Decision 170/2018: Record keeping policies, procedures and practices.

Public authority: Orkney Health Board
Reference No: 201801139

Summary

NHS Orkney was asked for a wide range of information relating to its record keeping policies, procedures and practices. It refused to comply with the request, stating that it would cost in excess of the £600 limit.

The Commissioner found that complying with the request would exceed the cost limit and that NHS Orkney was not obliged to comply.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 12(1) (Excessive cost of compliance); 15 (Duty to provide advice and assistance)

The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost - prescribed amount)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 25 April 2018, Mr X made a multi-part (around 70 questions), interconnected request for information to Orkney Health Board (NHS Orkney) about its record keeping and confidentiality.

2. NHS Orkney acknowledged receipt of the request on 30 April 2018.

3. On 4 and 19 June 2018, Mr X wrote to NHS Orkney requesting a review on the basis that NHS Orkney had not responded to his request.

4. On 27 June 2018, NHS Orkney acknowledged Mr X's request for a review and apologised for the delay in replying to him. NHS Orkney responded that it would cost in excess of £600 to fulfil his request and, therefore, by virtue of section 12 of FOISA, it was not obliged to comply with that request. It did not hold the information in a format that made reporting in the level of detail required easily accessible. NHS Orkney advised Mr X that he could narrow the terms of his request to try to bring it within the cost limit of FOISA.

5. On 1 July and 10 August 2018, Mr X wrote to the Commissioner. Mr X applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of NHS Orkney's review because he believed it should have been able to provide the information he had requested within cost. He said that if it could not do so, it would be because NHS Orkney did not have the required record keeping systems which would mean that NHS Orkney was relying on its own failings as a reason not to supply information.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Orkney was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

Commissioner's analysis and findings

8. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to him by both Mr X and NHS Orkney. He is satisfied that no matter of relevance has been overlooked.

Section 12(1) - excessive cost of compliance

9. Section 12(1) of FOISA provides that a Scottish public authority is not obliged to comply with a request for information where the estimated cost of doing so would exceed the relevant amount prescribed in the Fees Regulations. This amount is currently set at £600 (regulation 5). Consequently, the Commissioner has no power to require the release of information should he find that the cost of doing so would exceed £600.

10. The projected costs the public authority can take into account in relation to a request for information are, according to regulation 3 of the Fees Regulations, the total costs, whether direct or indirect, the authority reasonably estimates it is likely to incur in:

(i) locating

(ii) retrieving, and

(iii) providing

the information requested in accordance with Part 1 of FOISA. The maximum rate a Scottish public authority can charge for staff time is £15 per hour.

11. The public authority may not charge for the cost of determining:

(i) whether it actually holds the information requested, or

(ii) whether or not it should provide the information.

12. NHS Orkney was asked by the Commissioner to explain how it had estimated the cost of complying with Mr X's request.

13. NHS Orkney acknowledged that further details should have been provided to Mr X on how it had calculated the cost of complying with his request. NHS Orkney said it would be willing to provide a breakdown of the estimated costs to Mr X.

14. NHS Orkney noted that Mr X's request contained 74 questions relating to Records Management, confidentiality and the Caldicott Guardian. It had sent the questions on to the relevant persons or departments within the authority, asking for an estimate of the time it would take them to answer.

15. The total estimated total cost of £1,250.75 was based on the following breakdown of costs.

• Board Secretary - 22.5 hours (at £15.00 per hour) - £337.50
• Health Records Manager - 22.5 hours (at £15.00 per hour) - £337.50
• DPO [Data Protection officer]- 4 hours (at £15.00 per hour) - £60.00
• Caldicott Guardian - 30 hours (at £15.00 per hour) - £450.00
• HR [Human Resources] Logistics Officer - 4 hours (at £12.50 per hour) - £50.00
• Organisational development - 0.5 hours (at £10.50 per hour) - £5.25
• PA [Personal Assistant] - 1 hour (at £15.00 per hour) - £10.50

16. NHS Orkney also supplied the Commissioner with copies of its Records Management Policy, its Records Management Plan, and information from its website on the Public Records (Scotland) Act. It confirmed that this information had been sent to Mr X in hard copy on 18 July 2018.

17. The Commissioner accepts that, in order to comply with Mr X's extensive request, the cost to NHS Orkney would exceed the statutory maximum (£600). Although some parts of Mr X's request are specific, there are some that cover a wide array of information (albeit within groupings of subjects). The Commissioner accepts that, in terms of staff time, NHS Orkney has identified the members of its staff (given the subject of the request) most likely to be aware of relevant information and that the hourly rates for staff time cited by NHS Orkney comply with the limits in the Fees Regulations.

