Decision 167/2018: Number of Registered Sex Offenders housed in multi-storey flats in Glasgow

Public authority: Chief Constable of the Police Service of Scotland
Reference No: 201800969

Summary

Police Scotland were asked for the numbers of Registered Sex Offenders housed in multi-storey flats in the Glasgow City Council area.

Police Scotland refused to provide the information, considering it to be sensitive personal data and arguing that its disclosure would prejudice substantially the prevention or detection of crime and be likely to endanger the safety of individuals.

The Commissioner investigated and found that Police Scotland were not entitled to withhold the information under the exemptions claimed, and had failed to respond to the request for information in accordance with FOISA. The Commissioner required Police Scotland to disclose the information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 35(1)(a) (Law enforcement); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information); 39(1) (Health, safety and the environment)

Data Protection Act 1998 (the DPA 1998) sections 1(1) (Basic interpretative provision) (definition of "personal data")

Data Protection Act 2018 (the DPA 2018) Schedule 20 (Transitional provision etc - paragraph 56)

General Data Protection Regulation (the GDPR) Article 4 (Definitions) (definition of "personal data")

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 21 July 2017, Mr Howarth made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). He asked for the number of Registered Sex Offenders (RSOs) in the Glasgow City Council area with a registered address in multi-storey flats.

2. Police Scotland sought clarification on 9 August 2017. In particular, they asked Mr Howarth to clarify what he meant by multi-storey flats.

3. On 4 September 2017, Mr Howarth wrote to Police Scotland and referred to the following definition of a multi-storey flat, "five storeys or more with a lift". In this email, Mr Howarth noted that he was trying to get a comprehensive list of addresses for such multi-storey flats in Glasgow, and he asked whether the definition alone was sufficient for Police Scotland to process his information request.

4. Police Scotland responded to Mr Howarth's email on 6 September 2017. In their response, they stated that they would need to ask him to provide the addresses of the multi-storey blocks he was interested in. Police Scotland advised Mr Howarth that, if he provided the addresses, the request would be passed to the relevant department for consideration.

5. On 30 January 2018, Mr Howarth provided Police Scotland with a list of addresses of around 130 blocks of multi-storey flats in Glasgow.

6. Police Scotland responded to Mr Howarth's request for information on 22 March 2018. They apologised for the delay in responding and notified Mr Howarth that they were withholding the information under section 35(1)(a) (Law enforcement); 38(1)(b) (Personal information) and section 39(1) (Health, safety and the environment) of FOISA.

7. On 26 March 2018, Mr Howarth wrote to Police Scotland requesting a review of their decision. He argued that it would be impossible to identify any individual from the data he had requested and that the threshold for the exemption under section 39(1) had not been met.

8. Police Scotland notified Mr Howarth of the outcome of their review on 24 April 2018. They upheld their original decision in full and provided him with more explanation of why they considered the exemptions applied.

9. On 5 June 2018, Mr Howarth applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of Police Scotland's review because (in his view) they appeared to have rewritten his request in a way that changed its scope. Mr Howarth also disagreed with Police Scotland's application of exemptions.

Investigation

10. The application was accepted as valid. The Commissioner confirmed that Mr Howarth made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

11. On 31 July 2018, Police Scotland were notified in writing that Mr Howarth had made a valid application and the case was allocated to an investigating officer.

12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions including justifying their reliance on any provisions of FOISA they considered applicable to the information requested. Police Scotland were also asked to provide the investigating officer with the withheld information.

Commissioner's analysis and findings

13. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Howarth and Police Scotland. He is satisfied that no matter of relevance has been overlooked.

Withheld information

14. In his application to the Commissioner, Mr Howarth alleged that Police Scotland had not only misunderstood his request for information, but, in their review outcome, had rewritten his request as seeking "The numbered of registered sex offenders in the Glasgow City Council area with a registered address in specified multi-storey flats". Mr Howarth argued that the addition of the single word "specified" appears to material and fundamentally change the scope of his request so that "it fits Police Scotland's misapprehension".

