|
Decision 147/2015: Mr X and South Lanarkshire Council
Disturbances at a specified property
Reference No: 201501075
Decision Date: 22 September 2015
Summary
On 13 April 2015, Mr X asked South Lanarkshire Council (the Council) for information about disturbances at a specified property. The Council responded by refusing to confirm or deny whether it held any information. Following a review, Mr X remained dissatisfied and applied to the Commissioner for a decision.
The Commissioner investigated and found that the Council had properly responded to Mr X's request for information in accordance with Part 1 of FOISA. This was because she found that the Council was entitled neither to confirm nor deny whether it held information which would address Mr X's request. She did not require the Council to take any action.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); 2(g) (Sensitive personal data); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 13 April 2015, Mr X made a request for information to the Council. He asked whether the Police had been contacted about the number of call outs to a specified property (request 1) and whether individuals at another property had been contacted to confirm the nature of the disturbances at the specified property (request 2).
2. The Council responded on 11 May 2015. The Council cited section 18(1) of FOISA and notified Mr X that it was unable to confirm or deny whether it held any information falling within the scope of his requests. The Council stated that if it held any such information it would be exempt from disclosure under section 38(1)(b) of FOISA. The Council explained how it had reached this decision.
3. On 11 May 2015, Mr X wrote to the Council requesting a review of its decision on the basis that he could not understand why the Council would not answer his questions.
4. The Council notified Mr X of the outcome of its review on 9 June 2015. The Council's review upheld its initial response.
5. On 10 June 2015, Mr X wrote to the Commissioner. Mr X applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr X stated he was dissatisfied with the outcome of the Council's review because he wished the Council to supply him with the information he had asked for or confirm it did not hold the information.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr X made a request for information to a Scottish public authority and asked the authority to review its response to that request requests before applying to her for a decision.
7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.
Commissioner's analysis and findings
8. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr X and the Council. She is satisfied that no matter of relevance has been overlooked.
Section 18 of FOISA
9. Section 18 allows Scottish public authorities to refuse to reveal whether they hold information (or whether it exists) in the following limited circumstances:
? a request has been made to the authority for information which may or may not be held by it, and
? if the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA, and
? the authority considers that to reveal whether it holds the information, or whether it exists, would be contrary to the public interest.
10. Where a public authority has chosen to rely on section 18(1) of FOISA, the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions provided for by sections 28 to 35, 38, 39(1) or 41 of FOISA.
11. While doing this, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
12. The Commissioner will first consider whether the Council could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and was held.
Section 38(1)(b)
13. The Council stated that if it held the requested information, it would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
14. In order to rely on this exemption, the Council must show, firstly, that any such information would be personal data for the purposes of the DPA, and secondly that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1.
Is the information personal data?
15. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).
16. The Council stated that any information regarding correspondence about alleged incidents or disturbances at a particular property constitutes the personal data of individuals resident in that property.
17. The information Mr X asked for, by definition, relates to an identifiable property and would therefore also relate to any identifiable individual(s) resident in the property. Having considered the type of information Mr X is seeking in both requests (1) and (2), the Commissioner accepts that the information, if it exists, would be the personal data of the resident(s) of the property.
Is some of the information sensitive personal data?
18. The Council submitted that if it held any relevant information covered by request 1, the information would relate to investigations which may or may not have been undertaken by the Council, which (if they had occurred) would have amounted to an investigation into alleged criminal activities of the individual(s) living in the property. The Council considered that such information would be sensitive personal data in terms of section 2(g) of the DPA (information as to the commission or alleged commission by the data subject of any offence).
19. "Sensitive personal data" is a special category of personal data under the DPA that is subject to stricter processing criteria. Whether particular information falls within section 2(g) of the DPA is a question of fact in the circumstances of any given case.
20. Request 1 asked whether the Police had been contacted about the number of call outs to a specified property. The request refers directly to "the Police" and makes a connection between the police, police action and the property (i.e. "call-outs"). The implication in the request is that the Police have attended this property for the purposes of investigating the commission or alleged commission of an offence.
