Decision 151/2019: Homophobic Hate Crimes

Public authority: Chief Constable of the Police Service of Scotland
Case Ref: 201900718

Summary

Police Scotland were asked for the number of homophobic hate crimes reported to the Procurator Fiscal in Wick in 2017 and 2018 where the victims were police officers.

Police Scotland refused to say how many such crimes had been reported. They argued that disclosing the number would lead to individuals being identified and that this would breach the data protection principles.

The Commissioner did not agree that disclosing the number would identify individuals and required Police Scotland to disclose it.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18 (Further provisions as respects responses to request); 38(1)(b) and (5) (definition of "personal data")

Data Protection Act 2018 (the DPA 2018) section 3(2) and (3) (definition of "personal data") (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 19 January 2019, the Applicant made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). The information requested was:

• The total number of homophobic hate crimes reported to the Procurator Fiscal in Wick, Caithness (a) during 2017 and (b) during 2018. (Part 1)
• The number of homophobic hate crimes reported to the Procurator Fiscal in Wick, lodged in terms of a police officer(s) perceiving that he/she/they were the victim(s) of homophobic hate crime(s) (a) during 2017 and (b) during 2018. (Part 2)

2. Police Scotland responded on 19 February 2019. They provided the information sought in Part 1 of the request. For Part 2, Police Scotland refused to disclose the information requested, considering it to be third party personal data and exempt from disclosure under section 38(1)(b) (Personal information) of FOISA. Police Scotland also believed the information to be special category personal data, disclosure of which would breach data protection legislation.

3. On 19 February 2019, the Applicant wrote to Police Scotland, requesting a review of their decision on the basis of their failure to provide the information requested in Part 2.

4. Police Scotland notified the Applicant of the outcome of their review on 18 March 2019, upholding their original response to Part 2 with slight modification. While agreeing the section 38(1)(b) exemption was relevant, Police Scotland were of the view that section 18, as opposed to section 16, of FOISA ought to have been applied. Police Scotland also apologised for not responding to the request within the 20 working day legislative deadline.

5. On 5 May 2019, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of Police Scotland's review because he believed their reasons for withholding the information were not credible and did not stand up to scrutiny, and it was in the public interest for the information to be disclosed. The Applicant also provided the Commissioner with correspondence with the Equality Network in support of his position.

Investigations

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 3 June 2019, Police Scotland were notified in writing that the Applicant had made a valid application and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and to answer specific questions, focusing on the application of data protection legislation to the withheld information. They were also asked to confirm whether or not they were relying on section 18 of FOISA, as referred to in their review outcome. Police Scotland were also asked to send the Commissioner any information withheld from the Applicant.

9. As Police Scotland were withholding information under the exemption in section 38(1)(b), the Applicant was also asked to comment on his legitimate interest in obtaining the information.

10. Police Scotland provided their submissions to the Commissioner, along with the withheld information.

11. The Applicant provided no further submissions.

Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and Police Scotland. He is satisfied that no matter of relevance has been overlooked.

Section 18 of FOISA - "neither confirm nor deny"

13. Section 18 of FOISA allows Scottish public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

(i) a request has been made to the authority for information which may or may not be held by it; and

(ii) if the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and

(iii) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.14. In their review outcome of 18 March 2019, Police Scotland upheld their original decision with slight modification. They informed the Applicant that, while they agreed the section 38(1)(b) exemption was relevant, they were of the view that section 18, as opposed to section 16, ought to have been applied.

15. In their initial submissions to the Commissioner, Police Scotland noted their comment, in their review outcome, that a refusal under section 16 of FOISA "was not appropriate" and that section 18 "ought to have been used". They acknowledged this was a highly unusual step at review and fully accepted that the use of section 16, in their initial response, will have been interpreted as confirmation that information was held.

16. Police Scotland explained that they felt it was important, at review stage, to offer what they viewed to be the most appropriate and technically correct response. They submitted there was no public interest in confirming or denying whether any victims were police officers, given the small pool of officers to whom this data related. By confirming information was held, Police Scotland submitted this confirmed that at least one police officer in Wick had been the victim of such a crime.

17. Given that the wording of Police Scotland's review outcome was ambiguous, they were asked to clarify whether, at review stage, their intention was to change their position to rely on section 18 in conjunction with section 38(1)(b) of FOISA, or whether they were maintaining reliance solely on section 38(1)(b) to withhold the information for Part 2.

18. In response, Police Scotland accepted that, in initially applying section 16, they confirmed that relevant information was held, and the use of section 18 thereafter would make no sense. They submitted that they felt it was important, at review stage, to acknowledge the request had not been handled appropriately and that an erroneous response had been issued.

