Decision 185/2017: Mr Keith Banks and the Chief Constable of the Police Service of Scotland Intelligence/surveillance using section 29 of the Data Protection Act 1998 Reference No: 201701142 Decision Date: 9 November 2017 Summary Police Scotland were asked for records of intelligence gathering and surveillance undertaken in terms of section 29 of the DPA, and related procedures. Police Scotland stated that they did not hold any of the information described. The Commissioner was satisfied that this was correct, or alternatively that providing any information held would certainly exceed the £600 cost limit.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 12(1) (Excessive cost of compliance); 17(1) (Notice that information is not held)

The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost - prescribed amount)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 22 March 2017 Mr Banks made a request for information, in two parts, to Police Scotland. He asked:

(i) Can you provide me with all recorded information obtained by Police Scotland, including the legacy Northern Constabulary, in terms of the employment of s29 of the DPA [Data Protection Act]1998 for the purpose or purposes of intelligence gathering, surveillance, and possibly for other police enquiries, pertaining to a person or persons that for policing purposes have been deemed suspects, accused, or witnesses.

(ii) Can you provide me with the procedures in terms of the recorded information as contained in the current SOP [Standard Operating Procedure], and for the legacy Norther Constabulary FRD [Force Reference Document], that states and prescribes that S29 of the DPA 1998 can be employed lawfully, to request and obtain personal data for intelligence/surveillance or possibly for future investigations, about any person that is deemed to be of interest to the police, eg for the detection or the prevention of crime, from any controller?

2. Police Scotland responded on 19 April 2017, referring to a response they had given to a previous request from Mr Banks but otherwise confirming that they did not hold the information Mr Banks sought.

3. Later that day, Mr Banks wrote to Police Scotland, requesting a review of their decision. He believed there was information held demonstrating the use of section 29 by Police Scotland for intelligence gathering, surveillance and future investigation purposes and that it could be provided under FOISA.

4. Police Scotland notified Mr Banks of the outcome of their review on 18 May 2017, upholding the original response without modification. Police Scotland confirmed they did not hold information meeting the terms of the request.

5. On 29 June 2017, Mr Banks wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Banks stated he was dissatisfied with the outcome of Police Scotland's review because he maintained information was held which was capable of addressing the terms of his request and that it should be disclosed to him under FOISA.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Banks made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 5 July 2017, Police Scotland was notified in writing that Mr Banks had made a valid application. The case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland was invited to comment on this application and answer specific questions, focusing on the steps taken to identify and locate any relevant information held.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Banks and Police Scotland. He is satisfied that no matter of relevance has been overlooked.

10. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received, subject to qualifications which are not applicable in this case.

11. Police Scotland issued a notice to Mr Banks to the effect that it did not hold the information he sought. Under section 17(1) of FOISA, where an authority receives a request for information it does not hold, it must give the applicant notice in writing to that effect.

12. The standard proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.

Information held by Police Scotland

13. The investigating officer asked Police Scotland for details and evidence of the searches conducted for information falling within the scope of each part of Mr Banks' request.

14. Police Scotland explained that their Information Management team based in Inverness handled the searches. As this team was made up of staff from the former Northern Constabulary, there was sufficient expertise available to undertake the kind of searches needed. These staff had many years' experience in the department and understood what information was held.

Part (i)

15. With regard to the first part of the request, the investigating officer asked Police Scotland to provide excerpts from their Records Management Policy or Retention Schedules which were capable of describing any information concerning "intelligence weeding" processes for records reaching 12 months, then 3, 5 and 10 years old (as described in Police Scotland's original response to Mr Banks). They were asked to comment on whether they considered this document to fall within the scope of Mr Banks' request.

16. Police Scotland referred to the relevant section on page 41 of their Record Retention SOP (available on the Police Scotland website[1]) which listed "Intelligence Recording" retention actions at intervals of 1, 3, 5 and 10 years, with notes and examples of records illustrating this procedure. Police Scotland clarified that they did not consider any part of this document to fall within the scope of Mr Banks' request.

