Decision Notice 160/2020: Complaint Investigation Report
Public authority: Scottish Borders Council
Case Ref: 201901242
Summary
The Council was asked about a complaint investigation. The Council disclosed some information, but withheld other information under a number of exemptions.
The Commissioner investigated and found that the Council had partially breached FOISA in responding to the request. While, by the end of the investigation, the Commissioner found that the Council had correctly withheld some information, he also found that the Council had failed to identify all relevant information until his investigation had started and had failed to provide adequate advice and assistance.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 15 (Duty to provide advice and assistance); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "the GDPR", "personal data" and "processing") and (5A) (Personal information)
General Data Protection Regulation (the GDPR) articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 17 February 2019, the Applicant made a request for information to Scottish Borders Council (the Council) in relation to a specified investigation. The information requested was:
copies of all documents relating to the original and any follow-up investigation undertaken by [the Senior Business Services Officer] or any other member of SBC staff, including memos, reviews, reports (interim or draft), correspondence, minutes of meetings, records of telephone calls, interviews and conversations, and any other pertinent data.
2. The Council responded on 1 March 2019. It withheld the information requested, arguing it was exempt under sections 26(a) (Prohibitions on disclosure) and 38(1)(b)(Personal information) of FOISA.
3. On 23 March 2019, the Applicant wrote to the Council, requesting a review of its decision on the basis that she did not consider its reasons for refusal to be valid.
4. The Council notified the Applicant of the outcome of its review on 19 April 2019. The Council provided the Applicant with some information, i.e. a summarised version of events redacted to remove any personal data (section 38(1)(b of FOISA). It identified the principal document it was withholding (a complaint investigation report) and upheld its original decision to withhold the information, but adding that section 30(c) (Prejudice to effective conduct of public affairs) of FOISA also applied to that information.
5. On 23 July 2019, the Applicant wrote to the Commissioner. The Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA. The Applicant stated she was dissatisfied with the outcome of the Council's review because she did not believe the Council's "blanket refusal" was valid under the legislation quoted in its response.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 6 August 2019, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant. The Council provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. These related to the searches carried out to identify and locate any information falling within the scope of the request, and the Council's reasons for relying on sections 26(a), 38(1)(b) and 30(c) of FOISA to withhold information.
9. As the Council had withheld some information under an exemption which is subject to the public interest test (section 30(c)), the Applicant was also invited to provide submissions on the public interest in disclosure of the information. The Applicant provided submissions to the Commissioner. The Council provided submissions to the Commissioner. On 17 December 2019, the Council informed the investigating officer that further information falling within the scope of the request had been identified. This information comprised emails, which the Council disclosed to the Applicant with some redactions applied, relying on section 38(1)(b) of FOISA.
10. On 16 January 2020 the Council informed the investigating officer that a further document falling within the scope of the request had been located. The Council submitted that this further document was exempt in terms of section 30(c) of FOISA.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.
Information held
12. Under section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received.
13. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
14. In order to ascertain whether all relevant information had been identified, the Council was asked to explain the steps it took to establish what relevant information it held and which fell within the scope of the Applicant's request.
15. In its submissions to the Commissioner, the Council explained the searches it had undertaken, to identify the information falling within the scope of the Applicant's request. It provided details of the staff involved, the places searched and the search terms used.
16. In its initial submissions to the Commissioner, the Council provided no evidence of the searches and their outcomes. The Council was asked to provide evidence of the searches it carried out. In the course of this process, further searches were carried out and further information, falling within the scope of the request, was identified by the Council. As indicated above, further information was disclosed by the Council (although elements were withheld).
17. Having considered all relevant submissions and the terms of the request, the Commissioner is satisfied that the Council, by the end of the investigation, took adequate, proportionate steps in the circumstances to establish what information it held that fell within the scope of the request. He is satisfied that the searches described by the Council would have been capable of identifying any information held and relevant to the request.
18. However, the Council failed to identify and locate all relevant information in its initial response or review outcome. By only identifying some information falling within the scope of the request after his investigation had started, the Commissioner finds that the Council failed to comply with section 1(1) of FOISA.
