Decision 186/2018: Scottish Independence Referendum count: postal vote tallying allegations

Public authority: Chief Constable of the Police Service of Scotland
Reference No: 201701609

Summary

Police Scotland were asked about their investigation into the alleged illegal tallying of postal votes during the Scottish Referendum count.

After an investigation, the Commissioner agreed that some of the information held by Police Scotland was exempt from disclosure under sections 34 and 38 of FOISA. However, he ordered Police Scotland to disclose some of the information they held, including, unusually, the names of some witnesses.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 12(1) (Excessive cost of compliance); 34(1)(a) and (b) (Investigations by Scottish public authorities and proceedings arising out of such investigations); 38(1)(b), (2)(a)(i) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA 1998) section 1(1) (definition of "personal data" (Basic interpretative provisions); Schedule 1 Part I - The principles (first data protection principle); Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data (condition 6(1))

Data Protection Act 2018 (the DPA 2018) Schedule 2, paragraph 56 (Transitional provision etc.)

General Data Protection Regulation (the GDPR) Articles 5(1) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing)

The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost - prescribed amount)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. Between 29 September 2015 and 30 August 2016, Mr S made a number of information requests to the Chief Constable of the Police Service of Scotland (Police Scotland) about the year-long investigation into alleged postal ballot illegalities during the Scottish Independence Referendum.

2. The responses received from Police Scotland were first considered by the Commissioner in Decision 111/2017 Mr S and the Chief Constable of the Police Service of Scotland[1], which was issued on 17 July 2017. The Commissioner found that Police Scotland had failed to evidence that they had identified and located all the information they held which fell within the scope of the Mr S' requests of 8 December 2015 and 8 August 2016. The Commissioner therefore required Police Scotland to carry out additional searches and to issue a new response to Mr S' request for review.

3. Police Scotland complied with Decision 111/2017 on 31 August 2017. They told Mr S that no crime report was held in relation to any offence of postal vote tallying or counting in relation to the 2014 Scottish Independence Referendum. They stated that there was no category specific to election related offences which could be searched in relation to incidents (i.e. initial reports and allegations) recorded on the various command and control systems in use. They stated that it would be necessary to review all potentially relevant records on a case-by-case basis, which would far exceed the cost limit of £600 set out in the relevant Fees Regulations.

4. Police Scotland also told Mr S that, notwithstanding the above, they had traced individual Police Officers who were involved in inquiries relating to postal vote tallies and had conducted searches of their notebooks, their email accounts, their storage areas on the shared network and personal drives. Police Scotland listed the information retrieved by these searches and told Mr S that it was exempt from disclosure under section 38(1)(b) and section 34(1)(a) and (b) of FOISA (respectively, the exemptions for third party personal data and investigations by Scottish public authorities and proceedings arising out of such investigations).

5. On 5 September 2017, Mr S applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of Police Scotland's review because of the refusal to carry out full searches on grounds of excessive cost. He challenged the view that some information was third party personal data which could not be disclosed under FOISA, and expressed concern that "the default setting" was to withhold information from the items which Police Scotland had found.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr S made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 18 October 2017, Police Scotland were notified in writing that Mr S had made a new, valid application. Police Scotland had previously provided the Commissioner with information withheld from Mr S. The case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and to answer specific questions, including justifying their reliance on any provisions of FOISA they considered applicable to the information requested.

9. During the investigation, Police Scotland were asked further questions about the searches they had carried out, about statements made in submissions to the Commissioner, and about the extent of recorded information available about the investigation into the postal vote tallying allegations.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr S and Police Scotland. He is satisfied that no matter of relevance has been overlooked.

Section 12 - Excessive cost of compliance

11. Section 12 of FOISA provides that a Scottish public authority is not required to comply with a request if the cost of doing so would exceed the limit laid down in the relevant Fees Regulations (currently £600).

12. In their revised review response to Mr S of 31 August 2017, Police Scotland stated that his request had been refused because section 12(1) applied. Notwithstanding this decision, Police Scotland went on to list some recorded information which had been identified as relevant to his request and which they had withheld under section 34(1)(b) and section 38(1)(b) of FOISA.