17. Police Scotland explained that the request was "interpreted as seeking recorded information which set out the manner in which section 29 of the DPA was utilised by Police Scotland as an authority for requesting personal data". Police Scotland also stated that the series of SOPs and other guidance documents "would be the logical source of that information", and believed they held no further information capable of addressing Mr Banks request.

18. Police Scotland were asked to comment on the searches that would be needed to identify the day-to-day use of section 29 of the DPA in the normal course of police business (which appeared to be what was sought in part (i) of the request). Police Scotland explained that they searched their records pertaining only to the former Tayside Police area, and restricted this to just one day's records for 1 September 2017. They identified 109 "hits" (records) for this single day. Police Scotland explained that if they then allowed on average 30 minutes to research each hit and make an assessment of whether section 29 of the DPA was used. On this basis, they estimated they could only research about 80 crime reports within the £600 cost limit which applies for the purposes of section 12(1) of FOISA.

19. Section 12(1) provides that a Scottish public authority is not obliged to comply with an information request where it estimates that the cost of doing so would exceed the amount prescribed for that purpose in the Fees Regulations (currently £600). Consequently, the Commissioner has no power to order a public authority to disclose information should he find that the cost of responding to a request for that information exceeds this sum.

20. The relevant provisions of the Fees Regulations are set out in Appendix 1. Normally, the Commissioner would expect to be presented with a more robust sample when considering cost estimates, with more detail on the assumptions applied by the authority. In this case, however, it is readily apparent to the Commissioner that the cost of addressing such an all-embracing request, in relation to relatively routine police activity, would reach the £600 limit very quickly. The Commissioner must also question whether the information could be said to be held at all: the degree of professional judgement required to determine whether section 29 applied in any given case might justifiably be said to take the exercise out of the realms of a search for information held by the authority.

21. Either way, the Commissioner is satisfied that Police Scotland were not required to respond to part (i) of Mr Banks' request in any way which involved the provision of information or any decision to withhold information under an exemption.

Part (ii)

22. In their original response to Mr Banks' request, Police Scotland referred to a response they had given to another request from Mr Banks and provided a copy. In that other response, he was supplied with a copy of a document entitled Requests for Personal Information from External Bodies SOP, which they considered fell within the scope of the second part of Mr Banks request. With regard to legacy force documents, they had informed Mr Banks that nothing was held.

23. Police Scotland explained that the SOP in question was "owned", and in current use, by Information Management, who had dealt with the original request. They considered this document to be the logical source of any procedural information relevant to the request and the staff in question would have been fully familiar with it. Having considered the document in question and this explanation, the Commissioner is satisfied that it contains the current procedural information held by Police Scotland and falling within the scope of part (ii) of the request.

24. With regards to "legacy" Northern Constabulary documents, Police Scotland also supplied the investigating officer with a list of all FRDs which existed for that force prior to the formation of Police Scotland. There are 265 documents on this list. Police Scotland contended that the titles of the FRDs listed were self-explanatory, and that it was clear that no further information was held which was capable of addressing this part of Mr Banks' request (i.e. there was no Northern Constabulary equivalent of the current Requests for Personal Information from External Bodies SOP). Having considered the list and Police Scotland's submissions, the Commissioner is satisfied that this is the case: there is no further information held which is capable of addressing part (ii) of Mr Banks' request.

25. In other words, the Commissioner is satisfied that Police Scotland's response to part (ii) of the request was correct in terms of Part 1 of FOISA.

Decision The Commissioner finds that Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Banks.

  Appeal

Should either Mr Banks or the Chief Constable of the Police Service of Scotland (Police Scotland) wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If Police Scotland fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that Police Scotland has failed to comply. The Court has the right to inquire into the matter and may deal with Police Scotland as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

9 November 2017

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

 

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

12 Excessive cost of compliance

(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.

…

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

…

Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004

3 Projected costs

(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.

(2) In estimating projected costs-

(a) no account shall be taken of costs incurred in determining-

(i) whether the authority holds the information specified in the request; or

(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and

(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed £15 per hour per member of staff.

5 Excessive cost - prescribed amount

The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is £600.

---