21. The wording of request 2 states that there have been disturbances at the specific property, again carrying an implication that there may have been unlawful behaviour. Confirming that a neighbour had been contacted about this would in effect confirm that there was an alleged commission of an offence.
22. The Commissioner is of the view that any information that falls within the terms of requests 1 and 2 (if it exists and is held by the Council), would relate to the actual or alleged commission of a crime by the data subject(s) (whether broadly described as "disturbances", or in more specific terms). The Commissioner accepts that any relevant information (if it exists and is held by the Council) would constitute information as to the commission or alleged commission by the data subject(s) of any offence, and would therefore be defined as sensitive personal data.
Would disclosure contravene the first data protection principle?
23. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
24. The processing under consideration in this case would be the disclosure of any personal data that might be held by the Council into the public domain, in response to Mr X's information request.
25. In its submissions, the Council argued that disclosure of the information, if held, would contravene the first data protection principle. The Council submitted that the information covered by request 1 (if it existed and was held) would be sensitive personal data and that there were no conditions in Schedule 3 to the DPA which would permit disclosure. Consequently, disclosure would be unlawful.
26. Given the additional restrictions surrounding the disclosure of sensitive personal data, it makes sense to look at whether there are any conditions in Schedule 3 which would permit any relevant data to be disclosed, before considering the Schedule 2 conditions.
Can any of the conditions in Schedule 3 be met?
27. There are 10 conditions listed in Schedule 3 to the DPA. One of these, condition 10, allows sensitive personal data to be processed in circumstances specified in an order made by the Secretary of State. The Commissioner has therefore considered the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000. None of these are applicable in this case.
28. The Commissioner's guidance[1] on the section 38 exemptions concludes that (in practical terms) there are only two conditions in Schedule 3 which would allow sensitive personal data to be processed in the context of a request for information under FOISA, namely:
? the data subject has given explicit consent to the processing (condition 1); or
? the information contained in the personal data has been made public as a result of steps taken deliberately by the data subject (condition 5).
29. The Council's initial response identified these two conditions and confirmed the Council's view that these conditions did not apply in this case.
30. In the circumstances, the Commissioner is satisfied that neither condition 1 nor condition 5 could be met in this case.
31. Having considered the other conditions in Schedule 3 and (as indicated above) the additional conditions contained in secondary legislation, the Commissioner has come to the conclusion that there is no condition which would permit disclosure of the type of sensitive personal data under consideration here, should any relevant data be held by the Council.
32. In the absence of a condition permitting disclosure, any such disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of any relevant data held by the Council would breach the first data protection principle and that the information, if held, would therefore be exempt from disclosure under section 38(1)(b) of FOISA.
33. Having accepted that the Council could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of sections 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether the Council were entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.
Section 18 - Public interest test
34. The Council recognised that there is a public interest in allowing the public to be able to obtain information under FOISA. The Council also noted that that there is a general public interest in openness and transparency in relation to the actions of the Council. However, the Council contended that there is a greater public interest in ensuring that it complies with the provisions of the DPA.
35. Mr X provided arguments on why he considered that the public interest lay in providing confirmation of whether the Council held any relevant information. The Commissioner cannot give details of those arguments in this decision notice, but has considered all the points he raised, in reaching her decision.
36. Having considered the submissions of both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for the Council to reveal, in response to an information request under FOISA, whether the information requested by Mr X exists or is held by the Council. To confirm whether the information exists would disclose sensitive personal data, in breach of the DPA. The Commissioner accepts that this would not be in the public interest.
37. As a result, the Commissioner is satisfied that the Council was entitled to refuse to confirm or deny whether it held the information requested by Mr X, or whether such information existed, in line with section 18(1) of FOISA.
|
Decision
The Commissioner finds that South Lanarkshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr X.
|
Appeal
Should either Mr X or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
22 September 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
?
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
?
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
?
(g) the commission or alleged commission by him of any offence, or
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
.
Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
[1]