13. When asked for clarification by the Commissioner, Police Scotland explained that section 12 "applies overall as we are unable to confirm with any certainty that all records of relevance have been located… However, the initial searches were focused in such a way that, despite the fact that the process could not be repeated were the same request received today, we cannot ignore the information that was located as a result of the specialist knowledge of the referendum SPOC [Single Point of Contact] back in 2015."

14. Police Scotland stated: "it would be disingenuous not to address the information which was located as a result of the searches conducted - both at initial request stage and during the appeal." They explained that by applying section 12 to the request and providing an explanation of the searches that had been carried out, they had intended to provide "as full and unambiguous a response to Mr S as possible".

15. Police Scotland stated that, when Mr S' requests were received, they were directed to the officer who had been the SPOC for all referendum matters. If the same requests were made today, the only means by which they could attempt to locate any relevant information would be to carry out searches of the crime recording and incident recording systems, given the passage of time, and the retirement of the officer.

16. The Commissioner acknowledges that Police Scotland have made a distinction between information identified and located (and withheld) as a result of previous searches and information which may be held, but which was not identified by those searches. The Commissioner understands that Police Scotland's reliance on section 12 relates to the cost of carrying out further searches, for additional information.

17. The Commissioner's decision on section 12 will consider whether Police Scotland were entitled to rely on this provision only in relation to the cost of searching for additional information not previously identified. He is not required to consider section 12 in relation to the information already identified and withheld, to which section 12 was not applied when Police Scotland first responded to Mr S' requests.

18. This approach to section 12 is in line with a decision of the Information Tribunal when considering the equivalent provision in the Freedom of Information Act 2000. In Sittampalam v Information Commissioner and the BBC (EA/2010/0141)[2], the Tribunal underlined that the purpose of section 12 is to limit public expenditure. If the requested information has already been retrieved, the cost has already been incurred and there can be no saving by applying this provision retrospectively.

19. In order to assess whether Police Scotland were entitled to refuse to carry out further searches under section 12 of FOISA, the Commissioner has first considered the extent and adequacy of the searches already carried out by Police Scotland.

20. The Commissioner has made it clear in previous decisions that searches must be reasonable and proportionate: a comprehensive search will not always be required to achieve this standard.

Searches carried out by Police Scotland

21. In Decision 111/2017, the Commissioner was unable to accept, on the evidence provided by Police Scotland, that all relevant information had been identified by the searches they had carried out. Relevant information had been identified in a piecemeal fashion during the investigation, and no explanation had been given as to why some information had not been retrieved during earlier searches. The Commissioner took the view that Police Scotland might well hold other relevant information, and required them to carry out further searches to address specific points.

22. Police Scotland provided the Commissioner with an account of the enquiries they carried out and the locations they searched. These searches, and their results, can be summarised as follows:

• Information sourced by the original team responsible for dealing with Mr S' requests. No additional information found.
• Review of the "Operation Wheeler" spreadsheet, used to collate information about incidents which could in some way be regarded as "linked" to the referendum. No relevant entries found among the 600+ entries.
• Files and notebooks of the retired Senior Investigating Officer for "Operation Wheeler". It was noted that normal practice is to create an operational folder on a shared drive, but there is no such folder relating specifically to the postal vote tallying enquiry. A hard copy folder contained the five statements originally provided to the Commissioner. No notebook for the Senior Investigating Officer has been located for the material time.
• Files, notebooks and email accounts of other officers involved in the inquiry. The only information located were two emails containing a statement from one of the witnesses (the same statement in both emails), and a statement in a police notebook from another individual. This information has been withheld under section 34(1)(a) and (b) and section 38(1)(b) of FOISA.
• Files held by the Operational Support Division Events team, who had an "oversight role" for the referendum. The team reviewed 19 files from an "election" electronic folder, and identified two emails of potential relevance. Again, this information has been withheld under section 34(1)(a) and (b) and section 38(1)(b) of FOISA.

