Decision 185/2021: Allegations against named former Police Officer
Public authority: Chief Constable of Police Service of Scotland
Case Ref: 202100389
Summary
Police Scotland were asked for confirmation of any previous allegations reported to them about a named former Police Officer.
Police Scotland refused to confirm or deny whether they held the information. The Commissioner investigated and found that Police Scotland were entitled to refuse to confirm or deny whether they held the information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6)) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2A)(a), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 13 January 2021, the Applicant made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). The information requested was:
Using FOI regarding the retired cop [name], were there any previous allegations reported to the police before the reports that brought [specified case] to trial and his conviction?
2. Police Scotland responded on 5 February 2021. In doing so, Police Scotland applied section 18 of FOISA and refused to confirm or deny whether the requested information existed, or whether they held them. Police Scotland stated that it was contrary to the public interest to reveal whether the information existed or was held, as the overwhelming public interest lay in protecting the individual's right to privacy and the public's expectation of confidence in Police Scotland as regards their information.
3. If the information were held, Police Scotland stated that it would be exempt under section 38(1)(b) and 38(2A) of FOISA, as the request was for personal data and disclosure would contravene the data protection principles.
4. On 8 February 2021, the Applicant wrote to Police Scotland, requesting a review of their decision not to disclose information they might hold about the former Police Officer. He did not agree with the Police Scotland decision.
5. Police Scotland notified the Applicant of the outcome of their review on 25 March 2021. Police Scotland upheld their original decision that it was not in the public interest for them to publicly confirm whether or not they held the requested information. Police Scotland submitted that to do so, even if refusing to provide it, would confirm that a named individual had been subject to a police investigation and had been convicted of a crime.
6. Police Scotland also upheld their decision that, if information were held, it would be exempt from disclosure under section 38(1)(b) of FOISA. They also noted that other exemptions would be applicable, in addition, if the information were held.
7. Also on 25 March 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of Police Scotland's review because he believed there might have been complaints about the named former Police officer in the past, which might have been covered up.
Investigation
8. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
9. On 9 April 2021, Police Scotland were notified in writing that the Applicant had made a valid application. The case was allocated to an investigating officer.
10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and to answer specific questions. These related to their reasons for neither confirming nor denying whether they held the information, or whether it existed, and to the potential application of the exemptions cited in their responses to the Applicant.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and Police Scotland. He is satisfied that no matter of relevance has been overlooked.
12. As mentioned above, Police Scotland are relying on section 18 of FOISA, read in conjunction with a number of exemptions, including section 38(1)(b) of FOISA. The Commissioner will consider section 38(1)(b) first in this case, only going on to look at the other exemptions cited by Police Scotland if it is not considered applicable in the circumstances.
Section 18(1) - "neither confirm nor deny"
13. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:
- a request has been made to the authority for information, which may or may not be held by it;
- if the information existed and were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and
- the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
14. Where a public authority has chosen to rely on section 18(1), the Commissioner must establish whether the authority is justified in claiming that to reveal whether the information exists or is held would be contrary to the public interest. He must also establish whether, if the information existed and were held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1) and cited by the authority.
15. Where section 18(1) is under consideration, the Commissioner must ensure that his decision does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means he is unable to comment in any detail, in this case, on Police Scotland's reliance on any of the exemptions referred to, or on other matters that could have the effect of indicating whether the information existed or was held by Police Scotland.
Section 38(1)(b) - Personal information
16. Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data", as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
Would the information be personal data?
17. "Personal data" is defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular with reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."
18. The Applicant has named the individual about whom he wants Police Scotland to confirm any previous allegations they might have received. In his request, the Applicant also referred to a court case involving the named individual.
19. Police Scotland considered the information, if held, would be "personal data" given that the data subject had been identified and all of the information requested would, if held, relate to him.
20. The Commissioner notes that the Applicant's information request makes specific reference to a named individual and it is solely that named individual he is seeking information about - specifically, whether any allegations (other than those covered by a specified court case) against that named individual were held by Police Scotland. The Commissioner is satisfied that, if this information did exist and were held by Police Scotland, it would clearly relate to an identified or identifiable living individual. The Commissioner therefore accepts that, if it existed and were held, the information would be personal data as defined in section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
21. Police Scotland argued that disclosing the personal data, if it existed and were held, would breach the first data protection principle. This requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject" (Article 5(1)(a) of the UK GDPR).
