|
Decision 142/2015: Mr X and South Lanarkshire Council
Investigation into report of anti-social behaviour
Reference No: 201500889
Decision Date: 8 September 2015
Summary
On 13 March 2015, Mr X asked South Lanarkshire Council (the Council) for a copy of an investigation he understood it had carried out.
The Council refused to confirm or deny whether it held any such information, but stated that if the information existed and was held, it would be personal data which was exempt from disclosure under FOISA. Following a review, Mr X remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Council was entitled to neither confirm nor deny whether it held information which would address Mr X's request.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); 2(g) (Sensitive personal data); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 13 March 2015, Mr X made a request for information to the Council. He asked for a copy of an investigation into a reported disturbance which he understood had been carried out by the Council.
2. The Council responded on 13 April 2015. Under section 18 of FOISA, it refused to reveal whether the requested information existed or whether it was held by the Council. As required by section 18, the Council named the exemption in FOISA which it considered would apply if the information existed and was held. The Council argued that if the information existed it would be the personal data, and it would be exempt from disclosure under section 38(1)(b) of FOISA.
3. On 13 April 2015, Mr X wrote to the Council requesting a review of its decision.
4. The Council notified Mr X of the outcome of its review on 12 May 2015. The Council upheld its initial response.
5. On 14 May 2015, Mr X wrote to the Commissioner. Mr X applied to the Commissioner for a decision in terms of section 47(1) of FOISA.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
7. On 1 June 2015, the Council was notified in writing that Mr X had made a valid application.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.
Commissioner's analysis and findings
9. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr X and the Council. She is satisfied that no matter of relevance has been overlooked.
Section 18 of FOISA
10. Section 18 allows Scottish public authorities to refuse to reveal whether they hold information (or whether it exists) in the following limited circumstances:
? a request has been made to the authority for information which may or may not be held by it, and
? if the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA, and
? the authority considers that to reveal whether it holds the information, or whether it exists, would be contrary to the public interest.
11. Where a public authority has chosen to rely on section 18(1) of FOISA, the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions provided for by sections 28 to 35, 38, 39(1) or 41 of FOISA.
12. While doing this, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
13. In this case, the Council has indicated that the phrasing of Mr X's information request alleges illegality. The Council takes the view that, in these circumstances, if it confirmed that it held the requested information, that confirmation would, by itself, disclose sensitive personal data .
14. The Commissioner must first consider whether the Council could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it exists and is held.
Section 38(1)(b)
15. The Council stated that if it held the requested information, it would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
16. In order to rely on this exemption, the Council must show, firstly, that any such information would be personal data for the purposes of the DPA, and secondly that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1.
Is the information personal data?
17. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
18. The Council stated that the information specified in Mr X's request (if it exists) would be the personal data of the people referred to in the request. The information, by definition, would relate to them and would identify them. Having considered the type of information Mr X is seeking, the Commissioner accepts that the information, if it exists, would be personal data.
Would disclosure contravene the first data protection principle?
19. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
20. The processing under consideration in this case would be the disclosure of any personal data that might be held by the Council into the public domain, in response to Mr X's information request.
21. In its submissions, the Council argued that disclosure of the information, if held, would contravene the first data protection principle. It submitted that the information would be sensitive personal data and that there were no conditions in Schedule 3 to the DPA which would permit disclosure. Consequently, disclosure would be unlawful.
22. The Council submitted that if it held any relevant information it would be sensitive personal data in terms of section 2(g) of the DPA. This applies to personal data "consisting of information as to the commission or alleged commission by [the data subject] of any offence". The Commissioner accepts that any relevant information (if it exists and is held by the Council) would meet this definition and would be sensitive personal data.
23. Given the additional restrictions surrounding the disclosure of sensitive personal data, it makes sense to look at whether there are any conditions in Schedule 3 which would permit any relevant data to be disclosed, before considering the Schedule 2 conditions.
Can any of the conditions in Schedule 3 be met?
24. There are 10 conditions listed in Schedule 3 to the DPA. One of these, condition 10, allows sensitive personal data to be processed in circumstances specified in an order made by the Secretary of State. The Commissioner has therefore considered the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000. None of these are applicable in this case.
25. The Commissioner's guidance[1] on the section 38 exemptions concludes that (in practical terms) there are only two conditions in Schedule 3 which would allow sensitive personal data to be processed in the context of a request for information under FOISA, namely:
? the data subject has given explicit consent to the processing (condition 1); or
? the information contained in the personal data has been made public as a result of steps taken deliberately by the data subject (condition 5).
26. In the circumstances, the Commissioner is satisfied that neither condition 1 nor condition 5 could be met in thie case.
27. Having considered the other conditions in Schedule 3 and (as indicated above) the additional conditions contained in secondary legislation, the Commissioner has come to the conclusion that there is no condition which would permit disclosure of the type of sensitive personal data under consideration here, should any relevant data be held by the Council.
28. In the absence of a condition permitting disclosure, any such disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of any relevant data held by the Council would breach the first data protection principle and that the information, if held, would therefore be exempt from disclosure under section 38(1)(b) of FOISA.
29. Having accepted that the Council could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to consider whether the Council was entitled to conclude that it would be contrary to the public interest to reveal whether the information exists or is held by the Council.
Public interest test - section 18
30. The Council recognised that there is a public interest in allowing the public to be able to obtain information under FOISA. The Council also noted that that there is a general public interest in openness and transparency in relation to the actions of the Council. However, the Council contended that there is a greater public interest in ensuring that it complies with the provisions of the Data Protection Act 1998 (the DPA).
31. The Council made further arguments to the Commissioner which cannot be summarised here as to do so would confirm whether or not it held the information.
32. Having considered the submissions of both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for the Council to reveal, in response to an information request under FOISA, whether the information requested by Mr X exists or is held by it. To confirm whether the information exists would disclose sensitive personal data in breach of the DPA. The Commissioner accepts that this would not be in the public interest.
33. As a result, the Commissioner is satisfied that the Council was entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether it held the information requested by Mr X, or whether such information existed.
|
Decision
The Commissioner finds that South Lanarkshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr X.
|
Appeal
Should either Mr X or South Lanarkshire Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
8 September 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
?
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
?
(g) the commission or alleged commission by him of any offence, or
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met
Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
[1]
