Decision 175/2010 Mr John Smart and Fife Council
Recorded incidents of bullying
Reference No: 201000620
Decision Date: 11 October 2010
Summary
Mr Smart asked Fife Council (the Council) for information about recorded incidents of bullying at Madras College, St Andrews.
The Council provided Mr Smart with copies of forms used to record incidents of bullying, but withheld other information on the grounds that it comprised personal data, which was exempt from disclosure under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA).
After investigation, the Commissioner found that the Council had provided some information covered by Mr Smart's request, in compliance with section 1(1) of FOISA, and correctly withheld certain information under section 38(1)(b) of FOISA (on the basis that its disclosure would breach the first data protection principle).However, the Commissioner also found that Mr Smart's legitimate interests could be met in part by the disclosure of information held by the Council which did not comprise personal data, and therefore required the disclosure of that information.Finally, he found that the Council failed to respond to Mr Smart's request for review within 20 working days, as required by section 21(1) of FOISA.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 21(1) (Review by Scottish public authority); 38(1)(b), (2)(a)(i) and (b), (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 19 October 2009, Mr Smart sent the Council an email asking for:
"?any and all information relating to the recorded incidents of bullying for the period from the commencement of the academic year 2008-2009 and for this academic year 2009-2010 to the date of this request for Madras College St Andrews."
2.Mr Smart added that he was aware that any reference to named individuals would be redacted.He explained that he sought to ascertain how, and on what forms, all bullying incidents had been recorded during the period specified.
3.On 17 November 2009, the Council advised Mr Smart that it was refusing to provide the information he had requested, on the grounds that it was personal data and therefore exempt under section 38(1)(b) of FOISA.The Council confirmed, however, that in the academic year 2008-2009, incidents of bullying at Madras College were recorded using a memo format, and stated that a copy of the form was attached.It advised that Madras College now used a standardised care and welfare bullying incident report, and again indicated that a copy was attached to its email.Finally, the Council confirmed that a bullying log was also kept, in which were recorded the date of incidents; the pupils involved; their class; a brief description of the incident; action taken and by whom.
4.On 23 November 2009, after a telephone conversation with Mr Smart, the Council sent him another email with a copy of the "Incident Report Form ? Bullying" attached, acknowledging that this should have been sent with its earlier response of 17 November 2009.The Council advised that this was the form currently used by Madras College to record incidents.
5.On 27 November 2009, Mr Smart asked the Council to review its response to his request.He raised a number of questions and concerns about the response he had received.These are summarised as follows:
he asked the Council to reconsider the decision to withhold certain information, reiterating that he was content for "sensitive details" to be redacted;
he queried whether he had been supplied with "any and all information" relating to recorded instances of bullying, and gave examples of the types of document and information which he believed might have been overlooked;
he queried whether the "Incident Report Form ? Bullying" (see previous paragraph) was in fact a draft version forming part of a bullying policy still being developed by the school;
he referred to a "prior incarnation of a draft form [which] has been used to record matters of concern" and complained that this form had not been supplied under the terms of his request.
6.The Council failed to respond to Mr Smart's request for review within the statutory time period, and he applied for a decision from the Commissioner.During the investigation of this application, the Council issued a review response to Mr Smart (8 February 2010).The Council upheld the decision to withhold information under section 38 of FOISA and provided some additional explanation and commentary to Mr Smart, otherwise confirming that his request had been dealt with in accordance with Part 1 of FOISA.
7.Mr Smart was not satisfied with the review response received from the Council and, on 17 March 2010, he made a fresh application for a decision from the Commissioner.
8.The application was validated by establishing that Mr Smart had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
9.On 8 April 2010, the Council was notified in writing that an application had been received from Mr Smart and was asked to provide the Commissioner with any information withheld from him. This information was provided on 27 April 2010, and the case was then allocated to an investigating officer.
10.On 3 May 2010, the Council was invited to provide comments on the application (as required by section 49(3)(a) of FOISA). The Council was asked to provide further information on the following points:
a)the bullying log referred to in the Council's letters to Mr Smart;
b)whether the Council held statistical information collated and disseminated within the schools or within the Council, for example, for reporting to the Scottish Government on school exclusions, or for internal monitoring and action;
c)whether any reports were held about the circumstances leading up to exclusions, where the reason for exclusion related to bullying behaviour;
d)whether the Council held any other information covered by the terms of Mr Smart's request;
e)which of the data protection principles would, in the Council's view, be breached by disclosure of the bullying incident forms and memos;
f)whether, in the Council's view, these reports would cease to be personal data if the names of the individuals concerned were redacted.
