Decision 138/2014 Mr Scott Pattinson and Aberdeen City Council
Records concerning a named individual: refusal to confirm or deny
Reference No: 201400841
Decision Date: 19 June 2014
Summary On 29 January 2014, Mr Pattinson asked Aberdeen City Council (the Council) for records held concerning a named individual. The Council refused to confirm or deny whether it held any such information, but stated that if the information was held it would be the individual's personal data and its disclosure would be unlawful.
Following an investigation, the Commissioner found that the Council was entitled to neither confirm nor deny whether it held information which would address Mr Pattinson's request.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to requests); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); 2(g) (Sensitive personal data); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 29 January 2014, following previous related correspondence, Mr Pattinson wrote to the Council requesting information about criminal offences recorded or investigations carried out, with regard to allegations made against a named individual working at a named school. He also asked for detailed reports of any such incidents.
2. The Council responded on 27 February 2014, citing section 18(1) of FOISA and notifying Mr Pattinson that it was unable to confirm or deny whether it held any information falling within the scope of his request. The Council stated that, if it held any such information, it would be exempt under section 38(1)(b) of FOISA.
3. On 10 March 2014, Mr Pattinson wrote to the Council, requesting a review of its decision. He did not agree with the Council's application of section 18(1) of FOISA.
4. The Council notified Mr Pattinson of the outcome of its review on 7 April 2014, upholding its initial decision.
5. On 13 April 2014, Mr Pattinson wrote to the Commissioner's office, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Mr Pattinson made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.
Investigation
7. The investigating officer wrote to the Council on 5 May 2014, notifying it that an application had been received and giving it an opportunity to provide comments (as required by section 49(3)(a) of FOISA). It was asked to justify its reliance on section 18(1) of FOISA.
8. Mr Pattinson was also contacted by the investigating officer and asked for any comments he wished to make in support of his position.
9. Both the Council and Mr Pattinson provided submissions to the Commissioner.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr Pattinson and the Council. She is satisfied that no matter of relevance has been overlooked.
Section 18(1) of FOISA - "neither confirm nor deny"
11. As mentioned above, the Council refused to confirm or deny whether it held any information falling within the scope of Mr Pattinson's request. The Council adhered to this position in its submissions to the Commissioner.
12. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:
? a request has been made to the authority for information which may or may not be held by it;
? if the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38,[1] 39(1) or 41 of FOISA;
? the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
13. Where a public authority has chosen to rely on section 18(1), the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1).
14. In any case where section 18(1) is under consideration, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
15. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information it held would be exempt information under one or more of the listed exemptions. Where the exemption(s) is/are subject to the public interest test in section 2(1)(b) of FOISA, the authority must also be able to satisfy the Commissioner that the public interest in maintaining the exemption(s) outweighs any public interest there would be in releasing any relevant information it held.
16. In this case, the Council submitted that if it did hold any information falling within the scope of Mr Pattinson's request, it could be withheld under section 38(1)(b) of FOISA. The particular exemption in section 38(1)(b) relied on by the Council is not subject to the public interest test.
17. The Commissioner must first consider whether the Council could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and was held.
Section 38(1)(b)
18. The Council stated that if it held the requested information, it would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
19. In order to rely on this exemption, the Council must show, firstly, that any such information would be personal data for the purposes of the DPA, and secondly that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1.
Is the information personal data?
20. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
21. The Council stated that any records of the kind asked for by Mr Pattinson would be the personal data of the individual referred to in the request. The information, by definition, related to the individual and identified them. Having considered the type of information Mr Pattinson is seeking, the Commissioner accepts this.
Would disclosure contravene the first data protection principle?
22. In its submissions, the Council argued that disclosure of the information, if held, would contravene the first data protection principle. It submitted that the information would be sensitive personal data and that there would be no conditions permitting disclosure. Consequently, disclosure would be unlawful.
23. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
24. The processing under consideration in this case would be the disclosure of any personal data that might be held by the Council into the public domain, in response to Mr Pattinson's information request.
25. The Council submitted that any relevant information it held would be sensitive personal data in terms of section 2(g) of the DPA. This applies to personal data "consisting of information as to the commission or alleged commission by [the data subject] of any offence". The Commissioner accepts that any relevant information held by the Council would, if held, be sensitive personal data falling within that description.
26. Given the additional restrictions surrounding the disclosure of sensitive personal data, it makes sense to look at whether there are any conditions in Schedule 3 which would permit any relevant data to be disclosed, before considering the Schedule 2 conditions.
Can any of the conditions in Schedule 3 be met?
27. There are 10 conditions listed in Schedule 3 to the DPA. One of these, condition 10, allows sensitive personal data to be processed in circumstances specified in an order made by the Secretary of State. The Commissioner has therefore considered the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000. None of these are applicable in this case.
28. The Commissioner's guidance[2] on the section 38 exemptions concludes that (in practical terms) there are only two conditions in Schedule 3 which would allow sensitive personal data to be processed in the context of a request for information under FOISA, namely:
? the data subject has given explicit consent to the processing (condition 1); or
? the information contained in the personal data has been made public as a result of steps taken deliberately by the data subject (condition 5).
29. The Commissioner notes that the Council is not in a position to contact the data subject (i.e. the person to whom the data relate), were any relevant data to be held. Consequently, given the context of this request, she is satisfied that condition 1 in Schedule 3 could not be met in this case.
30. Similarly, from the information available to her, the Commissioner is unable to conclude that condition 5 in Schedule 3 could be met in this case.
31. Having considered the other conditions in Schedule 3 and (as indicated above) the additional conditions contained in secondary legislation, the Commissioner has come to the conclusion that there is no condition which would permit disclosure of the type of sensitive personal data under consideration here, should any relevant data be held by the Council.
32. In the absence of a condition permitting disclosure, any such disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of any relevant data held by the Council would breach the first data protection principle and that the information, if held, would therefore be exempt from disclosure under section 38(1)(b) of FOISA.
33. Having accepted that the Council could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether the Council was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.
The public interest - section 18(1)
34. Mr Pattinson provided reasons why he believed the information he was seeking, if held, should be disclosed.
35. The Council recognised that revealing whether it held any information on any criminal offences, investigations, allegations or reports of incidents in relation to the named individual might help to illustrate that it had relevant procedures in place.
36. However, the Council considered there to be a stronger public interest in applying section 18(1).
37. The Council was of the view that it was in the interest of the public for it to comply with the DPA and protect individuals' personal data, particularly sensitive personal data, should it hold any such information. It believed that by applying section 18(1) in a case such as this, it was illustrating its compliance with the DPA and thereby reassuring the public that it took its DPA obligations seriously.
38. On balance, therefore, the Council was of the view that the public interest was best met by applying Section 18(1).
39. Having considered the submissions of both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for the Council to reveal whether the information requested by Mr Pattinson existed or was held by it.
40. As a result, the Commissioner is satisfied that the Council was entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether it held the information requested by Mr Pattinson, or whether such information existed.
Decision
The Commissioner finds that Aberdeen City Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Pattinson.
Appeal
Should either Mr Pattinson or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
19 June 2014
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that-
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
?
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
?
(g) the commission or alleged commission by [the data subject] of any offence
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
?
[1] The Freedom of Information (Amendment) (Scotland) Act 2013 added section 38 to the list of exemptions in respect of which section 18 could be claimed on 31 May 2013.
[2]