Withheld Information
19. The Council is withholding a complaint investigation report dated 1 August 2017 and notes of meetings with staff. The Council has also redacted information it considers to be personal data from email correspondence disclosed to the Applicant.
Section 30(c) - prejudice to effective conduct of public affairs
20. The Council applied section 30(c) to some of the withheld information.
21. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs". The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
22. The prejudice requires to be substantial and the exemption, if engaged, is subject to the public interest test in section 2 (1) (b) of FOISA.
Submissions from the Council
23. The Council argued that the complaints process provides an essential check on the effective operation of its services. It explained that, in order to carry out a review, staff and service users are interviewed in detail, and any file notes or correspondence are interrogated by the investigating officer.
24. The Council submitted that releasing details of an investigation of this nature might undermine the confidence of those involved in delivering and receiving the service. The Council argued that internal complaint processes need to take place in a safe environment, to ensure open and honest participation by the parties involved.
25. The Council also considered it had a duty of care to its staff. It argued that complaints investigations would be irreparably damaged if individuals did not feel they were in an environment that allowed full and candid discussion of what had occurred, without the likelihood of this being provided to third parties (in the case of FOISA, disclosed into the public domain).
Submissions from the Applicant
26. The Applicant submitted that an investigation process that is not transparent in approach fails in its purpose. She stated that such an investigation process would deter staff from reporting concerns within their work environment, rather than encouraging them to do so.
The Commissioner's findings on section 30(c)
27. Having considered the nature and content of the withheld information, together with the Council's submissions, the Commissioner accepts that disclosure of the withheld information would be likely to cause substantial prejudice to the effective conduct of public affairs, both to staff and service user's confidence, and (in consequence), to the level of candour offered during complaint investigations.
Public Interest - section 30(c)
28. As mentioned above, the exemption in section 30(c) is subject to the public interest test in section 2(1)(b) of FOISA. The Commissioner must therefore go on to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by that in maintaining the exemption.
Submissions from the Council
29. The Council argued that it is in the interest of the public to receive the best level of service from the Council. In order to achieve this level of service, it is vital that any problems that arise following a complaint are able to be discussed candidly and openly in order that failings can quickly be identified and remedial measures implemented.
30. It argued that this interest outweighs the public interest in complaint investigation reports - as opposed to the conclusions of the investigation - being provided to individual complainers under FOISA (and hence into the public domain) as to do so would undermine the internal investigation procedure, meaning that problems may not be as readily identified, resulting in a diminution of services and thus damaging the public interest.
Submissions from the Applicant
31. The Applicant submitted that the matter in this case was of serious concern and benefited the public by raising concerns relating to professional conduct and accountability towards vulnerable people. The Applicant commented that there was a significant ageing population in the Scottish Borders and it was important that health care professionals treat sick, elderly people with respect and consideration.
32. The Applicant thought the public interest was not served by the Council withholding information and that, by failing to report openly and be seen to hold its social workers accountable, the Council could be faulted for condoning unacceptable working practices.
The Commissioner's findings on the public interest
33. The Commissioner agrees that there is always a general public interest in openness and accountability, particularly in areas involving the care of vulnerable members of society. Openness and accountability allow effective scrutiny and reassure the public where appropriate.
34. On the other hand, the Commissioner has already acknowledged the risk of substantial prejudice to the effective conduct of public affairs in this case, with particular reference to the effect of disclosure on the open engagement of staff in the investigation process and thereby the value of these investigations.
35. In all the circumstances, the Commissioner is satisfied that the public interest in disclosure is outweighed by that in maintaining the exemption and allowing the information to be withheld under section 30(c) of FOISA. The Council was therefore entitled to withhold the information under this exemption.
Section 15 - duty to provide advice and assistance
39. Section 15(1) of FOISA requires a Scottish public authority, so far as is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to make, or has made, a request to it. Section 15(2) states that a Scottish public authority shall be taken to have complied with this duty where (in relation to the provision of advice and assistance in a particular case) it conforms with the Scottish Ministers' Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004 (the Section 60 Code[1] ).
40. The Section 60 Code states, at paragraph 5.1.1 in Part 2:
Authorities have a duty to provide advice and assistance at all stages of a request. It can be given before a request is made, or to clarify what information an applicant wants after a request has been made, whilst an authority is handling a request, or after it has responded.