15. In their submissions to the Commissioner, Police Scotland stated that they had always understood that Mr Howarth was seeking a global figure for the total number of RSOs living in multi-storey flats across Glasgow. They confirmed that they understood that Mr Howarth did not want to know which specific multi-storey flats housed RSOs. Police Scotland submitted that reference to the word "specified" in their review outcome was in relation to the specific addresses supplied by Mr Howarth following communication to clarify his definition of a multi-storey property.

16. The Commissioner notes the comments by both Mr Howarth and Police Scotland. He considers that the information requested by Mr Howarth is that contained in his email of 31 July 2017.

17. To summarise, the withheld information in this case comprises the overall number of RSOs who are resident in the addresses listed by Mr Howarth. The addresses provided by Mr Howarth are those of multi-storey blocks in the Glasgow City Council area.

Section 38(1)(b) - Personal information

18. Police Scotland withheld the information on the basis that it was exempt from disclosure under section 38(1)(b) of FOISA.

Data Protection Act 2018 (Transitional provisions)

19. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amended section 38 of FOISA and also introduced a set of transitional provisions which set out what should happen where a public authority dealt with an information request before FOISA was amended on 25 May 2018, but where the matter is being considered by the Commissioner after that date.

20. In line with paragraph 56 of Schedule 20 to the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018 (as is the case here - the review response was issued on 22 May 2018), the Commissioner must consider the law as it was before 25 May 2018 when determining whether the authority dealt with the request in accordance with Part 1 of FOISA.

21. Paragraph 56 of Schedule 20 goes on to say that, if the Commissioner concludes that the request was not dealt with in accordance with Part 1 of FOISA (as it stood before 25 May 2018), he cannot require the authority to take steps which it would not be required to take in order to comply with Part 1 of FOISA on or after 25 May 2018.

22. The Commissioner will therefore consider whether Police Scotland were entitled to apply the exemption in section 38(1)(b) of FOISA under the old law. If he finds that Police Scotland were not entitled to withhold the information under the old law, he will only order Police Scotland to disclose the information if disclosure would not now be contrary to the new law.

The exemption

23. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA 1998) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA 1998.

24. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

25. In order to rely on this exemption, Police Scotland must show that the information being withheld is personal data for the purposes of the DPA 1998 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA 1998. Police Scotland considered disclosure of the information would breach the first data protection principle.

Is the withheld information personal data?

26. "Personal data" are defined in section 1(1) of the DPA 1998 as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

27. Police Scotland submitted that, due to the low numbers involved relating to a specific address and the condensed community of a multi-story flat, they were unable to disclose the requested information as it might identify specific individuals.

Mr Howarth's views

28. Mr Howarth did not accept that the information he had requested was personal data. He referred to statistics he had obtained from the Scottish Housing Regulator, which indicated that in 2016/17 there were 16,988 high rise apartments in the Glasgow area. He also referred to data he had obtained from the National Records of Scotland, which indicated that the average household size in Glasgow in 2017 was 2.08. Based on these figures, Mr Howarth estimated that the number of individuals living at the addresses he had provided would be around 35,000.

29. Mr Howarth referred to a previous decision issued by the Commissioner, namely Decision 014/2009 Dunbritton Housing Association, Craigdale Housing Association and Blochairn Housing Association and the Chief Constable of Strathclyde Police [1]. In that particular case, the geographical areas in Glasgow for which RSO numbers were requested had populations ranging between 983 and 10,542. He argued that all of these postcode areas had populations smaller than that of the total Glasgow population living in multi-storey apartments.

30. Mr Howarth referred to data that was published in the wake of Decision 014/2009, which listed the highest ratio of RSOs per 1,000 population as 13.36 (in postcode area G2 7). Mr Howarth argued that this level of ratio was clearly deemed to fall within the upper limit of "safe".

31. Mr Howarth noted that, in April 2018, Police Scotland published information which stated that there were 610 RSOs living in Glasgow. He argued that, even if three-quarters of these RSOs were living in high rise accommodation (which in his view was highly improbable), the ratio would be about 13 per 1000 head of population, a ratio still lower than the 13.36 per 1000 figure at which numbers of RSOs were disclosed following Decision 014/2009. Mr Howarth also noted that the addresses he had listed covered 24 postcode areas, so they were geographically dispersed.

