Decision 170/2015: Mr David Ross and Lothian Health Board Final report of external review Reference No: 201500743 Decision Date: 6 November 2015 Summary On 11 January 2015, Mr Ross asked Lothian Health Board (NHS Lothian) for the information in a report produced following an external review relating to its perinatal psychiatry service. NHS Lothian told Mr Ross that none of the information in the report could be disclosed given the personal nature of the matters considered. Following a review, Mr Ross remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and was satisfied that the withheld information should all be considered the personal data of the individuals whose actions were the subject of the review. Disclosure would breach the first data protection principle, so NHS Lothian was entitled to withhold the information under section 38(1)(b) of FOSIA.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 11 January 2015, Mr Ross made a request for information to NHS Lothian. He asked for "the final report of the external inquiry into concerns raised about the NHS Lothian perinatal psychiatry service and its management".

2. NHS Lothian responded, explaining that it considered the information to be confidential to individual members of staff. It cited section 38 of FOISA, on the basis that it did not have the consent of the individuals concerned and disclosure would breach the data protection principles.

3. On 6 March 2015, Mr Ross wrote to NHS Lothian requesting a review of its decision. He believed personal details could be redacted and highlighted that the inquiry addressed matters of considerable public importance.

4. NHS Lothian notified Mr Ross of the outcome of its review on 24 April 2015, upholding its original response without modification. It did not consider redaction to be practicable.

5. On 24 April 2015, Mr Ross wrote to the Commissioner. Mr Ross applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Ross stated he was dissatisfied with the outcome of NHS Lothian's review because of the serious nature of the matters considered. He referred to a previous external inquiry into the same service, the report of which was published in redacted form on the authority's own website.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Ross made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 8 May 2015, NHS Lothian was notified in writing that Mr Ross had made a valid application. NHS Lothian was asked to send the Commissioner the information withheld from him. NHS Lothian provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Lothian was invited to comment on this application and answer specific questions, with particular reference to why the report was being withheld in its entirety under section 38 of FOISA.

9. NHS Lothian provided submissions. The investigating officer sought clarification as to which data protection principles were being relied upon, which NHS Lothian provided.

10. Mr Ross also provided submissions during the investigation.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Ross and NHS Lothian. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal information

12. NHS Lothian sought to rely on section 38(1)(b) of FOISA in relation to the entire report. In order to rely on this exemption, NHS Lothian must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one of more of the data protection principles to be found in Schedule 1 to the DPA.

Is the information under consideration personal data?

13. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

14. The Commissioner notes that NHS Lothian is withholding the entire document under section 38(1)(b) of FOISA. The issue here is whether the report can be withheld in its entirety. Mr Ross has referred to the report of a previous external review of the same service, the report of which was published by NHS Lothian following a previous information request[1]. It is important to bear in mind that the focus of this earlier report is the quality of the service rather than the actions of specific individuals.

15. In this case, NHS Lothian submitted that the focus of the present report was the conduct of individual members of staff rather than the service. Given the nature of the report, it did not believe redaction would permit any information to be provided in intelligible form.

16. The Commissioner takes the view that the focus of the report is a set of complaints which are personal to living individuals (the complainer and any individuals complained of). Information of this nature clearly relates to the individuals concerned. The Commissioner has considered the report carefully, along with other relevant information in the public domain and the way in which consideration of complaints, actions complained of and the service itself are intertwined. In the circumstances, she accepts NHS Lothian's view that the report cannot practicably be redacted to render the individuals concerned no longer identifiable, leaving intelligible information which could be disclosed to Mr Ross.

Would disclosure breach the first data protection principle?

17. In other words, the Commissioner must consider the report's content in its entirety. In its submissions, NHS Lothian argued that disclosure of the withheld information would contravene the first data protection principle.

18. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. The processing in this case would be making the information publicly available in response to the request Mr Ross submitted.

19. If the data were sensitive personal data, as defined in section 2 of the DPA, a condition in Schedule 3 to the DPA would also need to be met, In this case, the Commissioner is satisfied that the data under consideration are not sensitive personal data.