22. Police Scotland also submitted that, if the personal data existed and were held, it would relate to criminal convictions and offences or related security measures: it would therefore be subject to section 10 of the DPA 2018 (and Article 10 of the UK GDPR), and there would be no lawful basis for processing such data in response to the request.
23. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". For the purposes of FOISA, personal data are processed when disclosed in response to a request. This means that personal data could only be disclosed if disclosure would be both lawful (i.e. it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Articles 6(1)(f) of the UK GDPR
24. In considering lawfulness, the Commissioner must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the personal data to be disclosed.
25. Police Scotland considered the only lawful basis in Article 6(1) of the UK GDPR which could potentially allow disclosure of the information, if it existed and were held, would be condition (f).
26. The Commissioner agrees that condition (f) is the only one which could potentially apply, assuming the personal data existed and were held. This condition states that processing shall be lawful if it is "necessary for the purposes of the legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
27. Although Article 6(1) states that this condition cannot apply to processing carried out by a public authority in performance of its tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
28. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Would the Applicant have a legitimate interest in obtaining personal data, if held?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?
Would the Applicant have a legitimate interest in obtaining the personal data, if held?
29. Police Scotland acknowledged that, while they had not sought details of the Applicant's particular interest in the personal data, assuming it existed and were held, they were prepared to accept that he had a legitimate interest in obtaining the personal data. Police Scotland acknowledged that people can have a legitimate interest in obtaining this type of information for all kinds of reasons.
30. In the circumstances, the Commissioner is satisfied that the Applicant is pursuing a legitimate interest in seeking this information. He is also satisfied that this legitimate interest would embrace a wider public interest, in being satisfied that allegations made against an individual are appropriately investigated by the Police. The Commissioner is therefore satisfied that, if it existed and were held, the Applicant would have a legitimate interest in obtaining the personal data.
Would disclosure be necessary?
31. The next question is whether disclosure of personal data (if held) would be necessary to achieve that legitimate interest. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests could reasonably be met by means which interfered less with the privacy of the data subject.
32. The Commissioner has considered the scope of the Applicant's request. Police Scotland have noted that it is not clear from the request whether the Applicant is interested in any and all allegations, or simply those of a particular nature (related to the conviction referred to in the request). The Commissioner is satisfied that the request is capable of covering any and all allegations made to the Police in respect of the individual concerned.
33. In the Commissioner's view, the only way the Applicant's legitimate interest could be met in this case would be by viewing the information he requested (assuming it existed and were held). Only then would he be able to satisfy himself as to whether any other allegations had been made against the named former Police officer.
34. Police Scotland explained that there were very limited circumstances in which they would disclose third party personal data on request outwith FOISA. They queried whether it would ever be necessary for personal data of this kind to be disclosed through FOISA.
35. In all the circumstances, the Commissioner accepts that disclosure of the personal data sought in this case (if it existed and were held) would be necessary to fulfil the Applicant's legitimate interest.
The data subject's interests or fundamental rights and freedoms (and balancing exercise)
36. The Commissioner has concluded that the disclosure of the information (if in existence and and held) would be necessary to meet the Applicant's legitimate interests. However, this must be balanced against the interests, fundamental rights and freedoms of the data subject (the individual named in the request). Only if the legitimate interests of the Applicant outweighed those of the data subject could personal data be disclosed without breaching the first data protection principle.
37. The Commissioner has considered the submissions from both parties carefully, in the light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[1]. He is unable to set out, in detail, the arguments put forward by Police Scotland.
38. The Commissioner's guidance[2] on section 38 of FOISA notes that, in carrying out the balancing exercise, much will depend on the reasonable expectations of the data subject. Factors which will be relevant in determining reasonable expectations include:
(i) whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
(ii) the potential harm or distress that may be caused by disclosure
(iii) whether the individual objected to the disclosure.
39. Police Scotland submitted that (particularly when it comes to offence information, but also in relation to any information) individuals overwhelmingly have a right to privacy and that right should only be overridden in exceptional circumstances.