23. Police Scotland then addressed each of the specific points raised by the Commissioner in relation to the investigation that led to Decision 111/2017. In each case, they confirmed that they did not hold any relevant information, and that this was supported by the recollection of one of the officers involved with "Operation Wheeler".

24. It appears to the Commissioner that the record of Police Scotland's investigation of the postal votes tallying allegations is far from complete. It appears that the Senior Investigating Officer departed from established practice and did not create a folder on a shared drive where relevant information would be stored. The reason for this is unclear. The same officer has now retired, and Police Scotland cannot access any information which might have been in his notebooks or emails.

25. The Commissioner was aware that Police Scotland was in contact with the Crown Office and Procurator Service (COPFS) in relation to Operation Wheeler. Enquiries were made to COPFS about emails exchanged with Police Scotland. It appears that several emails were exchanged which have not been retained by Police Scotland.

26. In relation to information held on their electronic records systems, Police Scotland explained that, generally, when a member of the public contacts them, a record is created on the command and control management system. Where there is any inference that a crime has been committed, a crime report is raised unless criminality can be disproved. Many incidents are recorded which do not result in a crime report being raised.

27. Police Scotland searched their crime recording system for entries with the Scottish Government Justice Department (SGJD) offence classification code "38/002 - Election Offences". This would cover all criminal offences in terms of the Scottish Independence Referendum Act 2013 and the Representation of the People Act 1983. The search included any crime reports which were thereafter classified as "no crime". A total of 60 reports were identified across Scotland since 1 January 2013. None were relevant to Mr S' request.

28. In terms of incident recording, Police Scotland explained that a national command and control system has been rolled out over the past few years, but the process is not complete. However, incidents are categorised on all systems currently in use, although not to the level of detail afforded by the SGJD classifications. Most crimes are recorded in a non-specific way, such as "crime - other". On that basis, Police Scotland submitted that Mr S' request would be refused on grounds of excessive cost, if it were received today.

29. After considering the searches already carried out by Police Scotland, the Commissioner accepts that to widen the search would cost more than £600. The command and control system does not categorise records in a way which would make it easy to locate any relevant incident report. Given this limitation, and given the number of incidents recorded by Police Scotland each year, the Commissioner accepts that the cost of scrutinising individual records for relevance would soon exceed the £600 limit.

30. The Commissioner therefore accepts that Police Scotland are entitled to rely upon section 12(1) of FOISA, where compliance with Mr S' request would require additional searches not already undertaken.

31. In terms of the adequacy of the searches carried out by Police Scotland, the Commissioner is satisfied that a reasonable and proportionate search has been carried out. As noted, the record of the investigation from documents obtained through these searches does not appear to be complete. Despite the gaps in the correspondence, the Commissioner accepts that the searches have been reasonable. He accepts there are reasons likely to explain the incomplete documentation: the lack of a central file (as would normally be used for such an investigation); the departure of key personnel; and the fact that records relating to the investigation were not routinely retained.

Section 34(1)(a) and (b) of FOISA (Investigations by Scottish public authorities)

32. In all, Police Scotland identified 22 separate documents containing information covered by Mr S' request. They withheld all but one (item 14) under the exemptions in section 34(1)(a) and (b) of FOISA.

33. Section 34(1)(a) and (b) of FOISA provide that information is exempt from disclosure if it is held for the purposes of:

(i) an investigation which the authority has a duty to conduct to ascertain whether a person should be prosecuted for an offence (section 34(1)(a)(i));

(ii) an investigation which the authority has a duty to conduct to ascertain whether a person prosecuted for an offence is guilty of it (section 34(1)(a)(ii)); or

(iii) an investigation, conducted by the authority, which in the circumstances may lead to a decision by the authority to make a report to the procurator fiscal to enable it to be determined whether criminal proceedings should be instituted (section 34(1)(b)).

34. The exemptions in section 34 are described as "class-based" exemptions. This means that if information falls within the description set out in the exemption, the Commissioner is obliged to accept it as exempt. There is no harm test: the Commissioner is not required or permitted to consider whether disclosure would, or would be likely to, prejudice substantially an interest or activity, or otherwise to consider the effect of disclosure in determining whether the exemption applies. However, the exemptions are subject to the public interest test contained in section 2(1)(b) of FOISA.