11.The Council was also invited to comment on any of the issues raised in Mr Smart's wide-ranging and lengthy application to the Commissioner, and also on its failure to respond to Mr Smart's request for review within the statutory timescale.
12.The Council replied on 28 May 2010, addressing each point in turn. It explained that it collected information about pupil exclusions from all schools to report to the Scottish Government, but that "bullying" was not listed as one of the categories of exclusions in this exercise.The Council was asked about the existence of reports on the circumstances which had led up to an exclusion, but advised that the only information recorded was why the exclusion had occurred; the Council reiterated that "bullying" was not one of the categories used for this purpose.The Council stated that no additional information was available, in relation to Mr Smart's request.
13.In relation to the information withheld under section 38(1)(b) of FOISA (which included the information from the bullying log, along with that from bullying incident forms and memos), the Council advised that disclosure would cause harm and distress to the individuals whose personal information was held on the logs.The Council took the view that disclosure would therefore breach the first, sixth and seventh data protection principles in the DPA.The Council considered that even if the names of individuals were redacted, the remaining details would allow living individuals to be identified.
14.An extract from the bullying log was provided to the Commissioner's office on 7 June 2010.
15.The Council was later asked to make further enquiries about information which, if held at Madras College, would fall within the scope of Mr Smart's request.The Council reported that, after making these enquiries, it had established that no additional information had been created for reporting or monitoring purposes.
16.During the investigation, the Council agreed to disclosure of a summary of the various forms and formats used to record bullying incidents at Madras College, if this would meet Mr Smart's requirements.However, Mr Smart declined this offer.
17.Mr Smart also submitted comments in the course of the investigation.The submissions received from both Mr Smart and the Council, insofar as relevant, will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
18.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by both Mr Smart and the Council and is satisfied that no matter of relevance has been overlooked.
Information falling within the scope of the request
19.During the investigation, Mr Smart queried whether the Council had identified all information covered by the scope of his request.
20.The Commissioner notes that when making his request (19 October 2009), Mr Smart appeared to have limited its scope by explaining that he sought to ascertain "from the original copies of recorded events how and on what forms all the incidents ?have been recorded."This would appear to indicate that Mr Smart required information only about the particular forms used to record incidents of bullying during the period in question.However, the Commissioner accepts that Mr Smart's request for review (27 November 2009) shows that he intended his request to be interpreted more broadly, covering "all and any information" relating to recorded instances of bullying.He is satisfied that the original request was capable of being interpreted in this way.
21.The Council identified, as information falling within the scope of Mr Smart's request, the information contained in (i) the completed forms and memos recording individual incidents at the school, and (ii) a log (the "bullying log") used to record key details of each incident.
22.During the investigation, the Council was asked whether other relevant recorded information might also exist, such as statistics or reports created for internal use within the school, or created as part of the process by which the Council reported to the Scottish Government on pupils excluded from school.The Council confirmed that it did not hold any such information, either centrally or at Madras College.The Council explained that "bullying" was not one of the categories used in reporting pupil exclusions and provided a link to information on the Scottish Government website to demonstrate this fact.[1]The Council also explained that it had discussed with staff at Madras College whether information was created and held locally, to help the school monitor levels of bullying and the effectiveness of its anti-bullying policy.The staff had confirmed that no such information was created and that they would refer to the bullying log if required during any discussions about bullying.
23.The Commissioner is satisfied that the Council has identified all information falling within the scope of Mr Smart's request.
Information withheld under section 38(1)(b) of FOISA
24.The Council took the view that the contents of the bullying log and the forms, memos and other written records in which individual incidences of bullying were recorded comprised personal data as defined in the DPA.The Council has argued that disclosure of this information would contravene the first, sixth and seventh data protection principles in the DPA, and that the information is therefore exempt from disclosure under section 38(1)(b) of FOISA.
25.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles laid down in Schedule 1 to the DPA.
26.This particular exemption is an absolute exemption, so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
Is the information personal data?
27.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
28.In this case, the Commissioner is satisfied that the withheld information relates to living individuals who can be identified from that information and other information in the possession of the Council. He therefore accepts that this information is the personal data of those individuals.
29.The Commissioner will therefore consider whether the withheld information can be disclosed or whether this would contravene one or more of the data protection principles.
Would disclosure breach the first data protection principle?
30.The Council has argued that the release of the information would breach the first data protection principle, which the Commissioner will consider initially.Only if he is not satisfied with the Council's arguments on this principle will he go on to consider the remaining principles cited by the Council.
31.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure into the public domain in response to Mr Smart's information request.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the personal data in this case does not fall into any of the relevant categories.It is therefore not necessary to consider the conditions in Schedule 3 in this case.
