Decision 139/2009 Mr James Duff and Dumfries and Galloway Council
Reports and other documents provided to the Police Authority
Reference No: 200900806
Decision Date: 4 December 2009
Summary
Mr James Duff asked Dumfries and Galloway Council (the Council) to provide certain specified reports and other documents. The Council advised Mr Duff that the information was exempt from disclosure under the Freedom of Information (Scotland) Act 2002 (FOISA).This position was unchanged after Mr Duff requested, and received, a review of the Council's response.
After investigation, the Commissioner found that some of the information requested by Mr Duff had been correctly withheld by the Council under the exemptions in sections 38(1)(a) and 38(1)(b) of FOISA.Other information was found not to be held by the Council.The Commissioner found that the Council had failed to comply with section 17(1) of FOISA in failing to give notice that some information was not held.
The Commissioner did not require the Council to take any action in relation to this breach.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(i) and (ii) (Effect of exemptions); 15 (Duty to provide advice and assistance); 17(1) (Notice that information is not held) and 38(1)(a) and (b) and (2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 (the DPA): sections 1(1) (Basic interpretative provisions) (definition of personal data); 2(g) (Sensitive personal data) and Schedules 1 (The data protection principles) (the first data protection principle) and 3 (Conditions relevant for the purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 23 February 2009, Mr Duff asked the Council to provide the following information:
a)a report dated 26 October 2007 by the Chief Executive and Clerk to the Police Authority (referred to here as "item 1");
b)a report by the Deputy Chief Constable presented to the Police Committee on 8 January 2009 (referred to here as "item 2");
c)a copy of the Decision by HMIC in respect of a complaint made by Mr Duff, which was presented to the Council meeting of 1 November 2007 (referred to here as "item 3");
d)a copy of a report by the Chief Executive dated 11 December 2008, regarding legal support for one of the Council's officials in relation to court action raised against that official by Mr Duff (referred to here as "item 4");
e)all other reports, letters, documents etc. that had been provided to the Police Authority concerning Mr Duff's complaints and court actions against Dumfries and Galloway Constabulary.
2.On 20 March 2009, the Council provided Mr Duff with a refusal notice.It withheld the information requested under exemptions in section 26(a), section 30(b)(ii) and (c) and section 36(1) of FOISA, and explained why it considered that these exemptions applied and (where relevant) why the balance of public interest did not favour disclosure of the information.
3.On 26 March 2009, Mr Duff requested a review of the Council's decision.
4.On 23 April 2009, the Council advised Mr Duff that it had complied with his request for review, but had concluded that the appropriate exemptions had been properly applied, and that it had taken all reasonable steps to explain to him the reasons for refusing to provide the information he had requested.
5.Mr Duff remained dissatisfied with the response provided by the Council and applied for a decision from the Commissioner on 27 April 2009.In a letter dated 11 May 2009, Mr Duff explained that the paperwork put before the Police Committee (the Complaints against the Police Sub-Committee) concerned him personally and related to his own complaints against the police.He believed he was entitled to have the information because Councillors were being misled.
6.Mr Duff also expressed concern that one of the members of the Council's review panel was a serving police officer, which (he considered) posed a serious conflict of interest given that the matters in the reports he had requested referred to Dumfries and Galloway Constabulary.
7.The application was validated by establishing that Mr Duff had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
8.On 13 May 2009, the Council was notified in writing that an application had been received from Mr Duff and was asked to provide the Commissioner with any information withheld from Mr Duff. This information was provided on 27 May 2009 and the case was then allocated to an investigating officer.
9.In its letter of 27 May 2009, the Council advised that one of the reports requested by Mr Duff (item 2) had not been submitted to the Complaints against the Police Sub-Committee by Dumfries and Galloway Police, but had been circulated for discussion and was taken back by the Police at the conclusion of the meeting.The Council stated that it did not hold the information and should have cited section 17(1) of FOISA in relation to this part of Mr Duff's request.The Council confirmed that the report did not contain any reference to Mr Duff.
10.The Council explained that four reports dated 26 October 2007 were submitted to the Complaints against the Police Sub-Committee meeting on 1 November 2007.Three were reports under the Police Appeals Tribunals (Scotland) Rules 1996, which are here referred to jointly as "item 1". The fourth was a report from Her Majesty's Inspectorate of Constabulary on a complaint made against Dumfries and Galloway Constabulary (item 3).
11.The Council stated that it wished to rely upon the exemption in section 38(1)(b) (read in conjunction with section 38(2)(a)(i) and (b)) for certain personal information in the reports.
12.The Council applied the exemption in section 38(1)(a) to the report dated 11 December 2008 (item 4), considering the information to be Mr Duff's own personal data.The Council stated that this was the only report which referred to Mr Duff.