35. In relation to section 34(1)(a), Police Scotland submitted that they had been instructed to undertake an investigation by COPFS; it was therefore an investigation which they had a duty to conduct. They have a duty to report the circumstances of a case to COPFS, in order for the prosecuting authority to decide whether criminal proceedings should be taken. They confirmed that all information withheld under this exemption was held by them as the result of an investigation into whether a person should be prosecuted for an offence.

36. In relation to section 34(1)(b), Police Scotland submitted that the withheld information was all gathered during the course of their investigation, and clearly fell within the exemption.

37. The information withheld under section 34(1) falls into three broad categories:

(i) witness statements and related information (items 7 - 11, 16, 17, 20 - 22)

(ii) emails and other information relating to the allegations and investigation (items 1 - 6, 15, 18, 19)

(iii) newspaper article and transcript of YouTube video (items 12 and 13)

38. The Commissioner accepts that the exemptions in section 34(1)(a) and (b) are engaged by the withheld information, with the exception of information in item 18. Item 18 is an email about the proposed line to take for a press statement, and cannot be said to be information held for the purposes of an investigation. The Commissioner will consider later in this decision whether the information in item 18 should be withheld under section 38(1)(b) of FOISA (Personal information), as argued by Police Scotland.

39. As noted above, the exemptions in section 34(1) are subject to the public interest test in section 2(1)(b) of FOISA. The exemptions can only be upheld if the public interest in maintaining the exemptions is not outweighed by the public interest in disclosure. The Commissioner must carry out a balancing exercise. Unless he is satisfied, in all the circumstances of the case, that the public interest in maintaining the exemption outweighs that in disclosure, he must order the information to be disclosed (unless satisfied that it should be withheld under another exemption in FOISA).

40. During the investigation, Police Scotland indicated that items 13 and 14 (two newspaper cuttings) could be disclosed, given that they are already in the public domain, except for an annotation to item 14 which Police Scotland wished to withhold under section 38(1)(b). In the absence of arguments from Police Scotland as to why they previously considered that the public interest favoured withholding the information in item 13 under section 34(1), or why, apart from the annotation, the information in item 14 was exempt from disclosure, the Commissioner must find that Police Scotland breached Part 1 of FOISA in withholding these two items. (The Commissioner will consider later whether the annotation on item 14 should be withheld under section 38(1)(b).)

41. In relation to the remaining information withheld under section 34(1), the Commissioner has carried out a balancing test in relation to the public interest in disclosing or withholding the information, taking account of the relevant submissions from Mr S and Police Scotland.

Submissions on the public interest test - Police Scotland

42. Police Scotland relied on submissions made to the Commissioner in relation to Decision 111/2017. They acknowledged that the investigation had attracted a significant level of public interest and scrutiny, and disclosure would inform the public as to how investigations of this nature are carried out and the decision-making processes followed by Police Scotland and COPFS.

43. Police Scotland also stated that disclosure would enhance accountability and transparency, "particularly in regard to high profile investigations involving an event of significance to the Scottish population". They argued that disclosure would allow the efficiency and effectiveness of these procedures to be examined, and would further the public debate in regard to the Scottish independence referendum.

44. Finally, Police Scotland noted that, because public funds are spent on such investigations, disclosure would inform the public as to the level of investigation carried out and whether this was an appropriate use of public money.

45. Against disclosure, Police Scotland argued that the process of conducting an investigation is necessarily a confidential process. Those affected by or associated with such enquiries are entitled to have their information protected, particularly when (as in this case) no charges resulted and the parties involved were classed as witnesses. They submitted that witnesses and other information providers do so on the understanding that the information will remain confidential unless given as evidence in court.

46. Police Scotland found no public interest in disclosure of information which could compromise the future flow of information to the police and, in turn, compromise the ability of the force to effectively fulfil its statutory obligations. They argued that the process of investigating crimes relies heavily upon the co-operation of individuals to provide evidence during investigations.