19. They further submitted that, had it been their intention to overturn the original decision, the review response would have referenced section 24(1)(b) instead of section 24(1)(a), explicitly stating that the original decision had been overturned.

20. Police Scotland confirmed that they were not relying on section 18 of FOISA, either at review stage or during this investigation, and their continued position was that, in terms of section 16 of FOISA, they were refusing to provide the information as they considered it was exempt from disclosure in terms of section 38(1)(b).

21. Police Scotland accepted that the reference, in their review response, to "slight modification" was potentially confusing, but they believed that it would be clear to the Applicant that their position had not changed and the information was not being disclosed.

22. In this case, the Commissioner notes that, in initially responding to Part 2 of the Applicant's request, Police Scotland gave him a formal refusal notice in terms of section 16 of FOISA, confirming the information was held, but also stating that it was considered to be personal data and therefore exempt from disclosure under section 38(1)(b).

23. The Commissioner also notes Police Scotland's explanation, in their review outcome, that a section 16 response was not appropriate and that they ought to have responded in terms of section 18. As noted in previous decisions (and indeed recognised by Police Scotland in their submissions), the Commissioner does not accept that an authority can confirm to a requester that the information is held and then subsequently revert to a position where it refuses to confirm or deny the existence of that information. To do so would make no sense and, in the Commissioner's view, would bring into disrepute a provision designed for a very serious purpose.

24. Having considered Police Scotland's submissions, the Commissioner accepts that Police Scotland's position, at review stage, was to continue to consider the information was exempt from disclosure in terms of section 38(1)(b). While recognising it may have been Police Scotland's intention to be helpful, by explaining to the Applicant the error in their original response, the Commissioner does not accept that the purpose of a review response is to set out what the original response "ought to have been", where that revised position cannot be sustained.

25. While the above concerns do not amount to a breach of FOISA, the Commissioner considers that the wording in Police Scotland's review outcome was somewhat confusing, and their stated position could have been made much clearer, for example by explicitly stating that the information continued to be withheld solely under the exemption in section 38(1)(b). He would ask Police Scotland to reflect on this matter when responding to any future requests for review.

26. The Commissioner will now go on to consider whether Police Scotland were entitled to withhold the information requested in Part 2 of the Applicant's request under the exemption in section 38(1)(b) of FOISA.

Section 38(1)(b) - Personal information

27. Police Scotland withheld the information requested in Part 2 of the Applicant's request on the basis that it was exempt from disclosure under section 38(1)(b) of FOISA.

28. In his application to the Commissioner, the Applicant believed that disclosure of the information was in the public interest. In evidence of his position, he provided the Commissioner with correspondence with the Equality Network. This correspondence, the Applicant argued, not only addressed but also demonstrated, in terms of civil and criminal justice legislation (recognised in Scots law), that the reasons given by Police Scotland for withholding the information were not credible, nor did they stand up to scrutiny.

29. The exemption in section 38(1)(b) of FOISA is not subject to a public interest test in the same way as some other exemptions. The test for section 38(1)(b), as applied by Police Scotland in this case, is whether disclosure would breach any of the data protection principles in Article 5(1) of the General Data Protection Regulation (the GDPR).

30. The Commissioner must decide whether Police Scotland were correct to withhold the information sought in Part 2 of the Applicant's request, under section 38(1)(b). He will consider whether the tests required for section 38(1)(b) to apply have been met.

Searches

31. Police Scotland explained that hate crime information is recorded on their Interim Vulnerable Persons Database, and this was searched for all hate crimes motivated by sexual orientation for the relevant location and dates. The resultant crime reports were manually read to identify any where the victims were police officers, given that there is no marker in place that records such information.

32. Having considered Police Scotland's submissions on searches, the Commissioner is satisfied that these were reasonable and proportionate, and capable of identifying all of the information falling within the scope of Part 2 of the Applicant's request.

Is the information personal data?

33. The first point the Commissioner must consider is whether the information is personal data in terms of section 3(2) of the DPA 2018. Read with section 3(3), section 3(2) incorporates the definition in Article 4(1) of the GDPR:

… any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

The definition of personal data is set out in full in Appendix 1.

34. In their submissions to the Commissioner, Police Scotland stated that it was unusual for them to receive a request for crime statistics relating to a particular offence type, a small geographic area (in terms of population) and a particular demographic group (i.e. police officers). In their view, the combination of these three factors rendered the information personal data.

