Decision 178/2015: Mr T and the Scottish Prison Service URLs accessed by an employee Reference No: 201501663 Decision Date: 12 November 2015 Summary On 22 July 2015, Mr T asked the Scottish Prison Service (the SPS) for URLs accessed by an employee between specified dates. The SPS responded by stating it did not hold this information. Following a review, Mr T remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that the SPS did hold information falling within the scope of Mr T's request. She required the SPS to consider Mr T's requirement for review again, and communicate a fresh outcome to him.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 17(1) (Notice that information is not held)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 22 July 2015, Mr T made a request for information to the SPS. He asked for:

"In relation to access by [named employee] to worldwide web ("www") sites between 1 March and 30 April 2015 in connection with [their] employment by the SPS, whether using SPS or other IT facilities, please provide full details of each universal Resource Locator ("URL") accessed (i.e. "address", date, time, website name) held by the authority or by the [ ] in connection with [their] SPS employment."

2. The SPS responded on 10 August 2015, issuing a notice to the effect that the information was not held.

3. On 12 August 2015, Mr T wrote to the SPS requesting a review of its decision. He queried the interpretation of his request by the SPS, and commented it was inconceivable that the information he sought would not be recorded and held. He also criticised the SPS for failing to acknowledge the possibility of information being held directly by the employee themselves or by an Internet Service Provider (ISP) on their behalf.

4. The SPS notified Mr T of the outcome of its review on 31 August 2015. It upheld its original decision, but provided a more detailed explanation of why it did not consider the information to be held: basically, it did not consider itself able to extract information specific to the individual's employment.

5. On 9 September 2015, Mr T wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr T explained why he considered the information to be held by the SPS.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr T made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. The case was allocated to an investigating officer. On 15 September 2015, the SPS was notified in writing that Mr T had made a valid application.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SPS was invited to comment on this application and answer specific questions, with reference to the searches carried out for the information and its interpretation of the request.

9. The SPS provided its submissions on 29 October 2015, with the logs of the URLs it had identified in its searches.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to her by both Mr T and the SPS. She is satisfied that no matter of relevance has been overlooked.

Whether information is held

11. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received.

12. Under section 17(1) of FOISA, where an authority receives a request for information it does not hold, it must give an applicant notice in writing to that effect. In this case, the Council issued Mr T with such at notice.

13. The SPS was asked if it wished to comment on Mr T' suggestion that it had misinterpreted his request. The SPS submitted that the request was correctly interpreted, as evidenced by the supporting documents it supplied listing all URLs accessed by the employee in question over the specified timeframe.

14. In the light of the fact that it clearly held records of URLs accessed, the SPS was also asked to consider again whether it held any data within the scope of Mr T's request. The SPS argued that the information it held was all the URLs, and associated URLs, of sites accessed by the employee. This was not the same as the URLs accessed "in connection with his employment" as specified by Mr T in his request. The SPS argued that it did not hold the information Mr T described in his request, only all URLs accessed without a record of their purpose. These might include URLs accessed in connection with the individual's employment, but there was no record of which these were.

15. In support of its position, the SPS further explained that SPS employees with access to the internet were able to use it for matters not in connection with their employment, subject to its "Internet Acceptable Use Policy". Internet use was logged for monitoring purpose, but this did not enable it to extract readily those URLs accessed for employment, as opposed to personal, purposes.

16. The Commissioner notes the explanations provided by the SPS. In this case, the issue is not whether the authority has identified all records of URLs accessed by the named employee and falling within the specified timeframe. From the SPS's submissions and the logs provided, the Commissioner is satisfied that it has. The issue is rather whether, and to what extent, this information falls within the scope of Mr T's request.

17. The Commissioner has considered carefully all submissions she has received on the interpretation of the request. The records of URLs accessed held by the SPS clearly include all the information sought by Mr T. The information he seeks may not be readily separable from information relating to personal internet use, but the Commissioner does not consider that to mean there is no information held by the SPS which falls within the scope of his request.

18. The full set of information (i.e. records of internet use, at an individual level) is held by the SPS for monitoring purposes and the Commissioner presumes it must be capable of being interrogated usefully for such purposes, within the law, in the context of the "Internet Acceptable Use Policy" identified by the SPS. It contains the information sought by Mr T, even if there is not a discrete subset of information readily identifiable by reference to the request, and the Commissioner must conclude that this is information captured by the request. There may be valid reasons, associated with its extraction, for not providing it in response to a request under section 1(1) of FOISA, but that is another matter.

19. In all the circumstances, therefore, the Commissioner finds that the SPS was incorrect to notify Mr T that it held no information falling within the scope of his request. In doing so, the SPS misapplied section 17(1) of FOISA and failed to deal with Mr T's request in accordance with Part 1 (and in particular section 1(1)) of FOISA.

20. In light of her findings above, the Commissioner now requires the SPS to re-consider the outcome of its review and issue a revised decision to Mr T, other than in terms of section 17(1) of FOISA. This will be a decision in terms of section 21(4)(b) of FOISA, that is a decision substituting a different decision for its original decision on Mr T's request.

Decision The Commissioner finds that the SPS failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr T. The SPS was not entitled to notify Mr T, in terms of section 17(1) of FOISA, that it did not hold any information falling within the scope of his request. In doing so, it failed to comply with section 1(1) of FOISA. The Commissioner therefore requires the SPS to issue a revised review outcome to Mr T, in terms of section 21(4)(b) of FOISA, by 29 December 2015.

 Appeal

Should either Mr T or the SPS wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the SPS fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the SPS has failed to comply. The Court has the right to inquire into the matter and may deal with the SPS as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

12 November 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

?