Police Scotland's views

32. Police Scotland noted that they regularly receive information requests asking for the number of RSOs residing in particular local postcode areas. They explained that, in all cases, a figure is provided if the population within a requested postcode area exceeds 1,000 persons, and an exemption is claimed if the population is below that number.

33. Police Scotland did not ratify or dispute the figures provided by Mr Howarth, but suggested that the figures were not relevant. They argued that a multi-storey building is essentially a micro-community. Based on Mr Howarth's estimated total population across all of the addresses he had listed, Police Scotland calculated that the average population of each block of flats would be about 169 persons. They argued that any information request that was seeking the number of RSOs in a similar sized population (169 persons) would be refused and an exemption would be applied.

34. Police Scotland explained that they had various concerns about Mr Howarth's information request. Mr Howarth had provided them with the list of addresses which were to be considered. They argued that he was capable of identifying and publishing the specific addresses across which the total figure provided would relate and that it was highly probably that he would publish the details of those specific addresses.

35. Police Scotland submitted that the addresses on the list were not isolated buildings: the majority were "grouped" within small geographical areas. They argued that each multi-storey property was essentially a micro-community within a small, highly concentrated area. Police Scotland noted that, while these properties may be spread across Glasgow, they could be considered an anonymous or generic list of addresses or regarded as a single community. They argued that any RSO resident within any of the addresses provided by Mr Howarth would readily be able to identify themselves were the addresses to be published.

36. Police Scotland noted that residents within each multi-storey property often have suspicions that an RSO resides in their building. Any publication of the addresses provided to Police Scotland by Mr Howarth risks increasing the anxiety of residents and potential hostility towards individuals already to be suspected to be RSOs, including innocent members of the public who have been subject to mistaken identity. Police Scotland acknowledged that it would be naïve to consider that community intelligence/tacit knowledge does not exist about RSOs, but argued that publication of such data is highly likely to result in local residents starting to undertake their own further research and to result in heightened fear and alarm.

37. Police Scotland noted that, while the figure requested by Mr Howarth was a total figure across the properties provided by him, the properties are often grouped together. They argued that Mr Howarth possesses details of each address and is highly likely to publish them. If this happened, Police Scotland submitted that this would enable offenders to identify themselves and would likely result in increased fear of harm and anxiety, not only for the offenders but also other residents.

38. Police Scotland submitted that, while there may be an element of tacit knowledge within the communities local to each multi-storey property, the publication of further detail which would in all probability identify these addresses, serves to stir up community tension, fear and anxiety and will further fuel the use of local social media pages to identify the whereabouts of offenders. Police Scotland argued that the fact that these multi-storey properties tend to appear in clusters also leaves the door open to further information requests, which, by careful use of partial postcodes, may risk the number of buildings which actually house RSOs being narrowed down.

Commissioner's conclusions

39. The Commissioner has carefully considered the submissions made by Mr Howarth and Police Scotland and he is not satisfied that the requested information is personal data.

40. In the case of Breyer v Bundesrepublik Deutschland [2] the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified. When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is insignificant, the information will not be personal data.

41. Police Scotland have raised many issues regarding the identification (or misidentification) of RSOs in a community, but they have not established why disclosure of a single figure, i.e. the total number of RSOs in the multi-storey flats listed by Mr Howarth (which fall into 24 post-code areas, each with a sizeable population) would lead to the identification of one or more living individual(s).

42. Mr Howarth has estimated that the number of people living at the addresses he has provided to be around 35,000, working on the basis that there are 16,988 high rise apartments and that the average household size is 2.08. The Commissioner notes that, even if each of these 16,988 properties housed only one individual (which is highly unlikely), that would still result in a population of some 16,988. In fact, even if half of the properties were vacant and the remaining half only housed one person, there would still be a population of some 8,000 people living in the flats, well within the population range for the post code areas for which Police Scotland already publish RSO data.

