Decision 190/2016: Mr Mark Howarth and the Chief Constable of the Police Service of Scotland Significant Case Review Reference No: 201600821 Decision Date: 13 September 2016 Summary On 11 November 2015, Mr Howarth asked the Chief Constable of the Police Service of Scotland (Police Scotland) for parts 10 and 11 of a specific Significant Case Review report. Police Scotland withheld the requested information under section 39(1) of FOISA (Health, safety and the environment). Following a review, Police Scotland decided that some information should also be withheld under section 38(1)(b) (Personal Information). Mr Howarth remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that Police Scotland had partially failed to respond to Mr Howarth's request for information in accordance with Part 1 of FOISA. The Commissioner accepted that some personal data was correctly withheld, but did not accept that the exemption in section 39(1) applied to the remaining information. She required Police Scotland to disclose the information which was wrongly withheld.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a), (b) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information); 39(1) (Health, safety and the environment)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); 2 (Sensitive personal data); 3 (The special purposes); Schedules 1 (The data protection principles) (the first data protection principle); 3 (Conditions relevant for the purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5).

Data Protection (Processing of Sensitive Personal Data) Order 2000 (Circumstances in which Sensitive Personal Data may be processed) (paragraph 3)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 11 November 2015, Mr Howarth made a request for information to Police Scotland. He asked for "the verbatim contents of parts 10 and 11, namely 'Issues within the MAPPA Context' and 'Recommendations'" of a specific Significant Case Review (SCR) report. Mr Howarth referred to Police Scotland's response to a previous FOI request in respect of the same SCR, which had disclosed the SCR's chapter headings, and commented that the broad nature of the recommendations had already been openly discussed in the Scottish Parliament. Mr Howarth did not accept that the mental health of any individual was likely to be endangered by disclosure of the information covered by his request. He also considered it unlikely that the information he had requested would constitute personal data.

2. Police Scotland responded on 10 December 2015. They withheld the requested information under section 39(1) of FOISA (Health, safety and the environment). Police Scotland said that publication of any part of the SCR report, and public debate about the circumstances of the case, would have a damaging impact, causing significant distress to the victims of the crime and their families. Disclosure would be likely to endanger the mental health of these individuals. Police Scotland acknowledged that there is a public interest in the outcome of SCRs, and any organisational learning points that are included in the SCR, but they also identified a public interest in protecting the victims of crime from further distress, and found that the balance of public interest lay in favour of withholding the SCR report.

3. On 8 February 2016, Mr Howarth wrote to Police Scotland requesting a review of their decision. He reiterated that the recommendations in the SCR had been discussed in the Scottish Parliament and the case discussed in public on numerous occasions. He made clear that he had "enormous sympathy for the plight of the victims in this case", but found it difficult to understand how the general public knowing the recommendations of the SCR would be likely to cause them mental distress.

4. Police Scotland notified Mr Howarth of the outcome of their review on 2 March 2016. Police Scotland upheld their initial response that the information was exempt in terms of section 39(1) of FOISA, and that the duty to protect the victims from further harm and distress outweighed any public interest in the learning outcomes of such a case. Police Scotland stated that section 38(1)(b) of FOISA also applied to personal data in the withheld information.

5. On 2 May 2016, Mr Howarth applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He did not accept that the exemptions quoted by Police Scotland applied to the information he had requested. He asked the Commissioner to decide if the information included any personal data and if so, whether it could be redacted to allow the requested parts of the SCR report to be disclosed.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Howarth made a request for information to a Scottish public authority and asked the authority to review their response to that request before applying to her for a decision.

7. On 6 June 2016, Police Scotland were notified in writing that Mr Howarth had made a valid application and were asked to send the Commissioner the information withheld from him. Police Scotland provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions including justifying their reliance on any provisions of FOISA they considered applicable to the information requested.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Howarth and Police Scotland. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal information

10. Police Scotland withheld parts of two sentences on the basis that section 38(1)(b) (read in conjunction with section 38(2)(a)(i)) of FOISA applied. Section 38(1)(b) of FOISA exempts personal data if disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

Is the information under consideration personal data?

11. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

12. The Commissioner has considered the submissions received from Police Scotland on this point, along with the withheld information. The Commissioner is satisfied that the information withheld is personal data. It is possible to identify an individual from the data itself. The information is biographical in relation to that individual and therefore can be said to relate to that person.

13. Police Scotland submitted that the information was sensitive personal data. The definition of sensitive personal data is contained in section 2 of the DPA (see Appendix 1).