32.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
33.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
34.Condition 1 of Schedule 2 is not applicable in this case, as consent to disclosure was neither sought nor given by the data subjects.
35.In the circumstances, condition 6 would appear to be the only condition which would permit disclosure to Mr Smart. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s) (the individuals to whom the data relate).
36.There are a number of different tests which must be satisfied before condition 6 can be met.These are:
Does Mr Smart have a legitimate interest in obtaining the personal data?
If yes, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?
Even if the processing is necessary for Mr Smart's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Smart must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Smart.
Does the applicant have a legitimate interest?
37.In his application for a decision from the Commissioner, Mr Smart described some of his concerns about the way in which bullying incidents have been recorded at Madras College.He noted that the nature of each incident was not recorded on the bullying log, and argued that this information was held only on the form used to record the incident.He stated his purpose in making the request was to "seek the nature of recordable events and what actions has been taken by the school and importantly the methods employed to record these instances."He did not believe that the means of recording used by the school were consistent with the handling procedures laid down in its care and welfare policy.
38.In relation to the bullying log, Mr Smart has explained that he wishes to analyse the information it contains to obtain "corroboration of recorded events to figures given and assess whether all matters of bullying have actually been recorded or not".
39.The Commissioner accepts that Mr Smart has a legitimate interest (as do the wider public) in information which would show the extent to which the school has complied with the procedures laid down in its care and welfare policy in relation to the recording of bullying incidents.
Is disclosure of the personal data necessary for Mr Smart's legitimate interests?
40.In his correspondence with the Commissioner, Mr Smart acknowledged that the information withheld would require to be anonymised if it were to be disclosed.He believed this could be achieved by removing the names of the individuals concerned from each record.
41.If the information was capable of being anonymised in this way, it would cease to be personal data, as defined in section 1(1) of the DPA, and the exemption in section 38(1)(b) of FOISA could no longer apply.However, after examining the information withheld, the Commissioner does not accept that anonymity would be guaranteed by redacting the names of individuals from the forms and the bullying log.The other details recorded about each incident (e.g. date, location, nature of the complaint, action taken) provide enough information to make identification possible, even if names were not disclosed.The Commissioner has therefore found (subject to his comments below on the dates of the incidents) that it would not be possible to redact the information in the forms and the bullying log in a way which would mean it was no longer personal data.
42.Having considered the legitimate interest he has identified in disclosure of the withheld information, the Commissioner considers that it is capable of being met, at least in part, by the provision of a summary of the withheld information, disclosure of which would not cause any intrusion into the privacy of the data subjects.
43.The Commissioner believes this could be achieved by providing Mr Smart with a summary of the type of record created for each incident, as described in paragraph 16 and as offered to Mr Smart during the investigation.The Commissioner would expect this summary to show how bullying incidents were recorded at Madras College during the period covered by Mr Smart's request, and the date of each incident.As this information would not permit identification of individual persons, it would not be personal data as defined by the DPA, and the exemption in section 38(1)(b) of FOISA would not therefore apply to it.The summary would contain such information (basically, the dates of the incidents) as the Commissioner considers could be extracted from the withheld information while maintaining full anonymity.
44.The Commissioner accepts that this would not provide Mr Smart with information about the nature of each incident.As stated previously, the Commissioner finds that disclosure of information about the nature of the incident would make it possible to identify the persons involved, even if their names were redacted.On the other hand, he accepts Mr Smart has a legitimate interest in obtaining this information and has been unable to identify any means of meeting that legitimate interest which would interfere less with the privacy of the data subjects than disclosure of the information.He therefore accepts that disclosure of information about the nature of each incident is necessary to meet Mr Smart's legitimate interests, and must go on to consider the effect of disclosure of these personal data on the data subjects.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
45.The Commissioner must now consider whether disclosure of information about the nature of the incidents, which is personal data, would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects (the individuals named in the records of bullying incidents). As noted above, this involves a balancing exercise between the legitimate interests of Mr Smart and those of the data subjects. Only if the legitimate interests of Mr Smart outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
46.The Council submitted, and the Commissioner accepts, that disclosure of this personal data would cause harm and distress to the individuals concerned, because of the nature of the incidents recorded.In addition, given the nature of the information, and the fact that it relates to children and young persons subject to a duty of care, the Commissioner does not consider that its disclosure in response to a FOISA request would be within the reasonable expectations of the data subjects.
47.The Commissioner considers that in this case the rights, freedoms and legitimate interests of the data subjects, in relation to their reasonable expectations of privacy, outweigh the legitimate interest he has previously identified in disclosure of the information.