43. Police Scotland have argued that any RSO resident in any of the addresses provided by Mr Howarth would be able to identify themselves, but the Commissioner does not accept this. Even if Mr Howarth were to publish the list of multi-storey flats he provided to Police Scotland (and his intentions are unknown), the information he has requested would only indicate that x number of RSOs reside in some 16,988 properties. The information does not indicate which properties house RSOs, nor does it indicate whether there is only one RSO in any particular block of flats: there may well be multiple RSOs in any one building, or numerous buildings which do not house any resident RSOs. Knowing that some RSOs reside in multi-storey flats does not, by itself, permit any individual to be identified. If that were the case, it would mean that any RSO living in any of the postcode areas for which Police Scotland publish data would also be able to identify themselves, or be identified.

44. Police Scotland have referred to multi-storey buildings as micro-communities, suggesting that the number of individuals residing in the addresses provided by Mr Howarth is not one population of 35,000 individuals but rather 208 distinct populations of 169 individuals. Police Scotland argued that this makes it more likely that individuals could be identified from disclosure of the data, especially when combined with community knowledge or suspicions.

45. The Commissioner is not persuaded by these arguments. He would reiterate that Mr Howarth is not seeking the number of RSOs resident in any specific building; he is looking for the total number of RSOs resident in multi-storey flats in the City of Glasgow area. Disclosure of the overall figure will not enable communities to identify any individual RSO, regardless of whether or not each block functions as a micro-community and regardless of whether Mr Howarth publishes the list of multi-storey flats; it will only reveal the number of RSOs housed in multi-storey flats across the whole City of Glasgow area.

46. Police Scotland have also referred to the existence of tacit knowledge or community intelligence which has enabled some communities to "out" or falsely accuse individuals of being a RSO. Police Scotland argue that disclosure of the figure requested by Mr Howarth would further exacerbate this issue and that it may enable individuals to narrow down the buildings within which a RSO may reside. However, the Commissioner notes that, even if it were possible for an individual to narrow down the buildings in that way (which he does not accept), that would not mean that an individual would be identified, only that the number of potential addresses for such an individual had been reduced.

47. In conclusion, the Commissioner is not satisfied that the information withheld under this exemption (i.e. the number of RSOs living in multi-storey flats in Glasgow) comprises personal data. There is no realistic prospect of an individual being identified from the information. Therefore, the Commissioner finds that Police Scotland were not entitled to apply section 38(1)(b) of FOISA to this information.

Transitional provisions

48. Given that the Commissioner has concluded that Police Scotland did not comply with Part 1 of FOISA (as it stood before 25 May 2018) in withholding the information under section 38(1)(b), he must now go on to consider whether disclosure would breach Part 1 of FOISA as it currently stands.

49. On this occasion, the first question the Commissioner must consider is whether the information is personal data for the purposes of Article 4 of the GDPR. The definition is set out in full in Appendix 1.

50. The Commissioner contacted Police Scotland to advise them that he considered the information they were withholding under section 38(1)(b) of FOISA was not personal data and should now be disclosed. He gave Police Scotland an opportunity to comment on whether disclosure would be contrary to section 38(1)(b) as amended.

51. Police Scotland responded on 12 October 2018. Police Scotland reiterated their previous arguments that the information was personal data that would identify a living individual and provided more detailed arguments as to how (in their view) a member of the public could use the information to identify an RSO. Police Scotland maintained that it would be relatively straightforward for someone to use the addresses as a basis for narrowing down the location of a RSO and they explained how (in their view) this could be done.

52. Police Scotland also commented that, when they considered Article 4(1) of the GDPR, they had taken account of Recital 26 of the GDPR (which makes it clear that if a data subject is no longer identifiable, the data should be considered anonymous - and therefore no longer subject to the GDPR).

53. The Commissioner has set out above his reasons for concluding that the number in question is not personal data for the purposes of the DPA 1998. His views were not changed by any of the arguments submitted by Police Scotland on 12 October 2018 and he has concluded, for the same reasons, that the number is not personal data for the purposes of the GDPR. It follows that its disclosure would not contravene any of the protection principles in Article 5(1) of the GDPR, which requires that personal data be processed lawfully, fairly and in a transparent manner.

