Decision 152/2018: Identity of Counsel who supplied legal opinions
Public authority: Chief Constable of the Police Service of Scotland
Reference No: 201800808
Summary
Police Scotland were asked for a range of information about legal advice they had received.
They disclosed some information (including legal advice), but withheld the name of the advocate who provided the advice. Following a review, Mr Cherbi remained dissatisfied and applied to the Commissioner for a decision.
The Commissioner investigated and found that Police Scotland had correctly withheld this information. He also found that Police Scotland had not responded to Mr Cherbi's review requirement within the required 20 working days, but did not require Police Scotland to take any action.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 21(1) Review by a Scottish public authority; 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA 1998) sections 1(1) (Basic interpretative provision) (definition of personal data); Schedules 1 (The data protection principles, Part 1 - the principles) (the first data protection principle)
Data Protection Act 2018 (the DPA 2018) Schedule 20 (Transitional provision etc. - paragraph 56(1), (3) and (4))
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 5 March 2018, Mr Cherbi made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). The information requested was:
- The identity of the law firms, Advocates stable & QC (names) who supplied opinions and numbers of opinions with regards to issues in relation to the Counter Corruption Unit of Police Scotland, and in particular with reference to DCC Fitzpatrick's statement "It is our position, supported by external and independent legal opinion from a QC, that our regulations would not have permitted Chief Constable Barton from carrying out both the complaint enquiry and the misconduct investigation."
- Information contained in the content of the opinions & legal advice.
- The cost of such external and independent legal opinion(s) in relation to this matter (totals) - and figures in terms of legal fees, faculty services fees, fees for the opinion itself and fees of the QC(s).
2. Police Scotland responded on 4 April 2018 and provided copies of the opinions with Counsel's name redacted as personal data under section 38(1)(b) of FOISA. They also provided information in respect of the fees paid.
3. On 4 April 2018, Mr Cherbi wrote to Police Scotland requesting a review of their decision, as he believed the name should be disclosed as a matter of significant public interest.
4. Police Scotland notified Mr Cherbi of the outcome of their review on 10 May 2018. They upheld the initial decision to withhold the information under section 38(1)(b) of FOISA.
5. On 11 May 2018, Mr Cherbi wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Cherbi stated he was dissatisfied with the outcome of Police Scotland's review because the opinions had been paid for by public cash and therefore, in his view, the public had the right to know who provided them. Mr Cherbi was also unhappy that Police Scotland had not replied to his review requirement within 20 working days.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr Cherbi made a request for information to a Scottish public authority and asked the authority to review their response to that request before applying to him for a decision.
7. On 20 June 2018, Police Scotland were notified in writing that Mr Cherbi had made a valid application. Police Scotland were asked to send the Commissioner the information withheld from Mr Cherbi. Police Scotland provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application, with particular reference to their reliance on section 38(1)(b) of FOISA and the time taken to respond to Mr Cherbi's review requirement.
9. Mr Cherbi was also asked for, and provided, submissions on what he considered to be his legitimate interest in disclosure.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Cherbi and Police Scotland. He is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) of FOISA (Personal information)
11. Police Scotland withheld the information on the basis that it was exempt from disclosure under section 38(1)(b) of FOISA.
Data Protection Act 2018 (Transitional provisions)
12. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amended section 38 of FOISA and also introduced a set of transitional provisions which set out what should happen where a public authority dealt with an information request before FOISA was amended on 25 May 2018 (but where the matter is being considered by the Commissioner after that date).
13. In line with paragraph 56 of Schedule 20 to the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018 (as is the case here - the review outcome was issued on 10 May 2018), the Commissioner must consider the law as it was before 25 May 2018 when determining whether the authority dealt with the request in accordance with Part 1 of FOISA.
14. Paragraph 56 of Schedule 20 goes on to say that, if the Commissioner concludes that the request was not dealt with in accordance with Part 1 of FOISA (as it stood before 25 May 2018), he cannot require the authority to take steps which it would not be required to take in order to comply with Part 1 of FOISA on or after 25 May 2018.
15. The Commissioner will therefore consider whether Police Scotland were entitled to apply the exemption in section 38(1)(b) of FOISA under the old law. If he finds that Police Scotland were not entitled to withhold the information under the old law, he will only order them to disclose the information if disclosure would not now be contrary to the new law.
The exemption
16. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA 1998) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA 1998.
17. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
18. In order to rely on this exemption, Police Scotland must show that the information being withheld is personal data for the purposes of the DPA 1998 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA 1998. Police Scotland considered disclosure of the information would breach the first data protection principle.
Is the withheld information personal data?
19. Personal data" are defined in section 1(1) of the DPA 1998 as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).
20. Police Scotland submitted that the withheld information comprised personal data because it identified a living individual.
21. The Commissioner is satisfied that the information comprises the personal data of the individual concerned. The individual can be identified by the information (their name and the fact that their position as Counsel is already in the public domain). The information relates to them as an individual. It is therefore that individual's personal data, as defined by section 1(1) of the DPA.
Would disclosure of the personal data contravene the first data protection principle?
22. Police Scotland submitted that disclosure of the withheld personal data would breach the first data protection principle and stated that Counsel in question had actively objected to their name being disclosed into the public domain.
23. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA), at least one of the conditions in Schedule 3 to the DPA must also be met. The processing in this case would be making the information publicly available in response to Mr Cherbi's request.
24. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for him to consider the conditions in Schedule 3.