18. Even allowing for a margin of error and over-estimation in NHS Orkney's calculations, the total estimated cost is considerably higher than the statutory maximum of £600. It is unlikely that the cost of compliance could be brought below £600 without considerable reduction in the staff time required. The Commissioner also notes that some parts of the request, for example those about the Caldicott Guardian, may require analysis of existing information, not just straightforward identification and provision. While there are some parts of Mr X's request that appear straightforward and relatively quick to answer, there are others parts where that is clearly not the case.

19. Taking account of all the above circumstances, including the extent and complexity of the request and the requirement for many different members of staff to be involved in answering it, the Commissioner is satisfied, on the balance of probabilities, that the cost of complying with Mr X's request would exceed £600 and, in line with section 12(1) of FOISA, that NHS Orkney was not obliged to comply with the request.

20. As stated above, some parts of Mr X's request are specific and precisely worded, and the Commissioner appreciates the importance of the requested information and the public interest in ensuring it is available. Nonetheless, section 12 of FOISA exists to ensure that there is protection for Scottish public authorities against the excessive cost of compliance with an information request. The Commissioner also notes that NHS Orkney has published information about its records management practices, and provided copies of this information to Mr X.

Section 15 - Duty to advise and assist

21. Section 15(1) requires a Scottish public authority, so far as reasonable to expect it to do so, to provide advice and assistance to a person who has made, or proposes to make, a request for information to it. Section 15(2) states that a Scottish public authority which, in relation to the provision of advice and assistance in any case, conforms to the Scottish Ministers' Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004[1] (the Section 60 Code), is taken to comply with the duty to provide reasonable advice and assistance in section 15(1).

22. The Section 60 Code provides guidance to Scottish public authorities on the practice which Scottish Ministers consider desirable for authorities to follow in connection with the discharge of their functions under FOISA. The Section 60 Code, provides (at 9.4.3):

"When refusing a request on cost grounds, it is good practice for the authority's response to provide clear advice on how the applicant could submit a new, narrower request within the cost limit. In giving advice you may wish to take account of how much the cost limit has been exceeded. Any narrowed request would be a separate new request and should be responded to accordingly."

23. NHS Orkney submitted that it took reasonable steps to assist Mr X. Mr X was informed that if he were to narrow the parameters of his request the cost of compliance might be brought under the threshold, but, due to the "large number of very detailed questions posed by Mr X" it proved difficult to attempt to respond to some parts of the requests with context to the questions raised in the entire request. NHS Orkney indicated that a member of staff had on several occasions offered to meet with Mr X to discuss how NHS Orkney could best meet his information requirements.

24. In a subsequent letter of 6 July 2018, NHS Orkney provided Mr X with its Records Management Policy[2], Records Management Plan[3] and evidence[4] to support the plan, and a link[5] to the Public Records (Scotland) Act on its website. When Mr X wrote back that he could not access the documents through the links provided to him, a hard copy of these documents was provided at no charge.

25. In its review of 27 June 2018, NHS Orkney advised Mr X that he could narrow the terms of his request, but without giving him any further advice on what might be provided within the cost limit of £600.

26. The Commissioner acknowledges that the published information which NHS Orkney provided to Mr X may be of assistance to him if he wishes to make a narrower request. This information may also contain the answers to some of his questions and should address some of his concerns, making it possible for him to submit a more focused request.

27. The Commissioner accepts that, although it may have been helpful for NHS Orkney to provide Mr X with the cost breakdown included in its submissions, in general terms the advice and assistance in its review response was sufficient to discharge its obligation under section 15 of FOISA. In reaching this conclusion, the Commissioner has taken into account the offers of a meeting which NHS Orkney made to Mr X.

Decision

The Commissioner finds that Orkney Health Board complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr X.

Appeal

Should either Mr X or Orkney Health Board wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

29 October 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

12 Excessive cost of compliance

(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.

…

15 Duty to provide advice and assistance

(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).

Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004

3 Projected costs

(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.

(2) In estimating projected costs-

(a) no account shall be taken of costs incurred in determining-

(i) whether the authority holds the information specified in the request; or

(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and

(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed £15 per hour per member of staff.

5 Excessive cost - prescribed amount

The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is £600.

---