13.On 23 June 2009, the Council was invited to provide any comments it wished to make on Mr Duff's application, as required by section 49(3)(a) of FOISA.The Council was asked to confirm that it wished to rely upon the exemption in section 26(a) of FOISA in relation to one report.It was also asked to explain why some of the information was believed to fall within the scope of the request.Finally, the Council was asked further questions about the report which had been circulated and then taken back by the Police (item 2).
14.The Council provided its response on 7 July 2009.It answered each of the points raised in the letter of 23 June 2009.The Council's response is discussed in detail later in this decision notice.
15.As noted, the Council had previously advised that it wished to rely upon the exemption in section 38(1)(a) to withhold item 4.Mr Duff was informed of the Council's decision, and was invited to make a subject access request under the Data Protection Act 1998 (the DPA) for the information in item 4.
16.The Council advised that it wished to cite section 25(1) of FOISA in relation to the background information attached to item 4, as the document in question had originated from Mr Duff.
17.The Council withdrew its reliance upon section 26(a) of FOISA, and provided arguments relating to the exemption in section 36(1).
18.During the investigation, the Council provided a further submission to support its view that the exemption in section 38(1)(b) applied to item 1.
Commissioner's analysis and findings
19.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by both Mr Duff and the Council and is satisfied that no matter of relevance has been overlooked.
Recent Court of Session Opinion
20.The Commissioner notes that the information request by Mr Duff was for copies of documents and that in the case of Glasgow City Council and Dundee City Council v Scottish Information Commissioner [2009] CSIH 73, the Court of Session emphasised that FOISA gives a right to information, not documents. However, the Court also said, in paragraph 45 of its Opinion, that where a request refers to a document which may contain the relevant information, it may nonetheless be reasonably clear in the circumstances that it is the information recorded in the document that is relevant. The Court also said that, if there is any doubt as to the information requested, or as to whether there is a valid request for information at all, the public authority can obtain clarification by performing its duty under section 15 of FOISA, which requires a public authority, so far as it is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to makes, or has made, a request for information to it.
21.In this case, the Commissioner notes that there is no indication in the correspondence he has seen between Mr Duff and the Council that the Council questioned the validity of the information request.In addition, there is nothing to suggest from correspondence which the Council has subsequently had with the Commissioner that the Council was unclear as to what the information request was for.
22.The Commissioner is satisfied that the request is reasonably clear and that the request is therefore valid.
Information not held
23.Section 17(1) of FOISA requires that, where an authority receives a request for information that it does not hold, it must give an applicant notice in writing that it does not hold the information.
Item 2
24.As noted above, the Council initially responded to Mr Duff's request for item 2 by advising that it was exempt from disclosure under FOISA.However, the Council then informed the Commissioner that the report was not held by the Council, and had been retrieved by Dumfries and Galloway Constabulary after the meeting at which it was circulated and discussed.The Council acknowledged that, to comply with section 17 of FOISA, it should have given Mr Duff notice that the information was not held by the Council.
25.The Council was asked by the investigating officer whether it was normal practice for reports from the Police to be circulated then taken back, and was asked to confirm that the circulated copies of the report were physically removed after the meeting, with none left behind for future reference by the Council.
26.The Council submitted a copy of a letter it had received from Dumfries and Galloway Police, dated 10 June 2009, which provided confirmation of the general content of the report regularly prepared by its Complaints and Professional Standards Unit (CPSU) for consideration and discussion during the Council's Police Sub-committee meetings.The letter also confirmed that a copy of the report marked "confidential" is made available to all members attending the meeting, for perusal and discussion; after the meeting, all copies are collected and retained by the CPSU for information security purposes.
27.The Commissioner accepts that the Council does not hold a copy of item 2.He believes this should have been established when the Council first responded to Mr Duff's request or during the review of that response, particularly since the Council sought to apply exemptions to the information in item 2 (evidently without first seeking to examine the information in the report).The Commissioner finds that the Council failed to comply with section 17(1) of FOISA in failing to notify Mr Duff that it did not hold the information he had requested.
Part 5 of the request
28.In part 5 of his request, Mr Duff asked for all other reports, letters, documents etc. provided to the Police Authority concerning his complaints and court actions against Dumfries and Galloway Constabulary.The Council initially advised him (20 March 2009) that reports were the only documents submitted to the Complaints against the Police Sub-Committee; no letters or documents had been submitted.Any reports submitted were considered to be exempt from disclosure under the exemptions cited in relation to the other reports requested by Mr Duff.The Council stated that it was unaware of any reports which had been put to Committee regarding court actions against Dumfries and Galloway Constabulary.
29.During the investigation, the Council was asked to clarify which reports had been submitted to the Complaints to the Police Sub-Committee, and whether these comprised the same reports covered by parts 1 ? 4 of Mr Duff's request.The Council confirmed that item 4 (as listed previously) was the only report submitted to the Sub-Committee in which reference was made to Mr Duff.