54. As Police Scotland are also withholding this information under section 35(1)(a) of FOISA, the Commissioner will now go on to consider it under that exemption.

55. The Commissioner acknowledges that some of the arguments put forward by Police Scotland on 12 October 2018, in submissions relating to personal data, are relevant to his consideration of section 35(1)(a) of FOISA, although they have not been put forward in relation to that exemption. The Commissioner will however, take these arguments into account when he considers the application of section 35(1)(a) of FOISA.

Section 35(1)(a) - Law enforcement

56. In order for the exemption in section 35(1)(a) to apply, the Commissioner has to be satisfied that disclosure of the information would, or would be likely to, prejudice substantially the prevention or detection of crime.

57. There is no definition in FOISA of what is deemed to be substantial prejudice, but the Commissioner considers the authority would have to identify harm of real and demonstrable significance. The harm would also have to be at least likely, and therefore more than simply a remote possibility.

58. As the Commissioner's guidance[3] on section 35(1)(a) highlights, the term "prevention or detection of crime" is wide ranging, encompassing any action taken to anticipate and prevent crime, or to establish the identity and secure prosecution of persons suspected of being responsible for crime. This could mean activities in relation to a specific (anticipated) crime or wider strategies for crime reduction and detection.

Police Scotland's submissions

59. Police Scotland explained that, under the Sexual Offences Act 2003, an RSO is compelled to register with the police. The purpose of this registration is to enable the police and other relevant authorities to supervise and monitor RSOs with a view to assessing the risk of them re-offending. Police Scotland submitted that this is essentially a strategy of supervision and monitoring and is aimed at prevent RSOs from committing a similar offence and protecting the wider community from any risk they pose. They argued that this strategy relies on the compliance of RSOs with such supervision.

60. Police Scotland argued that, if information relating to RSOs in such condensed areas as multi-storey flats was disclosed, then this may lead to the small communities housed in these flats to attempt to identify any offenders living within their block. Police Scotland acknowledged that, while it may seem reasonable to provide an overall total of the number of RSOs residing in high-rise apartments, this total relates to specified addresses and could cause widespread panic within the block of flats if it was identified that an RSO lived in the property. In turn, Police Scotland argued that this could lead to the physical harm of the RSO, or the harm of an innocent party who may be mistakenly identified as an RSO, or fearing identification and some form of reprisal attack, the RSO may flee the area and the police may lose contact with them.

61. Police Scotland argued that RSOs, like other individuals, expect their data to be treated confidentially and, if information was disclosed, any established trust between the RSO and the police would be broken. They submitted that this would make it more difficult for the police to ensure the RSO complies with the terms of their registration and without the appropriate supervision and assessment there would be a greater risk of these individuals re-offending.

62. Police Scotland stated that they are aware of at least 25 active groups targeting sex offenders and sharing information across social media. They argued that current technology exists, is widely available and requires minimal costs to enable not only the applicant, but any of these groups to communicate and undertake further research in order to ascertain the specific addresses of RSOs via online access to open source material, online platforms and social media.

63. Police Scotland explained, in detail, the steps that a determined person (or one of these groups) could take to track down which of the 208 addresses house RSOs, and they argued that the likelihood that individuals from these groups would use this information to identify and target RSOs is extremely high.

64. Additionally, Police Scotland argued that a high percentage of RSOs will be male and within a certain age bracket, which largely reduces the number of people within any small community such as multi-storey flats who could potentially be identified (and also mistakenly identified) as RSOs. Again, they considered that disclosure of the information requested by Mr Howarth would put these individuals at greater risk of physical harm.

65. Police Scotland submitted that disclosures under FOISA are disclosures to the wider public and, if such precedence was set, it could eventually become impossible for RSOs to be housed in specific areas because of the negative impact and likely disorder that would ensure. If this occurred across a large number of areas it would become impossible for the police and their partner agencies to house and monitor RSOs appropriately and ensure they comply with the terms of their registration.