40. The Commissioner recognises that, to the extent that there is no presumption in favour of the disclosure of the personal data under FOISA (as the Supreme Court acknowledged in the South Lanarkshire Council case, cited above), that is correct, although equally the General Data Protection Regulation, the UK GDPR and the DPA 2018 have all been enacted with the possibility of disclosure of personal data under Freedom of Information in mind. The question for the public authority, and the Commissioner, is to strike the appropriate balance between those privacy rights and the public's right to information.
41. The Commissioner has considered the reasonable expectations of the data subject in this case, and the potential harm or distress that could be caused by disclosure of the information (if it existed and were held). Disclosure under FOISA is a public disclosure. He has borne in mind the scope of the request, as noted above: it relates not just to allegations of a nature similar to the conviction referred to by the Applicant, but to any allegations, of whatever nature and whether proceeded with or substantiated, received by the Police in relation to the individual concerned. At that most general level, disclosing whether or not an individual had or had not been the subject of allegations to the Police would be likely (even if they had been convicted of a specific offence, a fact which does not negate the broader right to privacy) to impact on that individual's reasonable expectations of privacy and cause them some degree of harm or distress.
42. After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights and freedoms of the data subject, the Commissioner finds that the legitimate interests served by disclosure of any information held would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the individual in question in this case.
43. In all the circumstances of this particular case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the personal data sought by the Applicant (assuming it existed and were held).
Fairness and transparency
44. Given that the Commissioner has concluded that the processing of the personal data, if existing and held, would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject.
Conclusion on the data protection principles
45. For the reasons set out above, the Commissioner is satisfied that disclosure of any relevant personal data, if it existed and were held, would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Having reached this conclusion, he need not go on to consider the status of such personal data as data relating to criminal convictions and offences or related security measures.
46. In all the circumstances, the Commissioner is satisfied that such personal data would be exempt from disclosure under section 38(1)(b) of FOISA and that Police Scotland could give a refusal notice under section 16(1) of FOISA, on the basis that the information would be so exempt. Having reached this conclusion, the Commissioner does not need to consider the relevance of the other exemptions referred to in Police Scotland's review outcome.
Section 18(1) - The public interest
47. The Commissioner must now consider whether Police Scotland were entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.
48. In their submissions, Police Scotland commented that it is essential, when asked about third-party criminality or alleged criminality, or whether someone has been the subject of allegations or been investigated, that section 18 of FOISA is applied. Otherwise, Police Scotland would, they asserted, be effectively background checking people on request. It was, Police Scotland submitted, clearly not in the public interest for them to publicly confirm whether a particular individual has been the subject of Police attention.
49. Police Scotland accepted there was a public interest in better informing the public as to the perceived risk that certain individuals might pose. However, they believed the overwhelming public interest to lie in protecting an individual's right to privacy and ensuring that personal information was processed in accordance with the DPA 2018.
50. Anything other than a section 18 response to a request such as that made by the Applicant would, in Police Scotland's view, be unlawful in most cases and not, therefore, in the public interest.
51. Police Scotland explained to the Commissioner circumstances in which offending behaviour would be disclosed and the reasons for that.
52. In his submissions, the Applicant commented that he was concerned there might have been complaints made about the named former Police officer in the past, which might have been covered up.
53. The test the Commissioner must consider is whether (having already concluded that the information, if it existed and were held, would be exempt from disclosure) it would have been contrary to the public interest to reveal whether the information existed or was held.
54. The Commissioner has fully considered the submissions from the Applicant and appreciates that, where an individual has been convicted of a serious offence, there is a public interest in understanding whether any previous allegations have been made against that individual. It appears to the Commissioner that this public interest is recognised by Police Scotland, taking account of the mechanisms in place to allow the disclosure of offending behaviour in certain defined circumstances.
55. However, the Commissioner is aware that, in this case, the action of confirming or denying whether the information existed or was held would have had the effect of revealing, through public disclosure, whether the individual concerned had been the subject of any other allegations. The Commissioner has concluded that this could not be done in line with the requirements of Data Protection legislation, and doing so contrary to those requirements would clearly not be in the public interest. In the circumstances, the Commissioner must accept that it would have been contrary to the public interest for Police Scotland to reveal whether they held the requested information, or whether that information existed.
56. Consequently, the Commissioner is satisfied that Police Scotland were entitled to refuse to confirm or deny whether the information requested by the Applicant existed or was held, in accordance with section 18(1) of FOISA.
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
16 November 2021
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
…
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
…
(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided -
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
…
