Decision 149/2021: Records of a named individual

Public authority: Chief Constable of the Police Service of Scotland
Case Ref: 202001405

Summary

Police Scotland were asked for records of a named individual. Police Scotland refused to confirm or deny whether the information existed or was held by them.

The Commissioner found that Police Scotland's response complied with FOISA.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of "personal data") (Definitions); 5(1)(a) (Principles relating to processing of personal data); 10 (Processing of personal data relating to criminal convictions and offences)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and 14 (Terms relating to the processing of personal data); 10(4) and (5) (Special categories of personal data and criminal convictions etc data); 11(2) (Special categories of personal data etc: supplementary)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 22 October 2020, the Applicant made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). The information requested was for records of a named individual convicted in 2004.

2. Police Scotland responded on 5 November 2020. They refused to confirm or deny whether they held the information or whether it existed, relying on section 18(1) of FOISA in conjunction with section 38(1)(b) (Personal information).

3. On 5 November 2020, the Applicant wrote to Police Scotland requesting a review of their decision on the basis that: there was already a large amount of information in the public domain; that the information could be provide to him subject to redaction and that it did not relate to a current or ongoing investigation.

4. Police Scotland notified the Applicant of the outcome of their review on 23 November 2020. They upheld their initial response, expanded upon their reasoning and also stated that sections 34(1) (Investigations by Scottish public authorities and proceedings arising out of such investigations), 35(1)(a) and (b) (Law enforcement), and 39(1) (Health, safety and the environment) applied in conjunction with section 18(1) of FOISA.

5. On 24 November 2020, the Applicant applied for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of Police Scotland's review as he submitted that the information had been publicly reported; there was a wider public interest in the requested information; and there was no prejudice to an ongoing criminal investigation as the case was concluded many years ago.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 9 December 2020, Police Scotland were notified in writing that the Applicant had made a valid application. The case was then allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and to answer specific questions.

9. The Applicant was also given an opportunity to provide his comments as to why he considered the information, if held, should be disclosed.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner has considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and Police Scotland. He is satisfied that no matter of relevance has been overlooked.

Section 18(1) of FOISA - "neither confirm nor deny"

11. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

(i) a request has been made to the authority for information which may or may not be held by it;

(ii) if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and

(iii) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

12. Where a public authority has chosen to rely on section 18(1), the Commissioner must therefore establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. He must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1) and cited by the authority.

13. In any case where section 18(1) is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that he is unable to comment in any detail on matters which could have the effect of indicating whether the information existed or was held by the authority.

Section 38(1)(b) - Personal information

14. Police Scotland stated that, if held, the requested information, would be exempt from disclosure in terms of section 38(1)(b). Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data", as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.

15. In this case, Police Scotland submitted that, if the information existed or was held, disclosure would breach the first data protection principle, which requires the processing of personal data to be lawful and fair (Article 5(1)(a) of the GDPR).

Is the information personal data?

16. "Personal data" is defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual".

17. Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular by reference to -

a. an identifier such as a name, an identification number, location data or an online identifier, or

b. one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."

18. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

19. The Applicant identified the individual in his request. Given the subject matter of the request, the information, if held and if it existed, would clearly relate to that individual. The Commissioner therefore accepts that, if held, the information would be personal data.

Criminal offence data

20. Information relating to criminal convictions and offences is given special status in the UK GDPR: Article 10 makes it clear that the processing of this type of personal data can be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of the data subjects.

21. Section 11(2) of the DPA 2018 makes it clear that proceedings for an offence committed by a data subject or the disposal of such proceedings, including sentencing, is criminal offence data. Within the context of his request, the personal data requested, if held falls within this definition.

22. Criminal offence data can only be processed if one of the stringent conditions in Parts 1 to 3 of Schedule 1 to the DPA 2018 can be met (section 10(5) of the DPA 2018).

23. "Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.

24. The Commissioner has considered each of these conditions and whether any of them could be relied on to disclose the criminal offence data, if held. Having done so, and having taken into account the restrictive nature of the conditions, he considers that they could not.

25. As noted above, Police Scotland argued that disclosure would breach the data protection principle (Article 5(1)(a) of the GDPR) which requires that personal data shall be processed lawfully and fairly. As none of the conditions required for processing personal data are satisfied, there can be no legal basis for its disclosure.

26. Consequently, the information requested by the Applicant, if held and if it existed, would be exempt from disclosure under section 38(1)(b) of FOISA.

Section 18(1) - The public interest

27. The Commissioner must now consider whether Police Scotland were entitled to conclude that it would be contrary to the public interest to reveal whether the information exists or is held.