30.The Council also confirmed it to be standard practice that only information for consideration by the Complaints against the Police Sub-Committee, such as the reports discussed above, would be put to the Police Authority.
31.On the basis of the evidence presented by the Council, the Commissioner accepts that the Council was correct to give Mr Duff notice, in terms of section 17(1), that it did not hold any information covered by part 5 of his request.
Item 3
32.Item 3 is a report prepared by HMIC regarding the manner in which Dumfries and Galloway Constabulary dealt with a complaint.The Council withheld the information under section 38(1)(b) of FOISA on the grounds that it constituted personal data which, if disclosed, would contravene the first data protection principle by causing unnecessary or unjustified distress to the named persons in the report.
33.The Commissioner notes that although Mr Duff requested a copy of a decision by HMIC "in respect of my complaint", the report withheld does not, in any way, relate to any complaint submitted by Mr Duff.Although Mr Duff's request corresponded to the HMIC report in terms of its source and the date on which it was presented to the Complaints against the Police Sub-Committee, it is clear that the contents of the report were not those anticipated by Mr Duff.It is unfortunate that this was not made clear to Mr Duff.
34.The Commissioner understands that the Council took the view that there was sufficient correspondence between the details provided in Mr Duff's request and the report presented on 1 November 2007 to make the case that this part of his request related to item 3.Accordingly, the Council sought to withhold the information under section 38(1)(b) and other exemptions.
35.However, the Commissioner considers that the report which has been withheld does not fall within the scope of Mr Duff's request.It is clear that Mr Duff was seeking information relating to a complaint which he himself had made, rather than any other complaint.
36.The Commissioner therefore finds that the Council failed to give Mr Duff notice that it did not hold the information detailed in part 3 of his request, as required by section 17(1) of FOISA.
37.As the information in the HMIC report presented to the Council meeting of 1 November 2007 was not the information specified in Mr Duff's request, the Commissioner has not gone on to consider whether the information was exempt from disclosure under section 38(1)(b) of FOISA, as claimed by the Council.
Information withheld under section 38(1)(a) ? applicant's own personal data
38.The Commissioner examined the information withheld under section 38(1)(a) of FOISA; that is, a report dated 11 December 2008 regarding legal support for one of the Council's officials in relation to court action raised against that official by Mr Duff (item 4).
39.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a subject access request) under section 7 of the DPA.The DPA will usually determine whether a person has a right to information about themselves.Therefore, the effect of the exemption in section 38(1)(a) of FOISA is not to deny individuals a right of access to information about themselves, but to ensure that the right is exercised under the DPA and not under FOISA.
40."Personal data" is defined in section 1(1) of the DPA, which is reproduced in the Appendix to this decision.
41.Having examined the documents in question, the Commissioner is satisfied that item 4 and the attached background information (a copy of a writ) concern matters relating to Mr Duff and comprise information from which Mr Duff can be identified.The Commissioner therefore accepts that the information is Mr Duff's own personal data, and is exempt from disclosure under section 38(1)(a) of FOISA.
42.The Commissioner understands that Mr Duff has now made a subject access request for this information under the DPA.
Information withheld under section 38(1)(b) ? personal data
43.The Council withheld item 1 under section 38(1)(b) of FOISA.Section 38(1)(b), read in conjunction with either section 38(2)(a)(i) or (b) (as appropriate), provides that information is exempt information if it constitutes personal data (as defined in section 1(1) of the DPA) and if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in the DPA.This is an absolute exemption which is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
44.As noted previously, item 1 comprises three separate reports under the Police Appeals Tribunals (Scotland) Rules 1996.The Council consider that disclosure of the personal data in the reports would contravene the first data protection principle in the DPA, which states that personal data shall be processed fairly and lawfully, and that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met.In the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA must also be met.
Is the information 'personal data'?
45.As noted above, the definition of personal data is reproduced in the Appendix.Although the versions of the reports held by the Council have had the names and other personal details of the Police Officers concerned redacted, the Commissioner must take into account, in determining whether the Police Officers concerned could be identified, not only the information in the reports themselves, but other information which is in the possession of, or is likely to come into the possession of, the Council.
46.The Commissioner accepts, given the geographical and other details remaining in the reports, that the Police Officers could be identified either from other information which is in the possession of the Council, or which is likely to come into the possession of the Council, and that the reports therefore comprise personal data.
47.As the reports relate to the commission or alleged commission of an offence by the Police Officers concerned, the Commissioner is satisfied that the information is "sensitive personal data" as defined by section 2(g) of the DPA.
Can the information lawfully be disclosed?
48.Given the additional restrictions surrounding the disclosure of sensitive personal data, the Commissioner first considered whether there are any conditions in Schedule 3 which would permit the sensitive personal data to be disclosed.If none of the conditions in Schedule 3 can be met, the information cannot lawfully be disclosed.
