Decision 136/2015: Mr Patrick Kelly and Tayside Health Board Information relating to Professor Muftah Salem Eljamel Reference No: 201500390 Decision Date: 24 August 2015 Summary On 2 December 2014, Mr Patrick Kelly asked NHS Tayside for information relating to Professor Muftah Salem Eljamel. NHS Tayside responded by providing some information, stating that some of the information was not held and refusing to confirm or deny whether it held other information. Following a review, Mr Kelly remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that NHS Tayside was entitled to do this.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held); 18(1) (Further provisions as respects responses to request); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for the purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 4 December 2014, Mr Kelly made a request for information to NHS Tayside. Referring to a complaint against Professor Eljamel, he requested:

(i) When did NHS Tayside discover that there were problems with Professor Eljamel's surgical procedures?

(ii) If these surgical and other related problems go back several years, then why did it take NHS Tayside so long to discover what was actually taking place?

(iii) Was the Health Minister for Scotland or the Scottish Government informed about Professor Eljamel's failed surgical procedures and his behaviour? If not, then why not?

(iv) Do you have the statistics for the number of patients who suffered brain tumour/injuries who have later died under Professor Eljamel's care?

(v) When you discovered that Professor Eljamel was failing in his surgical duties, then why didn't you set up a hotline so that ex-patients who had been operated on could talk to someone about their concerns?

(vi) How many patients who were under Professor Eljamel's care are currently suing NHS Tayside?

2. NHS Tayside responded on 29 January 2015. It provided answers to Mr Kelly's questions but informed him that it did not hold any information in relation to point (iv) and refused to confirm or deny whether it held any information in response to point (vi).

3. On 2 February 2015, Mr Kelly wrote to NHS Tayside requesting a review of its decision in relation to points (iv) and (vi). For point (iv) he refused to accept that NHS Tayside did not hold information, while for point (vi) he argued that the public interest favoured disclosure.

4. NHS Tayside notified Mr Kelly of the outcome of its review on 25 February 2015. NHS Tayside upheld its original decision without modifications.

5. On 25 February 2015, Mr Kelly wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Kelly stated he was dissatisfied with the outcome of NHS Tayside's review because he believed the public interest favoured disclosure of the information requested.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Kelly made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 10 March 0215, NHS Tayside was notified in writing that Mr Kelly had made a valid application and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Tayside was invited to comment on this application and answer specific questions, focusing on the provisions of FOISA applied in responding to Mr Kelly's requirement for review.

9. During the investigation, NHS Tayside confirmed that it was seeking to rely on section 18 of FOISA, read in conjunction with section 38(1)(b) (Personal information), in relation to point (vi) of the request. Mr Kelly was provided with an opportunity to comment on this during the investigation.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr Kelly and NHS Tayside. She is satisfied that no matter of relevance has been overlooked.

Point (iv) - the number of patients who suffered brain tumours/injuries who have later died under Professor Eljamel's care

11. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not relevant in this case.

12. The information to be given is that held by the authority at the time the request is received, subject to any amendment or deletion which would have been made, regardless of the receipt of the request, between the date of receipt and the time information is given (section 1(4)). This is not necessarily to be equated with information an applicant believes the authority should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.

13. In response to this request, NHS Tayside stated that it does not hold the statistics requested by Mr Kelly. To support this statement, NHS Tayside explained that there was no one system that could be interrogated to provide the base data for the compilation of the requested statistics. Furthermore, to establish the root cause of a patient's suffering of a brain tumour/injury required specialist clinical assessment, and the assessment of information relating to the clinical treatment and outcomes could only be assessed by a qualified clinician.

14. NHS Tayside provided an explanation of the tasks that would be required to collate the information, which included the collation of all paper-based and electronic information relating to the named surgeon's involvement with patients over a period of more than 20 years, or to patients who had suffered brain tumours/injuries over that period.

15. A clinical assessment would then be required of how the named surgeon's involvement impacted on the patient's condition.

16. NHS Tayside argued that because information that might be relevant in some way to answering Mr Kelly's request was held in disparate systems and formats, it was not readily retrievable. In addition to the difficulty in retrieving the data, the amount of clinical interpretation and individual judgement required to assess and produce valid and reliable data for analysis or drawing conclusions was, it submitted, very complex and is excessive.

17. The Commissioner accepts that the collation of the information requested is more complex than merely a counting exercise. Having considered the submissions provided, she acknowledges that it would require a significant degree of clinical judgement. In the circumstances, she is satisfied that NHS Tayside does not (and did not, at the time it received Mr Kelly's request), hold the information which would address point (iv) for the purposes of FOISA.