48.Given this conclusion, the Commissioner finds that condition 6 of Schedule 2 to the DPA could not be met in relation to disclosure of the withheld personal data on the nature of the incidents.For the same reasons, the Commissioner has concluded that disclosure would be unfair and, in breaching of the first data protection principle, unlawful.The Commissioner therefore accepts that the information was properly withheld under section 38(1)(b) of FOISA.
49.The Commissioner requires the Council to provide Mr Smart with summary information about the type of record created for each incident, as described in paragraph 43 above.This is information covered by the terms of his request (which is not personal data), which the Council holds and to which he is entitled under section 1(1) of FOISA.
Compliance with statutory timescales for response
50.As noted previously in this Decision Notice, the Council initially failed to respond to Mr Smart's request for review (27 November 2009), and did so only after he had applied to the Commissioner for a decision on the matter.
51.Section 21(1) of FOISA gives public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for a review, subject to exceptions which are not relevant to this case.
52.The Council did not provide a response to Mr Smart's requirement for review of 27 November 2009 until 8 February 2010. While acknowledging this failure, the Council explained that, at the time, it had received many other requests for review from Mr Smart, all relating to similar subjects.The Council believes this particular request for review was missed, and commented that it had provided a review response as soon as the error was brought to its attention.
53.The Commissioner finds that the Council failed to respond to Mr Smart's requirement for review within the 20 working days allowed under section 21(1) of FOISA.
54.Since this occurrence, the Council's Education Directorate has undergone a good practice assessment by the Commissioner's staff.One of the recommendations made in the assessment report was that the Council should take steps to ensure it complies with the statutory timescales in FOISA and the Environmental Information (Scotland) Regulations 2004.In the circumstances, the Commissioner has not required the Council to take any further action in relation to its failure to respond to Mr Smart's request for review within the 20 working days specified in section 21(1) of FOISA.
Validity of the request
55.In its review response (8 February 2010) the Council advised Mr Smart::
"?in a recent decision between the Commissioner v Glasgow City Council it has been highlight that when requesting information through FOISA it should be the information required that is requested not copies of documents.In this case if you provide clarification of the information you require from these forms, we may re-consider your request."
56.It is understood that the Council was referring to the Court of Session ruling in the case of Glasgow City Council v Scottish Information Commissioner 2009 CSIH 73 (issued on 30 September 2009) (the Court of Session judgement)[2].The implication appears to be that the Council considered Mr Smart's request for the recording forms to be invalid, as he was seeking copies of documents rather than the information within the documents, although the Council did not make this explicit in its letter to Mr Smart.
57.The Commissioner has published guidance on the implications of the Court of Session judgement[3], which states:
"?where an applicant has asked for a copy of a document and it is reasonably clear in the circumstances that it is the information recorded in the document which the applicant wants, the public authority should respond to the request as a request properly made under FOISA. A reference to a specific document is a commonplace way of describing the information sought and can be of assistance to an authority in identifying and locating the information."
58.The Commissioner notes that the Council provided Mr Smart with a web link to his guidance on the Court of Session judgement in its email of 8 February 2010.
59.The Commissioner's guidance on the Court of Session judgement was published on 27 January 2010, only a few days before the Council wrote to Mr Smart on 8 February 2010.The Council made no further suggestion in the course of the investigation that the request was invalid (in a context in which the Commissioner clearly considered it to be valid), while presenting arguments as to why certain information should be withheld and acknowledging that it had not dealt with Mr Smart's request for review in accordance with Part 1 of FOISA.In the circumstances, the Commissioner does not consider it necessary to comment further on the matter, except to suggest that the purpose of the Council's initial reference to the Court of Session judgement could perhaps have been made clearer.
DECISION
The Commissioner finds that Fife Council (the Council) failed to comply in full with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Smart.
The Council provided some information covered by Mr Smart's request, in compliance with section 1(1) of FOISA, and correctly withheld certain information under section 38(1)(b) of FOISA.
However, the Council failed to provide Mr Smart with certain other information to which he was entitled under section 1(1) of FOISA.The Council also failed to respond to Mr Smart's request for review within 20 working days, as required by section 21(1) of FOISA.In these respects, the Council failed to comply with Part 1 of FOISA.
The Commissioner requires the Council to provide Mr Smart with the information described in paragraph 43 of the Decision Notice, by 2 December 2010.
Appeal
Should either Mr Smart or Fife Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
11 October 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6)This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
?
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a)at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.scotland.gov.uk/Resource/Doc/302580/0094711.pdf
[2] http://www.scotcourts.gov.uk/opinions/2009CSIH73.html
[3] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/CourtofSessionGuidance2010/Validrequests.aspx