Can any of the conditions in schedule 2 be met?

20. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2], that the conditions required careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interest of the data subject (i.e. the person or persons to whom the data relate).

21. The first Schedule 2 condition which might be considered relevant in this case is condition 1. This would apply where the data subjects (in this case, the complainer and the managers) have given their consent to the processing. Amongst other things, consent under the DPA requires to be fully informed and a positive indication of the data subject's wishes. Mr Ross highlighted that he believed one of the individuals concerned consented to disclosure: he produced evidence that they had communicated this to NHS Lothian, but this did not happen until some time after completion of NHS Lothian's review.

22. NHS Lothian confirmed that consent to disclosure had not been sought from, or given by, any of the individuals concerned.

23. In the circumstances, the Commissioner does not consider condition 1 to be applicable in this case. Even if consent from the complainer had been present at the time of NHS Lothian's review (as would be necessary for such consent to have any relevance here), the Commissioner has already noted the extent to which the personal data of the various data subjects are intertwined. Given the nature of the matters considered by the report, it is inevitable that its focus is on those complained about rather than those making the complaints. The Commissioner is not satisfied that the complainer's consent would permit disclosure of intelligible information from the report.

24. The only other Schedule 2 condition which could be relevant here is condition 6. This allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

25. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr Ross pursuing a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for Mr Ross's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

Is Mr Ross pursuing a legitimate interest or interests?

26. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In the Commissioner's published guidance on section 38(1)(b)[3], it states:

In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

27. It is clear Mr Ross considers he has a journalistic interest which may well align with the wider public interest in the safety and wider quality of a service such as this. Mr Ross commented in his application on the importance of the information he was seeking, which he considered to relate to matters of serious public concern. He indicated that the report related to a long series of widely publicised concerns raised about the perinatal service, highlighting articles he had written himself in the Herald newspaper, and also the previous external review and report referred to above.

28. NHS Lothian acknowledged that Mr Ross might have a legitimate interest, although it did not necessarily follow that he had a "legitimate right" to the information.

29. The Commissioner has considered these comments carefully. In the circumstances, she is satisfied that Mr Ross and the general public have a legitimate interest in being assured as to the safety and wider quality of the service under consideration in the report - basically, whether that service is (or at least was, at the time that question was considered) "fit for purpose".

Is disclosure necessary to achieve those legitimate interests?

30. Having concluded that Mr Ross has a legitimate interest, the Commissioner must now consider whether disclosure of the withheld personal data is necessary to achieve those legitimate interests. In doing so, she must consider whether these interests might reasonably be met by any alternative means.

31. In this case, the Commissioner is being asked to consider a report relating to allegations concerning managerial conduct. Its focus is on individual behaviours and working relationships, not on the service those individuals were responsible for. That was the focus of the earlier external review and report, referred to above. That report considers questions of safety and service quality comprehensively and, to the extent that it does not relate to more personal and behavioural issues, has been published. It was in the public domain at the time Mr Ross made his information request. The Commissioner cannot accept Mr Ross's assertion that it is more "limited" in its scope than the report under consideration here.

32. In all the circumstances, the Commissioner is not satisfied that disclosure of the personal data under consideration in this case is necessary for the purposes of Mr Ross's legitimate interests. These are capable of being fulfilled by the report which has been published already.

33. Having concluded that disclosure is not necessary, the Commissioner cannot find that condition 6 in Schedule 2 to the DPA is capable of being met in this case. In the absence of a condition permitting disclosure, she must find such disclosure to be unlawful. It therefore follows that disclosure of the personal data under consideration in this case would breach the first data protection principle. Accordingly, the Commissioner is satisfied that this information is exempt from disclosure, and that NHS Lothian was entitled to withhold it, under section 38(1)(b) of FOISA.

Decision The Commissioner finds that NHS Lothian complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Ross.

Appeal

Should either Mr Ross or Lothian Health Board wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

6 November 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---

[1]

[2]

[3]