Mr Howarth's submissions

66. In his submissions, Mr Howarth argued that Police Scotland had not demonstrated how the release of the information would jeopardise law enforcement. He noted that the exemption contained in section 35(1)(a) of FOISA has a high test for harm, and that authorities must show that the adverse consequences they claim "would or would be likely" to occur. Mr Howarth notes that Police Scotland's arguments under section 35(1)(a) of FOISA, often used the terms "may" or "could" when describing the negative impact of disclosure. Mr Howarth noted that Police Scotland's arguments in support of this exemption appear to be predicated on (in his view) a false assumption that the information requested is personal data.

Commissioner's conclusions

67. The Commissioner has considered all of the submissions made by Police Scotland in relation to the application of section 35(1)(a) of FOISA and he is not satisfied that disclosure of the number of RSOs resident in multi-storey blocks across the City of Glasgow Council area would, or would be likely to, prejudice substantially the prevention or detection of crime.

68. The Commissioner understands the importance of monitoring and supervising RSOs in the community, and he accepts that this supervision helps to prevent RSOs from re-offending, thus preventing crime. The Commissioner also understands that if an RSO is fearful or anxious of being identified, their behaviour may deteriorate and they may be less willing to co-operate with the police and other partners, which may result in them absconding and/or committing a further crime. The Commissioner will generally exercise caution when faced with the possibility of ordering disclosure of information that would interfere with the prevention or detection of a crime, but Police Scotland have not persuaded him that this would be the result of the information being disclosed.

69. The Commissioner accepts the possibility that disclosure of the withheld information may act as a tipping point for RSOs fearing identification, but he questions whether this is likely in this case, given the obvious difficulties in identifying an individual offender from the statistical information requested by Mr Howarth. He notes that, in many cases, RSOs are already likely to be vulnerable to identification through information available from social media, local incidents or information shared by people who know their history; the RSOs are likely to be aware that this is the case, and to live with this knowledge. In this context, he does not accept that disclosure of information which does not relate in an obvious way to identifiable individuals would be likely to produce the consequences anticipated by Police Scotland.

70. Police Scotland have argued that disclosure of the statistical information would lead people to speculate about the identity of the individuals concerned. The Commissioner accepts that this may be a consequence of disclosure, and that it is not necessary for an individual's status as an RSO to be established beyond doubt for them to become the target of vigilante action. The fact that the withheld statistical information does not permit identification of an individual RSO does not guarantee that action may not be taken against someone assumed to be an RSO. Police Scotland have given the Commissioner details of a number of incidents in which a person rightly or wrongly suspected to be an RSO has been subjected to harassment or violence from people objecting to their presence in the community.

71. In Decision 014/2009, the Commissioner considered whether disclosing the number of RSOs resident in a particular post-code area would lead to the same kind of negative outcomes cited by Police Scotland in relation to Mr Howarth's request. In that case he concluded:

"Vigilante action may occur where enough is already known or thought to be known about a particular individual for it to be assumed that the individual is an RSO, without the disclosure of the requested statistics. In these circumstances, the disclosure of the statistical information becomes incidental: the individual has already been "identified" (even where, in fact, misidentification has occurred) and the motive for vigilante action presumably already exists in the minds of those who would carry out such an attack. Disclosure of the statistics may provide a focus for renewed speculation about an individual who is already suspected of being an RSO, but would provide potential vigilantes with no further evidence of the identity of the RSOs in the area. So, while he accepts that disclosure could serve as a catalyst for renewed speculation, which might lead to vigilante action, the Commissioner does not find that Strathclyde Police have shown this to be a likely consequence."

72. The Commissioner's view on disclosure in this case, mirrors his conclusions in Decision 014/2009. In conclusion, the Commissioner has found that the exemption in section 35(1)(a) of FOISA should not be upheld in relation to information about the total numbers of RSOs resident in multi-storey blocks in Glasgow.

73. Because the exemption has not been found to apply, the Commissioner is not required to go on to consider the public interest test in section 2(1) of FOISA in relation to this information. However, Police Scotland have also argued that these statistics are exempt from disclosure under section 39(1) of FOISA and he will now go on to consider whether this exemption applies.

Section 39(1) - Health, safety and the environment

74. Section 39(1) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual. This is a qualified exemption and is subject to the public interest test required by section 2(1)(b) of FOISA.