41. During the Commissioner's investigation, it became clear that the Applicant considered that there was further information that the Council should hold in relation to her request. The original request for information was quite far reaching and open, but the Applicant had firm beliefs as to what the Council should hold.
42. The Commissioner recognises that there can often be a difference between the information an applicant considers a public authority should hold, and that it does hold at the time the request is received. That being said, it can be helpful to the Applicant to understand the absence of material they expect to be there, if an explanation can be provided by the public authority as to why this is the case.
43. It became apparent to the Commissioner during this investigation that the Applicant believed the Council should have correspondence from a particular member of staff, and also notes had been made by a member of staff on medical records.
44. The Commissioner considers the Council could have provided the Applicant with advice and assistance in relation to both of these matters. With regard to the correspondence, information on its retention policy for email accounts of staff that have left the organisation might have assisted the Applicant, as might information on access to medical records.
45. By failing to provide this, the Commissioner is of the view that the Council failed to provide adequate advice and assistance to allow the Applicant to understand the Council's position.
46. The Commissioner therefore concludes that the Council failed to comply with its duty under section 15(1) of FOISA to provide advice and assistance to the Applicant.
47. This advice and assistance was, however, provided to the Applicant by the conclusion of the Commissioner's investigation.
Section 38(1)(b) - personal information
48. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR or (where relevant) in the DPA 2018.
49. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
50. In order to rely on this exemption, the Council must show that the information being withheld is personal data in terms of section 3(2) of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.
51. In her submissions to the Commissioner, the Applicant did not accept that this information should be withheld.
Is the withheld information personal data?
52. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 - see Appendix 1.
53. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting then or has them as its main focus. The Council considered the redacted information in the emails constituted personal data as living individuals could be identified from that information.
54. Having considered the Council's submissions, the Commissioner accepts that individuals could be identified if the information was disclosed. He is also clear that the information would relate to those persons. The Commissioner is therefore satisfied that the withheld information is personal data as defined in section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
55. The Council submitted that it would be unfair to disclose the information as disclosure would breach the first data protection principle in Article 5(1) of the GDPR.
56. Article 5(1)(a) of the GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject".
57. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". For the purposes of FOISA, personal data are processed when disclosed in response to a request. This means that the personal data can only be disclosed if disclosure would be both lawful (i.e. it would meet one of the conditions for lawful processing listed in Article 6(1) of the GDPR) and fair.
58. The Commissioner considers condition (f) in Article 6(1) to be the only condition which could potentially apply in the circumstances of this case.
Condition (f): legitimate interests
62. Condition (f) states that processing will be lawful if it "… is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data…"
63. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests made under FOISA.
64. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the Applicant have a legitimate interest in obtaining the personal data?
65. The Applicant submitted that the information related to her concerns about the professional attitude and conduct of members of staff working with vulnerable members of society. The Applicant's view is that it is detrimental to the public if such complaints are not openly and honestly addressed.
66. The Council did not consider the Applicant had a legitimate interest in obtaining the information. The Council did not dispute the Applicant's right to full details of the decision reached by the Council in relation to her complaint and the reasons for this, but did not consider this resulted in a legitimate interest in the withheld information.
67. Having considered the submissions from the Applicant and the Council, the Commissioner is satisfied that the Applicant does have a legitimate interest in disclosure of the personal data. The Applicant is interested in the detail of how the investigation into her complaint was carried out. The Applicant has an obvious interest in the sense that she is seeking information in respect of her own complaint. The Commissioner has accepted the Applicant's view that disclosure of the information would allow her, and the public at large, to understand how the Council addresses complaints about the standard of professional behaviour of staff to vulnerable members of society.
Is disclosure of the personal data necessary?
68. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of the personal data is necessary for the Applicant's legitimate interests. In doing so, he must consider whether these interests might be reasonably met by any alternative means. As the Council did not consider the Applicant had a legitimate interest in the withheld information, it did not go on to consider whether disclosure was necessary.
69. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether disclosure is proportionate as a means and fairly balanced as to aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subjects.