Submissions on the public interest test - Mr S

47. Mr S expressed his lack of faith in the balancing exercise carried out by Police Scotland on the public interest test. He stated that the "default setting … remains to withhold to the detriment of the public interest". He noted that, from the list of information given to him by Police Scotland, some of the withheld information appeared to be very general in nature, and submitted that no attempt had been made to provide redacted versions of the withheld documents.

48. Mr S noted that he had originally been told that the police had interviewed three witnesses, but was now told that there were eight witnesses interviewed. He expressed grave concerns about the veracity of the statements made by Police Scotland on this matter. He noted that if Police Scotland's previous responses had been published, they would have provided "a wholly inaccurate picture".

Public interest test - the Commissioner's view

49. The Commissioner has found the public interest to be finely balanced in this case.

50. The independence referendum was a matter of great importance to the Scottish people, and it is clearly in the public interest for the allegations of illegal tallying of postal votes to be properly and robustly investigated.

51. Mr S has complained that the previous responses from Police Scotland to a number of related information requests were confusing and potentially misleading. The Commissioner agrees that this was the case, and takes the view that it is in the public interest for such confusion to be resolved, where possible. Decision 111/2017 made some progress in this regard, by clarifying some aspects of the postal vote investigation (such as the fact that the investigation covered two alleged incidents, not one). In addition, it is now known that Police Scotland interviewed eight witnesses, rather than three (as originally stated).

52. The Commissioner accepts, as a general principle, that there is an inherent public interest in protecting the process by which the police carry out investigations. He accepts that this process relies heavily on the free flow of information from witnesses and other sources; that people providing information to the police expect it to be treated confidentially; and that disclosure of such information in response to an information request may deter or inhibit the provision of information to the police in future.

53. Police Scotland have identified a number of factors supporting disclosure in the public interest. The Commissioner has considered these carefully. He agrees with Police Scotland that there is a public interest in the disclosure of information which would "inform the public as to how investigations of this nature are carried out and the decision-making processes followed by Police Scotland and COPFS". He also agrees that disclosure would be in the public interest where it "would allow the efficiency and effectiveness of these procedures to be examined".

54. The difficulty for the Commissioner in this case is that the information retrieved by Police Scotland does not constitute a complete record of the investigation carried out. The information which has been identified and withheld under section 34(1) would not provide complete understanding of the investigation or the decision-making process followed by Police Scotland and COPFS, or allow a full examination of the efficiency and effectiveness of the procedures followed by Police Scotland.

55. Nonetheless, the Commissioner takes the view that disclosure of even incomplete or limited information about the investigation would be of value, in terms of the public interest in informing the public about the investigation and giving insight into the process followed by Police Scotland, on a matter of national importance. He is aware that the available information will not give a full picture, because a full record was not retained. However, its disclosure would provide some transparency and accountability in relation to an investigation which hit the headlines but did not lead to any criminal proceedings.

56. The Commissioner therefore finds that, on balance, it would be in the public interest to disclose information which would inform the public how Police Scotland investigated the allegations of postal vote tallying.

57. The Commissioner has taken a different view about the public interest in disclosing information from witness statements. Although this would provide full details of the allegations and the matters which were investigated, the Commissioner accepts that the public interest lies in protecting the confidentiality around such statements. He accepts that disclosure would be likely to make future witnesses more cautious, or less willing to come forward with information.

58. The Commissioner therefore accepts that items 7 - 11, 16, 17, and 20 - 22 (the witness statements and related information) were correctly withheld under section 34(1)(a) and (b). Accordingly, there is no requirement for him to consider whether this information was correctly withheld under section 38(1)(b) as well, as argued by Police Scotland.

59. In relation to the remaining information withheld under section 34(1)(a) and (b), the Commissioner finds that the public interest in disclosure outweighs the public interest in maintaining the exemption. Although he does not accept that the information should be withheld under section 34(1), he must go on to consider whether the information is exempt from disclosure under section 38(1)(b) of FOISA, as argued by Police Scotland.

