|
Decision 163/2015: Mr P and Borders Health Board
Personal data
Reference No: 201501218
Decision Date: 21 October 2015
Summary
On 23 February 2015, Mr P asked Borders Health Board (NHS Borders) for information relating to his treatment.
NHS Borders provided Mr P with some information, informing him that other information had been routinely destroyed. NHS Borders withheld some information, either because it believed it to be legally privileged or because it was Mr P's own personal data. It explained that the personal data could be requested under the DPA. Following a review, Mr P remained dissatisfied and applied to the Commissioner for a decision.
During the Commissioner's investigation, NHS Borders recognised that the information requested was Mr P's personal data and therefore exempt from disclosure under FOISA. It also acknowledged that some of the withheld information did not actually fall within the scope of Mr P's request.
The Commissioner was satisfied that this approach was appropriate in the circumstances. She found that NHS Borders should have considered the scope of the request more carefully before responding to Mr P and (with a view to providing Mr P with reasonable, relevant advice and assistance) considered more carefully the implications of the information being his personal data.
Given NHS Borders' responses during the investigation, she did not require it to take any action in this case.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(i) (Effect of Exemptions); 15(1) (Duty to provide advice and assistance); 38(1)(a) (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data")
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 23 February 2015, Mr P made a request for information to NHS Borders. The information requested covered the period from 8 July 1999 to 1 February 2015. For that period, he sought all information held by NHS Borders in connection with his treatment, to include all correspondence with various specified persons and bodies. He also included information on bed availability on a specific date. If some of the information was considered to be his personal data, Mr P asked NHS Borders to consider his request under the DPA in addition.
2. NHS Borders responded on 17 March 2015:
(i) It provided information, including information previously disclosed to Mr P. It withheld some information (which it considered to be the subject of legal professional privilege) under section 36(1) of FOISA.
(ii) It informed Mr P that some information, dating from prior to 2007, was no longer held, having been destroyed in line with its Records Management Policy.
(iii) Regarding information considered to be Mr P's own personal data, NHS Borders notified him that this was being withheld under section 38(1)(a) of FOISA. It explained that it could be requested via a subject access request under the DPA.
(iv) NHS Borders provided Mr P with information pertaining to bed availability.
3. NHS Borders issued Mr P with a further response on 2 April 2015, confirming that it did not hold correspondence with one of the bodies listed in his request.
4. On 27 April 2015, Mr P wrote to NHS Borders requesting a review of its decision. He challenged NHS Borders' decision to withhold information under section 36(1) and sought clarification on a number of points arising out of NHS Borders' initial response.
5. NHS Borders notified Mr P of the outcome of its review on 20 May 2015, upholding its original decision to withhold information under section 36(1) of FOISA (although it did not appear to consider this information to relate to his treatment). It also provided responses to the other points raised by Mr P.
6. On 30 June 2015, Mr P wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. Mr P stated he was dissatisfied with the outcome of NHS Borders' review. He disagreed with the application of section 36(1) and believed the information should be disclosed in the public interest.
Investigation
7. The application was accepted as valid. The Commissioner confirmed that Mr P made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
8. On 2 July 2015, NHS Borders was notified in writing that Mr P had made a valid application. The case was allocated to an investigating officer and NHS Borders was asked to send the Commissioner the information withheld from Mr P. This was provided. Later, clarification was sought and obtained regarding the precise information being withheld from Mr P.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Borders was informed of the scope of the investigation and was invited to comment. In particular, NHS Borders was asked to provide detailed submissions justifying its reliance on section 36(1) of FOISA. These were provided.
10. Taking into account the terms of the request, it became apparent that anything falling within the scope of the request would be Mr P's own personal data and therefore exempt under section 38(1)(a). NHS Borders acknowledged this, and also that not all of the information withheld under section 36(1) of FOISA fell within the scope of the request.
11. Mr P also provided submissions during the investigation. Information was disclosed to him during the investigation, but under the DPA rather than FOISA.
Commissioner's analysis and findings
12. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr P and NHS Borders. She is satisfied that no matter of relevance has been overlooked.
Interpretation and scope of request
13. NHS Borders described the searches undertaken for correspondence (specifically with its legal representatives), describing the electronic and paper records searched, the nature of the searches and the search terms used. It provided supporting evidence of these.
14. Shortly after providing these submissions, however, NHS Borders acknowledged that these searches had identified information which, on a reasonable interpretation, did not fall within the scope of the request. This followed further consideration of the withheld information by the investigating officer, along with the terms of the request. The information in question related to the handling of Mr P's subsequent claim against NHS Borders, with no actual reference to his treatment: the request was quite clearly about his treatment.
15. It is important that public authorities do not interpret requests for information unduly restrictively. On the other hand, it is important that they interpret them accurately, with a view to providing the applicant with what he or she is actually seeking. If this is not clear, the authority has the opportunity to seek clarification from the applicant, in line with section 1(3) of FOISA: NHS Borders does not appear to have found this necessary in Mr P's case.