25. Condition 6 of Schedule 2 appears to be the only one which might be relevant to the withheld personal data. Condition 6 allows personal data to be processed where that processing is necessary for the purposes of a legitimate interest pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the person to whom the data relate).
26. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:
(i) Does Mr Cherbi have a legitimate interest or interests in obtaining the personal data?
(ii) If so, is the disclosure necessary to achieve these legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could the legitimate interests be achieved by means which interfere less with the privacy of the data subjects?
(iii) Even if the processing is necessary for Mr Cherbi's legitimate interests, would it nevertheless be unwarranted in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
27. Mr Cherbi submitted that there was a legitimate public interest and media interest in the identity of Counsel being disclosed, as the opinions had already been disclosed by Police Scotland and subsequently published by the Scottish Parliament.
28. He argued that given the nature of the opinions and their use in evidence to MSPs, there was a legitimate interest in disclosure, particularly as certain evidence, which included the use of the opinions, was "branded unbelievable" by MSPs on the Scottish Parliament's Justice Committee.
29. Mr Cherbi was of the view that the opinions were therefore in question, and there was a legitimate public interest in the identity of Counsel being disclosed, to check their credentials, and to allow the public and the media to question the validity of the opinion, and its basis in law for providing Police Scotland with legal advice, paid for from the public purse.
30. As a journalist, Mr Cherbi submitted, his own legitimate interest in disclosure derived from his continuing investigation of how actions of surveillance on journalists had and were being employed by Police Scotland.
31. Mr Cherbi submitted that it was therefore necessary for disclosure of the identity of Counsel, so that, should reporting require this, they could be approached for comment, that their identity could be submitted to the Scottish Parliament's Justice Committee, and that their service as a QC, and cases, experience or service to other public bodies, including Police-related entities could be considered and, if necessary, questioned in the light of the advice to Police Scotland.
Does Mr Cherbi have a legitimate interest and is disclosure of the names(s) of the QC(s) necessary to achieve that legitimate interest?
32. The Commissioner accepts that Mr Cherbi has a legitimate interest in continuing to investigate the story, as a journalist, and that there is a general public interest in accurate reporting of the matters in question. However, the Commissioner must still consider whether disclosure of the withheld name can be considered necessary for these purposes. In doing so, he must take account of the specific circumstances of each individual case.
33. In this case, Mr Cherbi already has access to the opinions and knows the costs involved in obtaining them. That information is in the public domain. With that in mind, the Commissioner must question how pursuing the legitimate interest can be said to be advanced any further by knowing who wrote the opinions: objectively, this can have no effect on their quality as finished pieces of work.
34. The Commissioner notes that Mr Cherbi states he needs the name so that Counsel can be approached for comment. Given the confidential nature of the lawyer/client relationship, it would appear inconceivable that Counsel would comment on his/her opinion, independently of the client.
35. Neither can the Commissioner envisage a Committee of the Scottish Parliament placing itself between a client and their chosen legal adviser, and interrogating the legal adviser to establish whether they were the right person to give that client particular advice: responsibility for regulating the conduct and competence of Counsel lies elsewhere - and if any person believes the advice in question is flawed, they can take the matter up with the appropriate regulatory body, for investigation within an appropriate procedural framework (which should not require immediate public exposure of the individual concerned).
36. While accepting that Mr Cherbi may, therefore, have a legitimate interest in investigating the story he has referred to, the Commissioner cannot - on the basis of the submissions he has received - accept that disclosure of Counsel's name would be necessary to advance that legitimate interest.
37. As the Commissioner has decided that disclosure of the name is not necessary to advance Mr Cherbi's legitimate interest, he has not gone on to consider whether disclosure would be unwarranted by reason of prejudice to the legitimate interests of the data subject.
38. In the circumstances, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of Counsel's name, in this case, would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) by Police Scotland under section 38(1)(b) of FOISA. Having reached this conclusion, the Commissioner is not required to consider questions of disclosure under current data protection legislation.
Timescales
39. Section 21(1) of FOISA gives authorities a maximum of 20 working days after receipt of the requirement to comply with a requirement for review, subject to qualifications which are not relevant in this case.
40. It is a matter of fact that Police Scotland did not provide a response to Mr Cherbi's requirement for review within 20 working days, so the Commissioner finds that they failed to comply with section 21(1) of FOISA.
41. The Commissioner notes that Police Scotland, in their review outcome, apologised for the delay.
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Cherbi.
The Commissioner finds that by withholding the identity of Counsel under section 38(1(b) of FOISA, Police Scotland complied with Part 1.
However, Police Scotland failed to comply with Part 1 by not responding to Mr Cherbi's review requirement within the timescale laid down in section 21(1) of FOISA, 20 working days.
Given that the review requirement was subsequently complied with, the Commissioner does not require Police Scotland to take any action in respect of this failure, in response to Mr Cherbi's application.
Appeal
Should either Mr Cherbi or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
3 October 2018
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
…
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
…
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
…
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
…
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
…
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
…
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
…
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
Data Protection Act 2018
Schedule 2 - Transitional provision etc
56 Freedom of Information (Scotland) Act 2002
(1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 ("the 2002 Act") before the relevant time.
…
(3) To the extent that the request was dealt with before the relevant time -
(a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act as amended by Schedule 19 to this Act, but
(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.
(4) In this paragraph -
"Scottish public authority" has the same meaning as in the 2002 Act;
"the relevant time" means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.