70. Prior to the request, the Council had already disclosed the conclusions of the investigation it undertook into the Applicant's concerns, in addition to the (redacted) timeline of outcomes and actions disclosed in response to the request for review. It had also provided the Applicant with details of how to escalate her concerns with the Scottish Public Services Ombudsman if she did not feel the Council had investigated her complaint appropriately. The Commissioner recognises that all of this goes some way towards satisfying the Applicant's legitimate interests, including the provision of a route the Applicant can follow if she is not satisfied with how the Council investigated her complaint. However, the Commissioner accepts that the withheld information is necessary to allow her to understand and assess fully how the investigation into her complaint was conducted.
71. Although the Applicant can, to an extent, assess the Council's investigation of her complaint from the redacted information she has received from the Council, the Commissioner can identify no viable means of meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects than providing the withheld personal data. The Commissioner will now consider whether the Applicant's legitimate interest in obtaining the withheld information outweighs the rights of the data subjects to privacy.
Interests and fundamental freedoms of the data subjects
72. It is necessary to balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subjects would not reasonably expect the information would be disclosed to the public in response to the request, or if such a disclosure would cause unjustified harm, their interests or rights are likely to override legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle
73. The Commissioner's guidance on section 38 of FOISA[2] notes factors that should be taken into account in balancing the interests of parties. He makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);
(ii) the potential harm or distress that may be caused by the disclosure;
(iii) whether the individual objected to the disclosure.
74. In considering the balance between the legitimate interests and the rights and interests of the data subjects, it is important to take account of whether the proposed disclosure would be within the reasonable expectations of those individuals. There are factors that assist in this determination, including the distinction between private and public life; the nature of the information; how the personal data was obtained; whether any specific assurances were given to individuals; privacy notices; and any policy or standard practice of the authority.
75. The Commissioner considers that the withheld information relates to the data subjects' public life, i.e. their work, but that the data subjects had no expectation in the circumstances that their personal data would be disclosed into the public domain.
76. The Commissioner has also considered the harm or distress that may be caused by disclosure. The Commissioner acknowledges that one of the data subjects expressed a view that they did not consent to their personal data being disclosed.
77. After carefully balancing the legitimate interests of the individuals concerned against those of the Applicant, the Commissioner finds that the legitimate interests served by disclosure of the personal data are outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subjects. Condition (f) in Article 6(1) of the GDPR cannot, therefore, be met in relation to the withheld personal data.
78. In the absence of a condition in Article 6 of the GDPR allowing personal data to be disclosed, the Commissioner has concluded that disclosing the information would be unlawful.
Fairness
79. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider separately whether disclosure would otherwise be fair and transparent in relation to the data subject.
Conclusion on section 38(1)(b)
80. For the reasons set out above, the Commissioner is satisfied that disclosure of the personal data would breach the data protection principle in Article 5(1)(a) of the GDPR. Consequently, he is satisfied that the personal data were correctly withheld under section 38(1)(b) of FOISA.
Section 26(a) of FOISA
81. As the Commissioner has accepted that section 30(c) and section 38(1)(b) were correctly applied in this case, he will not go on to consider whether information was also exempt from disclosure under section 26(a) of FOISA.
Decision
The Commissioner finds that Scottish Borders Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds the Council was correct to withhold information falling within the scope of the request under sections 30(c) and 38(1)(b) of FOISA.
However, the Commissioner also finds that the Council failed to comply with Part 1 of FOISA:
i) by only identifying some information falling within the scope of the request after his investigation had started, in breach of section 1(1); and
ii) by failing to provide sufficient advice and assistance to allow the Applicant to fully understand the responses she received, in breach of section 15(1).
Given that, by the end of the investigation, the Council had:
i) identified all of the information falling within the scope of the request, and
ii) provided the Applicant with adequate advice and assistance
the Commissioner does not require the Council to take any action in respect of these failures, in response to the Applicant's application.
Appeal
Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
9 December 2020
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
…
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
…
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).
…
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
…
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);
…
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available.
…
(5) "Data subject" means the identified or identifiable living individual to whom the data relates.
…
(10) "The GDPR" means Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regards to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
…