35. Police Scotland referred to some recent decisions by the Commissioner which, they submitted, had concluded that where the pool of individuals (to whom the data could relate) was small (i.e. one or two), the information was personal data[1], and where this was larger (e.g. 800,000) the information was not personal data[2]. While appreciating that there was no set "cut-off point" in determining this, Police Scotland took the view that the number of individuals to whom the information could relate to was a key factor - in this case, the number of police officers based in the area in question.

36. Police Scotland further submitted that, given the nature of the location, many police officers would be known to the community (including the Applicant), and so their consideration had focused on identification in the wider sense, and not solely on identification by the Applicant. Given the number of officers to whom the data could relate, Police Scotland took the view that an officer could potentially be identified were they to either confirm that relevant information was held, or to disclose that information.

37. On this basis, Police Scotland concluded that the information requested was personal data, as per the definition in section 3 of the DPA 2018 and Article 4 of the GDPR.

38. In the case of Breyer v Bundesrepublik Deutschland[3], the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified. When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is insignificant, the information will not be personal data.

39. Although this decision was made before the GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply. Recital (26) of the GDPR bears this out and confirms that data should be considered anonymous (and therefore no longer subject to the GDPR) when the data subject(s) is/are no longer identifiable.

40. The Commissioner's briefing on section 38 (Personal information)[4] provides that the two main elements of personal data are that the information must "relate to" a living person; and that person must be identified - or identifiable - from the data, or from the data and other information.

41. Information will "relate to" a person if it is about them, linked to them, has some biographical significance for them, is used to inform decisions affecting them, has them as its main focus or impacts them in any way.

42. An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals. There may be a slight hypothetical possibility that someone might be able to reconstruct the data in such a way that identifies the individual, but this is not necessarily sufficient to make the individual identifiable.

43. The Commissioner has considered Police Scotland's submissions. He is not satisfied that he has been provided with sufficiently compelling arguments to conclude that disclosure would lead to the identification of individuals.

44. Police Scotland argued that disclosure of low numbers could result in identification, referencing the pool of officers this could relate to in support of their position. Having considered this ratio, the Commissioner is unclear as to how disclosure could directly lead to the identification of the individuals involved. Without any further knowledge, the Commissioner considers that only a guess could be made.

45. In this case, the Commissioner considers Police Scotland's submissions on the potential to identify an individual to be somewhat hypothetical and without substance, particularly when taking account that the Applicant's request did not seek any further details (e.g. the specific circumstances of each offence, or the actual sexual orientation of the victims), only the actual number of offences.

46. The Commissioner has given regard to the information covering full years, the victims being police officers and the area in which the crimes were reported. The information lists numbers only and is in no sense biographical in the format in which it is presented. The Commissioner notes it is well known that, by the very nature of their roles, police officers are more susceptible to being the victims of various crime types, including but not limited to assault, hate crimes and breach of the peace. The commission of a homophobic hate crime will not necessarily bear any relation to the sexual orientation (or, for that matter, any other particular characteristics) of the victim.

47. The Commissioner also notes that, by withholding the information under an exemption in FOISA, Police Scotland have effectively confirmed that at least one police officer in the area in question was the victim of such a crime in each of the years stated. Having considered this, he is not satisfied that there is a realistic possibility that disclosure of the withheld information would make a further meaningful contribution to identification of the individuals concerned. Individuals may be able to confirm that they, or those close to them, are one of those victims, but they will know that anyway: disclosure the withheld information will not contribute further to identifying the individuals concerned.

48. In this case, therefore, taking account of all the circumstances, the Commissioner is not persuaded that there is a realistic prospect of individuals being identified from disclosure of the information in question. Having taken account of the arguments presented by both parties, he is of the view that the risk of identification is insignificant and, consequently, that the information is not personal data.

49. As the Commissioner is not satisfied that this information is personal data, he must find that Police Scotland were not entitled to withhold the information under section 38(1)(b) of FOISA.

50. The Commissioner therefore requires Police Scotland to disclose the information to the Applicant.

Decision

The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. Police Scotland wrongly withheld information under section 38(1)(b) on the basis that it was personal data, thereby failing to comply with section 1(1).

The Commissioner therefore requires Police Scotland to provide the Applicant with the information withheld by 25 November 2019.

Appeal

Should either the Applicant or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If Police Scotland fail to comply with this decision, the Commissioner has the right to certify to the Court of Session that Police Scotland have failed to comply. The Court has the right to inquire into the matter and may deal with Police Scotland as if they had committed a contempt of court.

Margaret Keyse

10 October 2019

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

…

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the Applicant a refusal notice by virtue of this section.

(2) Neither paragraph (a) of subsection (1) of section 16 nor subsection (2) of that section applies as respects a refusal notice given by virtue of this section.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(5) In this section-

"personal data" …[has] the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

…

---