75. As the Commissioner notes in his briefing on this exemption[4], section 39(1) does not contain the usual harm test. Instead of the "substantial prejudice" test found in many other harm-based exemptions in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety. This test is less demanding than the "substantial prejudice" test.

76. Police Scotland have argued that if the information was disclosed it could lead to communities "outing" sex offenders, which could either lead to the serious physical harm of the RSO or the harm of an individual mistakenly being identified as an RSO. Police Scotland also argued that disclosure may also harm the mental health of an RSO, as disclosure may result in the individual living in fear of being identified.

77. Police Scotland argued that individuals can be highly motivated and indeed creative in attempts to attain information regards the domicile of RSOs. They noted that while the requested information may seem harmless, any disclosure of this nature is likely to assist an individual in forming a mosaic picture which can place the RSO or, someone being mistakenly identified as an RSO, at increase of risk of harm. Police Scotland argued that if they disclosed the information requested by Mr Howarth, this would provide positive confirmation that RSOs are domiciled within the list of addresses he provided, and in turn, provide a point of congregation for any potential vigilante type behaviour.

78. Police Scotland submitted that publication of the addresses provided by Mr Howarth provides specific locations which may attract public protest. They noted that, while peaceful protest is entirely lawful, the anxiety which can result from self-identification, community "outing" and protests can result in offenders failing to engage with services, becoming suicidal, going missing, breakdown in relationships which are considered a protective factor in relation to risk of future serious harm, may result in public order issues and increased anxiety and fear within the local communities.

79. Police Scotland argued that there had been a significant increase during the course of the year in the use of local social media pages and co-ordinated efforts across such pages, to publicly "out" RSOs in the community. They noted that, while there had been instances of lawful, peaceful protests outside the home of offenders, there were also a significant increase in instances of; fire raising incidents at the home of offenders, vehicles being set alight, cases of mistaken identity, offenders having to be re-located and increased local public fear and anxiety.

80. Police Scotland argued that such activities served to undermine the efforts of the responsible authorities working together under the Multi Agency Public Protection Arrangements (MAPPA) to minimise the risk of serious harm presented to members of the public by RSOs. They submitted that such incidents can increase the anxiety felt by offenders; result in genuine fear for their own safety and that of their families; relationship breakdown; low mood risking suicide; and can result in offenders going missing.

81. Police Scotland submitted that protecting the public is one of their key priorities and it works in partnership with a number of key stakeholders through MAPPA to ensure that all RSOs are robustly managed within the community. They contended that while risk can never be mitigated completely, they would like to reassure communities that all reasonable steps are taken to protect them.

Mr Howarth's submissions

82. Mr Howarth argued that Police Scotland had not demonstrated how disclosure of the information would endanger health and he again stressed that much of their arguments appear to rely on the presumption that disclosure would result in the identification of individual RSOs. He noted that Police Scotland appear to suggest that there is a precedence for this type of information being released and subsequently causing "serious harm" to RSOs and to members of the community.

83. Mr Howarth referred to Police Scotland's statement that; "it is not merely a case of a possibility that this would occur, as police forces throughout the UK can evidence". He noted that Police Scotland did not provide him with any such evidence. Mr Howarth submitted that Police Scotland's legacy forces have previously opposed the release of geographical statistical information about RSOs using the same arguments presented in this case. Mr Howarth also noted that the Commissioner has repeatedly ruled in favour of disclosure, having judged the risks to be unsupported by evidence. Mr Howarth contended that he is not aware of any instance - and Police Scotland have not mentioned one - whereby their concerns have subsequently proved to be justified.

Commissioner's conclusions

84. In coming to a decision on the application of section 39(1) of FOISA, the Commissioner has taken cognisance of all of the submissions made by Police Scotland, including the submissions listed under section 35(1)(a) above, where they relate to the safety of individuals.

85. The phrase "endanger" is broad enough to apply where there is a threat, direct or indirect, to the safety of a person. Since the exemption does not specify that any threat should be imminent before it applies, the threat may be either immediate, or one which would foreseeably arise in the future, The Commissioner believes that for endangerment to be considered likely, however, there must be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.