28. In their submissions, Police Scotland explained that, when asked about third party criminality, whether someone has been investigated, or whether they have a criminal record etc, the application of section 18 is essential. Police Scotland explained that to respond otherwise would effectively mean background checking people on request through FOISA, stating that the information was not held (section 17 - Information not held) for those with no criminal record, or stating that information was held (section 16 - Refusal of request) for those with a criminal record.

29. Police Scotland considered it was not in the public interest for a police force to publicly confirm whether a particular individual has a criminal record or has been the subject of police attention.

30. They noted that some trials are subject to significant media attention and accept on that basis that there may be some cases or criminals so well known that a section 18 response becomes redundant.

31. However, even very minor cases will typically appear in local media etc in a "round the courts" type feature. The existence of court reporting cannot however negate an individual's right to privacy to the extent that a few lines in a newspaper means that, for example, a future partner or employer could find out through FOISA whether or not they had a criminal record.

32. The Applicant made a number of points to Police Scotland and the Commissioner which are relevant to the balancing of the public interest. the Applicant submitted that:

(i) the information sought is not in relation to a current or ongoing criminal investigation, and, as such the right of the applicant to have the information outweighs the right of the police to withhold it, or to refuse to confirm or deny whether they have it. This is because there can be no damage or bias caused to anyone by supplying this information;

(ii) it cannot prejudice any ongoing criminal investigation as the case was concluded in 2004. It would be disproportionate not to supply the documents after a more than reasonable period has elapsed; and

(iii) he did not consider Police Scotland could be trusted to keep the requested information safe, and considered the material should be disclosed before it is lost.

He also provided personal details as to why the information was of value to him.

33. The Commissioner accepts that there is a strong public interest in protecting the privacy of individuals in relation to their dealings with Police Scotland. While he is aware of the Applicant's interest in requesting information, the public interest is something of serious concern and benefit to the public at large, not merely something of individual interest. Disclosure under FOISA is not simply disclosure to the person requesting the information, but rather is a public disclosure. This must always be borne in mind when considering the effects of disclosure; a disclosure of this kind to one individual cannot, therefore, be considered in isolation.

34. The Commissioner notes the Applicant's public interest arguments in justice being done and in ensuring that the police and public prosecution authorities discharge their duties and are held to account. There is a public interest in transparency in relation to the actions and decision-making processes of public bodies, including Police Scotland; this may include disclosure of information (if held) which could shed some light on those actions and processes.

35. The Commissioner also accepts that there is a strong public interest in Police Scotland not breaching data protection legislation. It is not the case that a person who has been convicted of criminal conduct forfeits any rights to privacy. The Commissioner is satisfied that disclosing the information, if held, would breach the first data protection principle.

36. The test the Commissioner must consider is whether (having already concluded that the information, if it existed and were held, would be exempt from disclosure) it would be contrary to the public interest to reveal whether the information existed or was held.

37. The Commissioner notes the reasons why the Applicant considers the information, if held, should be disclosed. The Commissioner is also aware that the action of confirming or denying whether the information exists or is held would have the effect of confirming the status of an individual. This would, of itself, lead to Police Scotland breaching its duties as data controller under data protection legislation. In the circumstances, the Commissioner must find that it would be contrary to the public interest for Police Scotland to reveal whether it held the requested information, or whether the information existed.

38. Consequently, the Commissioner is satisfied that Police Scotland were entitled to refuse to confirm or deny, whether the information requested by the Applicant existed or was held, in accordance with section 18(1) of FOISA.

39. In the circumstances, the Commissioner will not go on to consider whether Police Scotland were also entitled to refuse to confirm or deny whether the information existed or was held in conjunction with the exemptions set out in paragraph 4.

Decision

The Commissioner finds that the Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Chief Constable of the Police Service of Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
30 September 2021

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A));

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in -

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

…

"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

UK General Data Protection Regulation

Article 4 Definitions

For the purpose of this Regulation:

(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

…

Article 5 Principles relating to processing of personal data

1. Personal data shall be:

a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 10 Processing of personal data relating to criminal convictions and offences

1 Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

2. In the 2018 Act-

(a) section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met;

(b) section 11(2) makes provision about the meaning of "personal data relating to criminal convictions and offences or related security measures".

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to-

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as

…

(d) disclosure by transmission, dissemination or otherwise making available,

…

(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.

…

(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).

…

(14) In Parts 5 to 7, except where otherwise provided -

(a) references to the UK GDPR are to the UK GDPR read with Part 2;

…

(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;

(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.

10 Special categories of personal data and criminal convictions etc data

…

(4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5) The processing meets the requirement in Article 10 of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.

…

11 Special categories of personal data etc: supplementary

…

(2) In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to -

(a) the alleged commission of offences by the data subject, or

(b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.