Section 38(1)(b) - Personal information

60. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amends section 38 of FOISA. It also introduced a set of transitional provisions which set out what should happen where a public authority dealt with an information request before 25 May 2018, but where the matter is being considered by the Commissioner after that date.

61. In line with paragraph 56 of Schedule 20 to the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018 (as is the case here), the Commissioner must consider the law as it was before that date when determining whether the authority dealt with the request in accordance with Part 1 of FOISA.

62. Paragraph 56 of Schedule 20 goes on to say that, if the Commissioner concludes that the request was not dealt with in accordance with Part 1 of FOISA (as it stood before 25 May 2018), he cannot require the authority to take steps which it would not be required to take in order to comply with Part 1 of FOISA on or after 25 May 2018.

63. The Commissioner will therefore consider whether Police Scotland were entitled to apply the exemption in section 38(1)(b) of FOISA under the old law. If he finds that Police Scotland were not entitled to withhold the information under the old law, he will only order Police Scotland to disclose the information if disclosure would not now be contrary to the new law.

Compliance with section 38(1)(b) pre-25 May 2018

64. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA 1998) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA 1998.

65. This exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

66. In order to rely on this exemption, Police Scotland must show that the information being withheld is personal data for the purposes of the DPA 1998 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA 1998.

67. As noted above, given that the Commissioner has found that the information in items 7 - 11, 16, 17, and 20 - 22 are exempt from disclosure under section 34 of FOISA, he will not consider whether they are also exempt from disclosure under section 38(1)(b) of FOISA.

Is the withheld information personal data?

68. Police Scotland submitted that there was a substantial amount of personal (and investigative) information within items 1 to 6 relating to:

• those who made complaints of electoral fraud, and the basis of their complaints
• the witnesses
• what enquiries were to be undertaken
• the outcome of these enquiries (including quotes from witness statements)

69. Police Scotland identified some parts of items 3 and 4 which they did not consider to be personal data. They disclosed this information to Mr S in February 2017.

70. Police Scotland argued that disclosure of the other information in items 1 - 6, even with names redacted, would permit Mr S and others to confirm the identities of witnesses. They believed this would be a clear breach of the first data protection principle.

71. While the Commissioner agrees that items 1 - 6 contain some information which is personal data, he does not agree that the documents cannot be redacted in such a way that some individuals will not be identified from the information. However, he accepts that items 1 - 6 contain some information which is personal data and accepts that the identity of at least one witness could be confirmed by disclosure of information in these documents, even in redacted form.

72. Item 14 is a newspaper cutting. The information withheld under section 38(1)(b) is a hand-written annotation. The Commissioner accepts that the annotation is personal data.

73. Items 18 and 19 were not discussed when Police Scotland provided submissions on section 38(1)(b) of FOISA to the Commissioner, in relation to the investigation which led to Decision 111/2017. Police Scotland has relied upon its previous submissions, in relation to this exemption. The Commissioner accepts that items 18 and 19 contain personal data.

74. In relation to all the personal data identified above, the Commissioner must consider whether disclosure would breach the first data protection principle, which states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA 1998 is met. The processing in this case would be making the information publicly available in response to Mr S' request.

75. In the case of sensitive personal data (as defined by section 2 of the DPA 1998), at least one of the conditions in Schedule 3 to the DPA 1998 must also be met. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA 1998, so it is not necessary for him to consider the conditions in Schedule 3.

Can any of the conditions in Schedule 2 be met?

76. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[3] (the CSA case) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).

77. It appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the personal data to Mr S. In any event, neither Mr S nor Police Scotland have suggested that any other condition would be relevant.

78. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. (In this case, the data subjects are the individuals identifiable from the withheld information.)

79. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Does Mr S have a legitimate interest or interests in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr S' legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

80. There is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Mr S must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 permits personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that Police Scotland were correct to refuse to disclose the information to Mr S.

Does Mr S have a legitimate interest or interests?

81. The Commissioner accepts that Mr S (given his role) and the general public has a legitimate interest in information which would give an insight into the investigation carried out into allegations of illegal postal vote tallying during the Scottish independence referendum.

