Decision 180/2016: Ms X and the Chief Constable of the Police Service of Scotland Information relating to a specified incident Reference No: 201600845 Decision Date: 24 August 2016  Summary On 20 November 2015, Ms X asked the Chief Constable of the Police Service of Scotland (Police Scotland) for information relating to a specified incident. Police Scotland refused to confirm or deny whether they held any information, but stated that if the information was held, it would be personal data and its disclosure under FOISA would be unlawful. Following a review, in which Police Scotland upheld their original decision in full, Ms X remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that Police Scotland were entitled to refuse to confirm or deny whether they held the information, and had therefore responded to Ms X's request for information in accordance with Part 1 of FOISA.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(i) (Effect of exemptions); 16(1) (Refusal of request); 18(1) (Further provision as respects responses to requests); 38(1)(a) and (5) (Definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data")

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 20 November 2015, Ms X made a request for information to Police Scotland. Enclosing a copy of an earlier request dated 13 February 2015 in which she had sought information relating to a specified incident, Ms X asked Police Scotland to provide the information requested in that letter as a matter of urgency.

2. Police Scotland confirmed receipt of Ms X's request on 1 December 2015.

3. On 23 January 2016, Ms X wrote to Police Scotland querying why they had not responded to her request, and asking them to provide the information requested.

4. Police Scotland replied to Ms X on 8 February 2016. They informed her that, according to their records, their response to her information request had been posted on 8 December 2015. Police Scotland provided her with a further copy by email. In their response, Police Scotland refused to confirm or deny whether they held the information requested, relying on section 18(1) of FOISA. They informed Ms X that the use of this provision was in conjunction with section 38(1)(a) and (b) of FOISA which exempted disclosure of the requester's own personal data or that of third parties. Police Scotland explained that individuals could access their own personal data by making a Subject Access Request (SAR) under the DPA, and provided Ms X with advice on that process.

5. On 12 February 2016, Ms X wrote to Police Scotland requesting a review of their decision on the basis that Police Scotland had not provided the information requested. Ms X believed FOISA extended the right of individuals to access information about themselves under the DPA, and allowed public access to all types of information held. She again asked Police Scotland to provide all information relating to herself, her children and to the police involvement in the specified incident, acknowledging this may require some redaction.

6. Police Scotland replied to Ms X on 12 February 2016, asking her to confirm whether she was seeking a review of their response under FOISA, or whether she wished to proceed with her request under the DPA. In response, Ms X asked Police Scotland to provide her with the information she had requested in accordance with the requisite legislation, i.e. FOISA and the DPA.

7. Ms X wrote again to Police Scotland on 3 March 2016 confirming she wished them to carry out a review under FOISA. She also asked them to provide all personal data relating to herself and her children under the DPA.

8. Police Scotland notified Ms X of the outcome of their review on 9 March 2016, upholding their original decision without modification. Police Scotland explained that if the information was held, it would be personal data and its disclosure under FOISA would breach the first data protection principle relating to the fair and lawful processing of personal data. They again provided Ms X with advice on requesting first party personal data through the SAR process under the DPA.

9. On 1 May 2016, Ms X wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. Ms X stated she was dissatisfied with the outcome of Police Scotland's review because she believed that Police Scotland had acted unlawfully in relation to the incident in question, and was seeking to establish all information held to allow clarification of the legal grounds and rationale underpinning their actions.

Investigation

10. The application was accepted as valid. The Commissioner confirmed that Ms X made a request for information to a Scottish public authority and asked the authority to review their response to that request before applying to her for a decision.

11. On 8 June 2016, Police Scotland were notified in writing that Ms X had made a valid application and the case was allocated to an investigating officer.

12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions. In particular, they were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested, with specific reference to sections 18(1) and 38(1)(a) and (b) of FOISA.

13. Police Scotland confirmed they were relying upon section 18(1) of FOISA in conjunction with section 38(1)(a) and (b), and provided reasons for maintaining this position.

14. The investigating officer also wrote to Ms X explaining the provision in section 18(1) of FOISA, specifically in relation to the consideration of personal data. As Police Scotland were maintaining reliance on section 18(1), Ms X was also invited to provide her comments on the case, in particular any legitimate interest she may have which would allow disclosure of the information without breaching the DPA (assuming the information she sought existed and was held by Police Scotland). Ms X did not respond.

