the nature of the information, including the material contained within that information, the context in which it was created and the expectations of the individuals who provided and received the advice contained in the withheld documents.
23. As noted above, the issue to be considered in this case is whether the effect of disclosure would be adverse, by causing, or being likely to cause, individuals to be substantially inhibited in the free and frank provision of advice.
24. In the Commissioner's view, the sensitivity of the information, nature of the communications and circumstances in which the information was created are such that its disclosure would be likely to cause the substantial inhibition envisaged by this exemption.
25. In all the circumstances of this case, the Commissioner is satisfied that PIRC has demonstrated that disclosure of the information withheld under this exemption would (or would be likely to) substantially inhibit officials and organisations from providing such advice in future. She therefore finds that PIRC was entitled to apply the exemption in section 30(b)(i) of FOISA to the withheld information.
26. The Commissioner must now go on to consider the application of the public interest test, as set out in section 2(1)(b) of FOISA. Before the information can be withheld under this exemption, the Commissioner must be satisfied that the public interest in maintaining the exemption outweighs that in disclosing the information.
The public interest test
27. As stated in previous decisions, the "public interest" is not defined in FOISA, but has been described as "something which is of serious concern and benefit to the public", not merely something of individual interest. It has also been held that the public interest does not mean "of interest to the public" but "in the interest of the public", i.e. disclosure must serve the interests of the public.
28. In its submissions to the Commissioner, PIRC accepted that there was a public interest in making information available in order to improve accountability and transparency. PIRC also considered it likely that exchanges of this nature would be jeopardised if such communications were considered suitable for disclosure whilst the issues under consideration were still sensitive and remained relevant.
29. Mr X argued that the context of complaints of police misconduct or potential criminality in a criminal investigation was significant. In his view, the conduct in which individuals may have been concerned was a matter of legitimate concern and it was in the public interest to know why specified allegations had been dealt with in a particular manner.
30. Additionally, Mr X considered there was a clear public interest in the publication of accurate and reliable information concerning his case.
31. The Commissioner has considered all of the comments made by Mr X and PIRC regarding the public interest for and against disclosure.
32. She acknowledges that there is a public interest in transparency in relation to the actions and decision making processes of public bodies. The Commissioner accepts that the disclosure of the information would shed some light on these actions and processes.
33. The Commissioner recognises also that Mr X has a strong personal interest in obtaining the information. However, in considering disclosure under FOISA, the Commissioner must ask herself whether this information should be made available to the public at large, and not just to Mr X. As stated above, the public interest should be considered in the context of FOISA as "something which is of serious concern and benefit to the public".
34. In the Commissioner's view, there was a justifiable expectation on the part of the individuals involved in the communications under consideration that the information would not be disclosed into the public domain. The information was, and remains, very sensitive. In the Commissioner's view it would not be in the public interest to discourage relevant parties from corresponding openly and candidly in relation to such matters in future.
35. The Commissioner has considered all submissions very carefully, with the withheld information, in balancing the potential benefits of disclosure against the potential harm. In all the circumstances of this case, she is not satisfied that the public interest in disclosure of this particular information is strong enough to outweigh the public interest in maintaining the exemption.
36. On balance, the Commissioner has concluded that, in this instance, the public interest in maintaining the exemption in section 30(b)(i) of FOISA outweighed that in the disclosure of the information. She therefore concludes that PIRC was entitled to withhold the information to which the exemption has been applied.
37. Having accepted that the information contained in these documents is exempt from disclosure in terms of section 30(b)(i), the Commissioner will now go on to consider PIRC's application of the exemption in section 38(1)(b) of FOISA to the remaining withheld document.
Section 38(1)(b) - personal data
38. PIRC applied the exemption in section 38(1)(b) on the basis that the information contained in the document comprised the personal data of individuals who were the subjects of the document under consideration. PIRC considered that the disclosure of this information would breach the first data protection principle of the DPA.
39. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
40. In order to rely on this exemption, PIRC must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
Is the information personal data?
41. Personal data are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
42. PIRC argued that the withheld information comprised the personal data of more than one individual. The Commissioner is satisfied that the information is personal data, in line with the definition in part a) of section 1(1) of the DPA. Living individuals, i.e. those named within the information can be identified from this information. In this case, the names of the individuals would clearly allow their identification and reveal that they had been named within the information.
Would disclosure of the personal data contravene the first data protection principle?
43. As noted above, PIRC argued that making this information available would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The processing in this case would be making the information available in response to Mr X's request.
44. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and she is satisfied that the personal data under consideration in this case do not fall into any of the categories set out in that definition. Therefore, it is not necessary to consider the conditions in Schedule 3 in this case.
45. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that disclosure would also be fair and lawful.
46. The Commissioner must now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether disclosure of the personal data would otherwise be fair and lawful.
47. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
Can any schedule 2 conditions be met?
48. The Commissioner considers that the only condition in Schedule 2 to the DPA which might apply in this case is condition 6. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.
49. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:
i. Is Mr X pursuing a legitimate interest or interests?
ii. If yes, is the processing (in this case, the disclosure of the information) necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects.
iii. Even if the processing is necessary for Mr X's legitimate interests, is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? As noted by Lord Hope in the CSA case, given that there is no presumption in favour of the release of personal data, the legitimate interests of Mr X must outweigh the rights, freedoms or legitimate interests of the data subject(s) before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that PIRC was correct to refuse to disclose the personal data to Mr X.
Is Mr X pursuing a legitimate interest or interests?
50. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on section 38 of FOISA[3] states:
"In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."
51. In his initial request to PIRC, Mr X explained that he required the information in order to assist him in instructing his solicitors in relation to the matters arising from his complaints and their disposal by PIRC. In his application to the Commissioner, Mr X explained that he was concerned that PIRC was, in effect, colluding with an attempt by the Crown Office and Procurator Fiscal Service to suppress his complaints and to obfuscate the circumstances in which a police enquiry had been conducted.
52. In his submissions to the Commissioner, PIRC stated that he did not consider that the information being withheld from Mr X would assist him with the legitimate interests that he had intimated in his request and in his application to the Commissioner.
53. In this case, given the nature of Mr X's dissatisfaction with the outcome of PIRC's review into his complaints against the police, the Commissioner is satisfied that he has a legitimate interest in obtaining the personal data contained within the withheld information. This would allow him to form a view on the nature of the information that had been considered by PIRC and the sources and recipients of that information.
Is the processing necessary for the purposes of that interest?
54. Having concluded that Mr X has a legitimate interest in obtaining the personal data contained in the withheld information, the Commissioner must now consider whether disclosure of the personal data is necessary in order to satisfy the legitimate interests identified above. In doing so, she must consider whether these interests might reasonably be met by any alternative means.
55. In his submissions to the Commissioner, PIRC stated that he did not consider the disclosure of the information to Mr X was necessary. PIRC stated that he had previously disclosed a considerable volume of information to Mr X and considered there was unlikely to be any additional information within the withheld information which would assist Mr X in any legitimate interest.
56. Having reviewed the information that has been withheld, the Commissioner considers that it would be necessary for the withheld personal data to be disclosed to Mr X in order to achieve these legitimate interests. The Commissioner is not aware of any other viable means of meeting Mr X's interests which would interfere less with the privacy of the data subjects than providing the withheld personal data. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mr X's legitimate interests.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
57. The Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr X's legitimate interests, but must now consider whether that disclosure would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Mr X and the data subjects in question. Only if the legitimate interests of Mr X outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
58. In the Commissioner's briefing on the personal information exemption, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
? the potential harm or distress that may be caused by disclosure
? whether the individual objected to the disclosure
? the reasonable expectations of the individual as to whether the information should be disclosed.
59. In his submissions, PIRC argued that disclosure of the information would impact on the privacy of the individuals concerned. PIRC did not consider that it could be assumed that the data subjects would be agreeable for their personal data to be disclosed.
60. PIRC also submitted that the disclosure of some of the personal data, when linked with other parts of the withheld information, would lead to disclosure of information relating to an individual's private life.
61. In Mr X's view, there was no indication that disclosure of the information would be damaging or distressing to the data subjects. He did not consider it would be outwith the expectations of the data subjects that their personal data would be disclosed. Additionally, Mr X was concerned by what he considered to be a divergence of accounts in relation to the matter which was the subject of his complaints to the police.
62. The Commissioner has considered all of the submissions made by PIRC and Mr X when considering the balancing test in this case. She considers that the data subjects would hold no expectations that their personal data would be disclosed into the public domain (which is the effect of disclosure under FOISA) as a consequence of Mr X's information request. She accepts that the information relates to the individuals' personal, rather than public, lives and is highly sensitive.
63. On balance, while the Commissioner accepts that disclosure of the personal data of these individuals would be necessary to fulfil Mr X's legitimate interests; she does not agree that this outweighs the prejudice that would be caused to these data subjects' rights, freedoms and legitimate interests. She considers that such prejudice would be unwarranted in relation to these individuals. Consequently, the Commissioner is satisfied that condition 6 of Schedule 2 is not met in this case in relation to these individuals.
64. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of these data subjects, the Commissioner must also conclude that disclosure would be unfair. As condition 6 cannot be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that this information was properly withheld under section 38(1)(b) of FOISA.
Decision
The Commissioner finds that the Police Investigations and Review Commissioner (PIRC) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr X.
The Commissioner finds that PIRC was entitled to withhold information under the exemption in section 30(b)(i) of FOISA. The Commissioner also finds that PIRC was entitled to withhold personal data under the exemption in section 38(1)(b).
Appeal
Should either Mr X or the Police Investigations and Review Commissioner wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Rosemary Agnew
Scottish Information Commissioner
13 June 2014
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
?
(b) would, or would be likely to, inhibit substantially-
(i) the free and frank provision of advice; or
?
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section30/Section30.aspx
[2] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[3] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