49.There are 10 conditions listed in Schedule 3 to the DPA. In guidance issued by the Commissioner on the interpretation of the exemptions in section 38[1], it is noted that because of the restrictive nature of the conditions in Schedule 3, generally only the first and fifth conditions might be relevant when considering a request for sensitive personal data under FOISA.
50.Condition 1 allows processing where the data subject has given explicit (and fully informed) consent to the release of the information.Condition 5 allows processing where information contained in the personal data has been made public as a result of steps deliberately taken by the data subject. Neither of these conditions has been met in this case.
51.The Commissioner has gone on to consider all of the other conditions in Schedule 3, including those in the Data Protection (Processing of Sensitive Personal Data) Order 2000 made by the Secretary of State for the purposes of condition 10 of Schedule 3.Having done so, he remains satisfied that there are no conditions in Schedule 3 which would allow the information to be disclosed. Consequently, he is satisfied that disclosure of any of the sensitive personal data withheld would breach the first data protection principle.
52.As the Commissioner is satisfied that there are no conditions in Schedule 3 which would permit the release of the information, he finds that the disclosure of the reports would breach the first data protection principle.
53.The Commissioner therefore finds that the Council was correct to withhold item 1 under section 38(1)(b) of FOISA.
Conclusion
54.The Commissioner has found that the information requested by Mr Duff was either not held by the Council or was correctly withheld under sections 38(1)(a) or 38(1)(b) of FOISA.He is not required to go on to consider whether the other exemptions applied by the Council were also justified.
Conduct of the review
55.As noted previously, Mr Duff expressed concern that one of the members of the Council's review panel was a serving police officer.He considered that this gave rise to a serious conflict of interest, given that the matters in the reports he had requested referred to Dumfries and Galloway Constabulary and his complaints against the Police.
56.The Council advised the Commissioner that the Police Officer in question is the Freedom of Information Officer for Dumfries and Galloway Constabulary and regularly sits on the Council Review Panels.He is there to help assess whether, in responding to requests, the statutory processes in FOISA were adhered to and the appropriate exemptions applied. The Panel consists of three people, which limits any individual member's influence on its findings.
57.The Council advised that, in relation to this case, the Police Officer was asked to join the Review Panel because of holiday commitments by other Panel members and a lack of other Council staff with knowledge of FOISA.The Council pointed out that none of the reports considered by the Review Panel had originated from Dumfries and Galloway Constabulary, and only one of the reports referred to Mr Duff (item 4); this report concerned Mr Duff's complaint with the Council rather than his complaint against Dumfries and Galloway Constabulary.
58.The Commissioner accepts this explanation, while noting that item 2 was a report which was circulated to the Complaints against the Police Sub-Committee by Dumfries and Galloway Constabulary and then taken back.The Commissioner has not seen a copy of this report, but understands it to include details of all complaints recorded and finalised during the period covered by the report.If this report had been considered by the Review Panel, the Commissioner may have had concerns about a potential conflict of interest.However, as noted previously, the Commissioner found that item 2 was information which was not held by the Council and so could not have been considered in detail by the Review Panel.
59.The Scottish Ministers' Code of Practice on the Discharge of Functions by Public Authorities under the Freedom of Information (Scotland) Act 2002 (the Section 60 Code) gives some guidance about the conduct of a review.Paragraph 66 states:
"?the review should generally be handled by staff who were not involved in the original decision. While this may not always be possible it is important that the review procedure enables the matter to be considered afresh."
Paragraph 65 of the Section 60 Code lays down the main requirement:
"The review procedure should be fair and impartial and it should enable different decisions to be taken if appropriate."
60.The Commissioner is satisfied that the presence on the Review Panel of a Police Officer from Dumfries and Galloway Constabulary did not, in itself, in this case, create a conflict of interest, and did not prevent a fair and impartial review from taking place.Given that it was known that Mr Duff has previously complained about Dumfries and Galloway Constabulary, it would have been preferable if the Council could have arranged a Review Panel that did not include a Police Officer.However, the Commissioner accepts that a shortage of suitable panel members meant that this was not possible.
DECISION
The Commissioner finds that Dumfries and Galloway Council (the Council) generally complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Duff.
The Commissioner finds that the Council complied with Part 1 of FOISA by withholding information which was exempt from disclosure under sections 38(1)(a) or 38(1)(b).However, the Commissioner finds that the Council did not comply with section 17(1) of FOISA by failing to notify Mr Duff that it did not hold some of the information he had requested.
The Commissioner does not require the Council to take any action in respect of this breach in this instance.
Appeal
Should either Mr Duff or the Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
4 December 2009
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(?)
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
(?)
(e) in subsection (1) of section 38 ?
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(?)
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(?)
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to?
?
(g) the commission or alleged commission by him of any offence, or
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 3 ? Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
[1] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