16. In fact, NHS Borders appears to have focused on Mr P's reference to "correspondence" (which he stated his request should include), rather than what appears to the Commissioner to have been the clear focus of the request - his treatment. It also appears to have assumed that his request was focused on his claim rather than his treatment, which does not appear to be borne out by a straightforward reading of its terms.
17. In fact, the Commissioner is satisfied from NHS Borders' submissions that its searches were broad enough to capture any information held by the authority and falling within the scope of his request. Unfortunately, they were too broad and captured information which related purely to the handling of the claim rather than to Mr P's treatment - information which did not fall within the scope of the request.
18. In this case, NHS Borders' approach does not appear to have prejudiced Mr P in his search for information, although undoubtedly it led to confusion in the handling of his request and the conduct of the Commissioner's investigation (which will be considered further below). However, searches for information must proceed on the basis of a full, considered understanding of the scope of the request if they are to offer a reasonable prospect of capturing the information the applicant is seeking. In addition, the provision of irrelevant information can prove highly frustrating to applicants.
19. In this case, the Commissioner must find that NHS Borders failed to take reasonable steps to determine the scope of the request, before going on to identify and locate the requested information and consider whether it could be disclosed. In this respect, it failed to comply fully with section 1(1) of FOISA.
20. The Commissioner would also question whether NHS Borders took the time to understand the information it had identified fully. In the review outcome, it stated that none of the withheld documents contained personal information relating to Mr P's treatment, a statement which does not really make sense in the context of the request Mr P made - and also one it later acknowledged was inaccurate.
21. As indicated above, NHS Borders acknowledged during the investigation that the remaining withheld information (i.e. that captured by the request) was Mr P's own personal data. The Commissioner will now consider this point further.
Section 38(1)(a) of FOISA - Personal information
22. Where information is the personal data of the applicant, that information is exempt from disclosure under section 38(1)(a) of FOISA. The Commissioner is satisfied that this applies to all of the information NHS Borders continued to withhold under FOISA and which fell within the scope Mr P's request.
23. The definition of personal data in section 1(1) of the DPA is set out in Appendix 1. Mr P could be identified from the remaining withheld information. In relating to his medical treatment, it could be said to relate to him. Indeed, the Commissioner is satisfied that this follows by necessary implication from the terms of the request: any information relating to his treatment would, by definition, be his personal data.
24. The Commissioner is therefore satisfied that NHS Borders was entitled to withhold the remaining withheld information under section 38(1)(a) of FOISA. This exemption is absolute and so is not subject to the public interest test. Having concluded that this exemption applied, the Commissioner does not consider it necessary to go on to determine whether the information could also have been withheld under section 36(1) of FOISA.
25. As Mr P's personal data, the information will be subject to the subject access rights under section 7 of the DPA: it is not for the Commissioner to comment on whether this information will in fact be accessible to Mr P under that regime, or whether it might be withheld under an exemption in the DPA.
Section 15 of FOSA - Duty to provide advice and assistance
26. Section 15(1) of FOISA requires a Scottish public authority, so far as it is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
27. In her briefing on the exemptions in section 38 of FOISA[1], the Commissioner notes (on page 7) that there is no specific provision for automatically going on to treat a request for the applicant's own personal data, properly exempted under section 38(1)(a), as a subject access request under the DPA. However, the briefing goes on to state her view that it will be good practice (under section 15) to consider any FOISA request for an individual's own personal data as a subject access request, going on to process it under the DPA.
28. This does not appear to have been NHS Borders' approach in Mr P's case. Insofar as his personal data was withheld in its initial response to his request, he was simply invited to make a subject access request. The review outcome made no attempt to modify this approach and, when information was disclosed to Mr P during the investigation, it remained unclear whether this was being done under FOISA or the DPA. Only when prompted by the investigating officer did NHS Borders make it clear that the disclosure was under the DPA.
29. In all the circumstances, therefore, the Commissioner is not satisfied that NHS Borders met its duty under section 15(1) of FOISA in handling Mr P's personal data in response to his information request.
|
Decision
The Commissioner finds that Borders Health Board (NHS Borders) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr P.
In failing to take reasonable steps to determine the scope of the request, NHS Borders failed to comply with section 1(1) of FOISA.
In failing to address fully the implications of the withheld information being Mr P's own personal data (and going on to respond as if Mr P had made a subject access request under the Data Protection Act 1998), NHS Borders failed to comply with section 15(1) of FOISA.
Given the steps taken by NHS Borders during the investigation, the Commissioner does not require NHS Borders to take any action in respect of these failures, in response to Mr P's application.
|
Appeal
Should either Mr P or NHS Borders wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
21 October 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
(i) paragraphs (a), (c) and (d); and
?
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
?
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
[1]