Is the processing necessary for the purposes of these interests?

82. The Commissioner must decide whether disclosure is necessary and proportionate and whether the aims of Mr S can be achieved by any other means which would interfere less with the privacy of the data subjects.

83. He is satisfied that disclosure of the information is necessary for the purposes of the legitimate interest identified by Mr S, and cannot identify any other way of meeting those interests.

Would disclosure nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

84. The Commissioner has considered this question in relation to three separate groups of data subjects:

(i) members of the public who made complaints to Police Scotland

(ii) the witnesses or other individuals

(iii) the police officers and other public officials named in the correspondence.

Members of the public who made complaints to Police Scotland

85. In relation to the members of the public who submitted complaints to Police Scotland, the Commissioner accepts that disclosure of their identities would cause unwarranted prejudice to their rights and freedoms. He therefore finds that information which identifies these individuals cannot be disclosed without breaching the first data protection principle, and that it was correctly withheld under section 38(1)(b) of FOISA.

Witnesses or other individuals

86. In relation to witness or other individuals mentioned in the withheld information, Police Scotland have acknowledged that media articles have named some of the individuals who were spoken to during the course of the investigation. Nonetheless, Police Scotland submitted that it would be inappropriate for them to disclose information which confirmed this. They argued that it was not common practice for the police to name witnesses, especially in situations where criminal proceedings did not result.

87. The Commissioner has accepted that the witness statements obtained during Police Scotland's investigation should not be disclosed. He accepts that the expectation of confidentiality, in relation to information provided by witnesses, will generally lead to an expectation that the individual's privacy will be protected.

88. The Commissioner accepts that, in most cases, disclosure of information which would serve to identify witnesses would be an unwarranted breach of the data subject's right to privacy, in relation to involvement in a police investigation which did not lead to criminal proceedings.

89. However, the Commissioner does not accept that disclosure of the names of witnesses would be an unwarranted breach of privacy in relation to those witnesses who have a public profile and are known to have publicly discussed or made public statements about the possibility of postal vote tallying. The Commissioner has evidence to show that three of the witnesses were regular participants in public debate and discussion about referendum matters, and are on record as having made public statements which implied knowledge of the way the postal vote had gone, either before polls had closed or very shortly afterwards. It would not be an unwarranted breach of privacy to disclose information which confirms that these individuals were among the witnesses interviewed by the police. (As noted already, the Commissioner accepts that the contents of their statements should be withheld.)

90. While taking this view, the Commissioner accepts that in many instances it is not possible to disclose the names of these three witnesses without also disclosing information which is included in their witness statement, or other personal information. The Commissioner finds that this would be unwarranted and unfair, in terms of their right to privacy. In such instances, the Commissioner finds that no condition from Schedule 6 of the DPA 1998 can be met. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure would breach the first data protection principle and that the information is exempt from disclosure and properly withheld under section 38(1)(b) of FOISA.

Police officers and other public officials

91. Police Scotland did not give any arguments or views in relation to personal data which relates to police officers and other public officials involved or named in the investigation correspondence.

92. The Commissioner takes the view that, in relation to Mr S' legitimate interests, it would not be an unwarranted breach of privacy to disclose the names of senior officers, or the three persons already named in media articles about the postal vote tallying allegations. The Commissioner takes the same view in relation to the official at COPFS with whom Police Scotland were in contact about Operation Wheeler, given the seniority of that official. The information relates to the professional activities and judgments of these individuals, rather than their private lives.

93. The Commissioner finds that disclosure of the names of other, less senior, police officers and officials would be unwarranted. Mr S' legitimate interest in this information is weaker, and the expectation of privacy for less senior officers and officials is greater. The Commissioner therefore accepts that, as no condition from Schedule 6 of the DPA 1998 can be met, disclosure of this personal data would breach the first data protection principle and the exemption in section 38(1)(b) was correctly applied to the personal data of these police officers and officials.

94. Similarly, the Commissioner finds that disclosure of personal data contained in an annotation on document 14, and in annotations on document 5, were correctly withheld under section 38(1)(b) of FOISA. Disclosure of this personal information is unwarranted, when balanced against Mr S' legitimate interests.