18. In this regard, the Commissioner finds that NHS Tayside complied with Part 1 (and in particular section 17(1)) of FOISA, by notifying Mr Kelly that it did not hold the information requested.

Point (vi) - How many patients who were under Professor Eljamel's care are currently suing NHS Tayside?

19. NHS Tayside refused to confirm or deny whether it held any information falling within the scope of this part of the request.

20. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

(i) A request has been made to the authority for information which may or may not be held by it;

(ii) If the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA;

(iii) The authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

21. Where a public authority has chosen to rely on section 18(1), the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1).

22. In any case where section 18(1) is under consideration, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.

23. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information it held would be exempt information under one or more of the listed exemptions. Where exemption(s) is/are subject to the public interest test in section 2(1)(b) of FOISA, the authority must also be able to satisfy the Commissioner that the public interest in maintaining the exemptions(s) outweighs any public interest there would be in releasing any relevant information it held.

24. In this case, NHS Tayside submitted that if it did hold any information falling within the scope of Mr Kelly's request, it could be withheld under section 38(1)(b) of FOISA. This exemption is not subject to the public interest test.

25. The Commissioner must first consider whether the NHS Tayside could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and was held.

Section 38(1)(b)

26. NHS Tayside stated that if it held the requested information, it would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

27. In order to rely on this exemption, NHS Tayside must show, firstly, that any such information would be personal data for the purposes of the DPA, and secondly that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1.

Is the information personal data?

28. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

29. Having considered the terms of this information request, the Commissioner is satisfied that information captured by the request would relate to the individual named in the request and would identify them. The Commissioner is satisfied that information captured by this request would be their personal data.

Would disclosure contravene the first data protection principle?

30. NHS Tayside argued that disclosure of the information, if held, would contravene the first data protection principle.

31. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. Having considered the request, the Commissioner does not believe the information Mr Kelly is seeking could fall into any of the categories of sensitive personal data in section 2 of the DPA.

32. The processing under consideration in this case would be the disclosure of any personal data that might be held by NHS Tayside into the public domain, in response to Mr Kelly's information request.

33. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the requested information to be disclosed, if it existed and was held. If any of these conditions can be met, she must then consider whether such disclosure would be fair and lawful.

34. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits disclosure, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

35. NHS Tayside submitted that the only relevant Schedule 2 condition in the circumstances would be condition 6. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

36. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Does Mr Kelly have a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for Mr Kelly's legitimate interests, is the processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

37. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Kelly must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit disclosure. If the two are evenly balanced, the Commissioner must find that NHS Tayside would be able to refuse to disclose the requested information (if held) to Mr Kelly.

Is Mr Kelly pursuing a legitimate interest?

38. NHS Tayside argued that Mr Kelly had no legitimate interest in receiving the information, if it existed and was held, in as much as simply having a number associated with events does not and cannot be considered as a fair representation of any possible outcome of those events.

39. Mr Kelly stated that there was a public interest in seeking information on the behaviour of the named surgeon and that transparency was required so the public could have confidence in the authority's policies and actions.

40. The Commissioner has considered all relevant submissions she has received on this point and does not accept that Mr Kelly could be said to be pursuing a legitimate interest in this case. She accepts that there may be a general public interest in transparency so the public can have confidence in the authority's policies and actions, but the number of patients suing the authority, whether generally or in relation to a particular member of staff or issue, does not contribute anything of substance to fulfilling that interest.

41. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the requested information, if it existed and was held by the Council.

42. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the information, if it existed and was held, would breach the first data protection principle.

43. Having accepted that NHS Tayside could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if it existed and was held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to consider whether NHS Tayside was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

The public interest - section 18(1)

44. Mr Kelly explained to the Commissioner why he believed the information requested, if existed and was held, should be disclosed.

45. NHS Tayside recognised the importance in openness and transparency in its actions as a public authority, and accepted there is a general public interest making information accessible to the public.

46. NHS Tayside also submitted that there was a strong public interest in ensuring that it handled any and all personal data it held in compliance with the DPA. It believed its application of section 18(1) in this case illustrated its compliance with both the DPA and FOISA. NHS Tayside was therefore of the view that the public interest was best met by applying section 18(1).

47. Having considered the submissions of both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for NHS Tayside to reveal whether the information requested by Mr Kelly existed or was held.

48. As a result, the Commissioner find that NHS Tayside was entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether it held the information requested in point (vi) of Mr Kelly's request, or whether such information existed.

Decision The Commissioner finds that NHS Tayside complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Kelly.

  Appeal

Should either Mr Kelly or NHS Tayside wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner

24 August 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

?

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

"health record" has the meaning assigned to that term by section 1(1) of the Access to Health Records Act 1990 (c.23); and

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.