86. It is already publicly known that RSOs are housed across the Glasgow City Council area. In April 2018, Police Scotland published statistics on its website that listed the number of RSOs housed in every 3 digit post-code across the whole of Scotland, including Glasgow. As noted above, Police Scotland withholds information if the population size of any particular postcode area is less than one thousand individuals, but they provide statistics for any population size above this.

87. Police Scotland have also disclosed the fact that, as of April 2018, there were 610 RSOs domiciled across Glasgow. Every RSO living in Glasgow can easily find out how many other RSOs are living in the city, but they cannot identify themselves from this figure, nor can they identify any other RSO. The Commissioner accepts that some RSOs may be particularly anxious about being identified and falling victim to some form of vigilante action. But this anxiety must co-exist with the knowledge that Police Scotland routinely publishes the number of RSOs residing in postcode districts across Scotland.

88. What the Commissioner must consider here is whether, and to what extent, disclosure of the information withheld by Police Scotland would, or would be likely to, make any of the associated risks any greater, to the extent that the endangerment of any person would be made more likely.

89. The Commissioner has considered the appendix provided by Police Scotland which included extracts from correspondence received from their Divisions in relation to the use of local social media pages to publicly "out" RSOs in the community. This appendix clearly indicates that, across Scotland, a number of individuals use social media platforms to publicise the identity of RSOs (or suspected RSOs) and that vigilante action, including damage to property, often follows such postings.

90. The Commissioner has no reason to doubt the incidents described by Police Scotland and he considers it evidence of the issues that can arise when community knowledge leads to individuals being accused of or identified as a RSO. However, none of the incidents described by Police Scotland refer to any individual being identified because of the publication of the statistical number of RSOs in their neighbourhood.

91. The appendix provides no link between the data requested in this case and the harm that can occur when RSOs are identified (or misidentified) in the community. It does not indicate how the community were able to identify (or misidentify) the RSO in every incident, but, where that information is provided, it indicates that RSOs were identified by members of the victims' families or by other members of the community aware of the RSOs offending, or who had seen social media posts reporting on the RSO and their activities. There is not a single instance documented in the appendix whereby it is stated that a RSO was identified through statistical likelihood.

92. The Commissioner is not persuaded by the arguments presented by Police Scotland. In his view, these arguments do not demonstrate why the actual information Mr Howarth is seeking here would be likely to increase the risk of endangerment to the health or safety of individuals, and in particular RSOs and those misidentified as RSOs. Police Scotland are required to demonstrate a link between disclosure and endangerment: in all the circumstances of this case, the Commissioner does not find such a link to have been established.

93. Having concluded that the exemption was wrongly applied, the Commissioner is not required to consider the public interest test in relation to disclosing or withholding this information. He requires Police Scotland to disclose the information to Mr Howarth.

Decision

The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Howarth. Police Scotland wrongly withheld the information under sections 35(1)(a), 38(1)(b) and 39(1) of FOISA.

The Commissioner therefore requires Police Scotland to provide Mr Howarth with the total number of RSOs living at the addresses he specified when clarifying his request by 7 December 2018.

Appeal

Should either Mr Howarth or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If Police Scotland fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that Police Scotland has failed to comply. The Court has the right to inquire into the matter and may deal with Police Scotland as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

23 October 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

(i) paragraphs (a), (c) and (d); and

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

35 Law enforcement

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially-

(a) the prevention or detection of crime;

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

..

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

39 Health, safety and the environment

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, endanger the physical or mental health or the safety of an individual.

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Data Protection Act 2018

Schedule 20 - Transitional provision etc

56 Freedom of Information (Scotland) Act 2002

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 ("the 2002 Act") before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

(3) To the extent that the request was dealt with before the relevant time -

(a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act as amended by Schedule 19 to this Act, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.

(4) In this paragraph -

"Scottish public authority" has the same meaning as in the 2002 Act;

"the relevant time" means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.

General Data Protection Regulation

4 Definitions

For the purposes of this Regulation:

1. "personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

…

---