Compliance with section 38(1)(b) post-25 May 2018

95. The Commissioner has therefore concluded that Police Scotland were not entitled to withhold some personal data under section 38(1)(b) of FOISA as it stood before 25 May 2018.

96. However, given the transitional provisions in the DPA 2018, detailed above, the Commissioner can only order Police Scotland to disclose the personal data if disclosure would not now be contrary to section 38(1)(b) as amended by the DPA 2018.

97. The Commissioner therefore contacted Police Scotland to advise them that he considered that some personal data should be disclosed and gave them an opportunity to comment on whether disclosure would now be contrary to section 38(1)(b) as amended.

98. Police Scotland responded on 14 August 2018. Unfortunately, despite being asked to do so, they did not make a specific reference to the law as it has changed since 25 May 2018. Instead, they took the opportunity to repeat and, in some cases expand upon, the arguments they had made earlier to the Commissioner. In particular, Police Scotland argued that the names of the witnesses should not be disclosed.

99. The Commissioner does not intend to repeat his views on the disclosure of personal data in this case. However, for the reasons set out above in paragraphs 89 and 92, the Commissioner finds that disclosure of the personal data in question would not contravene any of the data protection principles in Article 5(1) of the GDPR, which requires that personal data be processed lawfully, fairly and in a transparent manner.

100. He is satisfied that, in terms of Article 6(1)(f) of the GDPR, processing the information (in this case disclosing the information to Mr S) is necessary for the purposes of Mr S' legitimate interests and are not overridden by the interests or fundamental rights and freedoms of the data subjects.

Conclusion

101. The Commissioner has found that the information which was wrongly withheld under section 34(1)(a) and (b) of FOISA should be disclosed, with the exception of the personal data which was correctly withheld under section 38(1)(b) of FOISA, as discussed above.

102. The Commissioner will provide Police Scotland with marked up copies of the relevant documents, showing what information should now be disclosed.

Decision

The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr S.

The Commissioner accepts that Police Scotland was not obliged to extend its searches beyond those carried out, in line with section 12(1) of FOISA.

The Commissioner finds that by correctly withholding some information under section 34(1)(a) and (b) and section 38(1)(b) of FOISA, Police Scotland complied with Part 1.

However, the Commissioner found that Police Scotland was wrong to withhold some information under section 34(1)(a) and (b) and section 38(1)(b) of FOISA.

The Commissioner therefore requires Police Scotland to disclose this information by 4 January 2019.

Appeal

Should either Mr S or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If Police Scotland fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that Police Scotland has failed to comply. The Court has the right to inquire into the matter and may deal with Police Scotland as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

19 November 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

12 Excessive cost of compliance

(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.

…

34 Investigations by Scottish public authorities and proceedings arising out of such investigations

(1) Information is exempt information if it has at any time been held by a Scottish public authority for the purposes of-

(a) an investigation which the authority has a duty to conduct to ascertain whether a person-

(i) should be prosecuted for an offence; or

(ii) prosecuted for an offence is guilty of it;

(b) an investigation, conducted by the authority, which in the circumstances may lead to a decision by the authority to make a report to the procurator fiscal to enable it to be determined whether criminal proceedings should be instituted; or

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

 

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

…

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Data Protection Act 2018

Schedule 2 - Transitional provision etc

56 Freedom of Information (Scotland) Act 2002

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 ("the 2002 Act") before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

(3) To the extent that the request was dealt with before the relevant time -

(a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act as amended by Schedule 19 to this Act, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.

(4) In this paragraph -

"Scottish public authority" has the same meaning as in the 2002 Act;

"the relevant time" means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.

General Data Protection Regulation

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject

("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

…

f. the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004

3 Projected costs

(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.

(2) In estimating projected costs-

(a) no account shall be taken of costs incurred in determining-

(i) whether the authority holds the information specified in the request; or

(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and

(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed £15 per hour per member of staff.

5 Excessive cost - prescribed amount

The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is £600.

---