Commissioner's analysis and findings

15. In coming to a decision on this matter, the Commissioner has considered all of the relevant submissions, or parts of submissions, made to her by both Ms X and Police Scotland. She is satisfied that no matter of relevance has been overlooked.

Section 18(1) of FOISA - "nether confirm nor deny"

16. Police Scotland refused to confirm or deny whether they held any information falling within the scope of Ms X's request. They adhered to this position in their submissions to the Commissioner.

17. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

? a request has been made to the authority for information which may or may not be held by it;

? if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA;

? the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

18. Where a public authority has chosen to rely on section 18(1), the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1).

19. In any case where section 18(1) is under consideration, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.

20. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if held, would be exempt information under one or more of the listed exemptions. Where the exemption(s) is/are subject to the public interest test in section 2(1)(b) of FOISA, the authority must also be able to satisfy the Commissioner that the public interest in maintaining the exemption(s) outweighs any public interest there would be in releasing any relevant information, if held.

21. In this case, Police Scotland submitted that if they held any information falling within the scope of Ms X's request, it would be exempt from disclosure under sections 38(1)(a) and 38(1)(b) of FOISA.

22. The Commissioner must first consider whether Police Scotland could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and was held; in other words, whether Police Scotland could have refused to provide the information on the grounds that it was exempt from disclosure under either section 38(1)(a) or section 38(1)(b) of FOISA, if they held it.

Section 38(1)(a) - Personal information of the data subject

23. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject. The fact that it is an absolute exemption means that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.

24. This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data, commonly known as a SAR, under section 7 of the DPA. This ensures that such information is disclosed to the data subject (rather than to the world at large, which is the effect of disclosure under FOISA) under a regime designed for such purposes.

25. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

26. Police Scotland considered that the information sought by Ms X in her request would comprise her own personal data, if held.

27. Having considered the terms of Ms X's request, the Commissioner is satisfied that, if held, all of the request would be for information which is Ms X's own personal data, as defined by section 1(1) of the DPA. She accepts that such information, if held, would be exempt from disclosure under section 38(1)(a).

28. As the Commissioner has determined that all of the information, if held, falling within the scope of Ms X's request, would be exempt from disclosure under section 38(1)(a), she is not required to go on to consider the application of section 38(1)(b).

Conclusion on section 16(1)

29. Having accepted that Police Scotland could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(a) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether Police Scotland were entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

The public interest - section 18(1)

30. In her application to the Commissioner, Ms X provided reasons why she believed the information she was seeking, if held, should be disclosed. These related to her belief that Police Scotland had acted in dereliction of their legal duties in relation to the incident in question, and that it was in the public interest that all information held by them in connection with this incident be disclosed. This, Ms X argued, would allow scrutiny of the legal grounds and rationale behind the actions taken by Police Scotland.

31. Police Scotland submitted that it was in the public interest that they neither confirm nor deny whether they held any information covered by Ms X's request under section 18(1) of FOISA. They submitted that to reveal whether the information was held, this would publicly confirm whether Ms X had, or had not, been involved in a specific incident.

32. Police Scotland took the view that the information, if held, would be classed as sensitive personal data under the terms of the DPA and must therefore be processed in accordance with the principles of that Act.

33. Police Scotland acknowledged there was a public interest in enabling individuals to access information under FOISA. Given there was a recognised separate process for individuals to obtain their own personal data through the SAR provisions of the DPA, Police Scotland argued that the public interest lay in ensuring requests for personal data were handled appropriately, not only to ensure compliance with the DPA but also to protect the rights and freedoms of the data subjects to whom the information related.

34. For these reasons, Police Scotland took the view that the public interest lay in refusing to confirm or deny whether they held the information requested by Ms X, by applying section 18(1) of FOISA.

35. Having considered the arguments submitted by both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for Police Scotland to disclose whether the information requested by Ms X existed or was held by them.

36. As a result, the Commissioner is satisfied that Police Scotland were entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether they held the information requested by Ms X, or whether such information existed.

Decision The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Ms X.

Appeal

Should either Ms X or the Chief Constable of the Police Service of Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

24 August 2016

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

(i) paragraphs (a), (c) and (d); and

?

16 Refusal of request

(1) Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-

(a) discloses that it holds the information;

(b) states that it so claims;

(c) specifies the exemption in question; and

(d) states (if not otherwise apparent) why the exemption applies.

?

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

?

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?