14. The Commissioner has reviewed the personal data and is satisfied that all of the personal data withheld in this case falls into at least one of the categories in section 2 of the DPA and therefore should be considered to be the sensitive personal data of an individual. The Commissioner is unable to confirm which of the categories of sensitive personal data are relevant here, without, in effect, disclosing the sensitive personal data.

Would disclosure contravene the first data protection principle?

15. In their submissions, Police Scotland argued that the disclosure of the withheld personal data would contravene the first data protection principle. This principle requires that personal data are processed fairly and lawfully and, in particular, are not processed unless at least one of the conditions in Schedule 2 to the DPA is met. For sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.

16. Given the additional restrictions surrounding the disclosure of sensitive personal data, it is necessary in this case to consider whether there are any conditions in Schedule 3 which would permit the data to be disclosed, before considering the Schedule 2 conditions. The conditions listed in Schedule 3 have been considered by the Commissioner, as have the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000.

17. Guidance[1] issued by the Commissioner regarding the exemption in section 38(1)(b) notes that, generally, only the first and fifth conditions are likely to be relevant when considering a request for sensitive personal data under FOISA. Condition 1 would allow personal data to be disclosed where the data subject has given explicit (i.e. fully informed and freely given) consent to their disclosure. Condition 5 would allow the personal data to be disclosed if the data had been made public as a result of steps deliberately taken by the data subject.

18. Police Scotland submitted in clearest terms that neither condition 1 nor condition 5 applies. The data subject has not consented to the release of personal data and has not taken steps to place this information into the public domain, with the result that conditions 1 and 5 could not be met. The Commissioner agrees with Police Scotland's submissions on these points and accepts that conditions 1 and 5 were not met.

19. Having reached these conclusions, and having concluded that no other condition in Schedule 3 applies in this case, the Commissioner finds that the disclosure of the sensitive personal data would breach the first data protection principle. She therefore finds that Police Scotland were correct to withhold this information under section 38(1)(b) of FOISA.

20. As the Commissioner has found that the withheld information has been correctly withheld under section 38(1)(b) of FOISA, there is no requirement for her to consider the application of section 39(1) of FOISA to the same information.

21. In their submissions, Police Scotland identified an additional statement in the withheld information which they acknowledged was "not strictly personal data" but which related to the statements which were personal data. They argued that the additional statement might need to be withheld, for consistency. The Commissioner agrees with Police Scotland that, on its own, the statement is not personal data. She has accepted that the two statements to which it relates are personal data which was correctly withheld. If these two statements are redacted, the additional statement loses its sensitivity. The Commissioner has considered whether the information in the additional statement, along with all remaining information from parts 10 and 11 of the SCR report, should be withheld under section 39(1) of FOISA.

Section 39(1) - Health, safety and the environment

22. Section 39(1) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual. This is a qualified exemption and is subject to the public interest test required by section 2(1)(b) of FOISA.

23. The Commissioner's briefing[2] on this exemption notes that section 39(1) does not contain the usual harm test. Instead of the "substantial prejudice" test found in other exemptions in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety. The briefing also notes that the test of "endangerment" is less demanding than the "substantial prejudice" test applied in other exemptions.

24. The Commissioner's view is that the term "endanger" is broad enough to apply where there is a (direct or indirect) threat to the safety of a person which would foreseeably arise in the future, as well as immediate harm, since the exemption does not specify that any threat should be imminent before it applies. The Commissioner believes that for endangerment to be considered likely, however, there must be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.

25. Police Scotland made clear their view that, even if personal data were withheld, disclosure of the information covered by Mr Howarth's request would cause significant distress to the victims and their families, to the extent that the exemption in section 39(1) of FOISA was engaged.

26. In its submissions, Police Scotland stated that publication of any part of the SCR report, and public debate about the circumstances of the case, would have a damaging impact, causing significant distress to the victims and the families of the victims. Police Scotland's submission to the Commissioner reiterated that the crimes committed by the subject of the SCR report would have had an emotional impact on the victims and their families. To put the information into the public domain through disclosure under FOISA would renew scrutiny of the case, and such scrutiny would be highly likely to endanger the mental health and safety of the victims. Police Scotland emphasised the seriousness of the crimes at issue.

27. Police Scotland highlighted the European Victim's Directive with particular reference to Articles 18 and 21, which relate to the right to privacy and protection from further victimisation. Police Scotland acknowledged that that these Articles apply during the police investigation and any subsequent proceedings, but argued that the application of such basic rights should not be precluded after proceedings.

28. Police Scotland also provided an example of academic research[3] and supporting confidential information to justify its view that disclosure would engage section 39(1), commenting that it provides further evidence that identifying such victims, either directly or through the disclosure of other identifying information can exacerbate victims' trauma.

29. Given the sensitive and confidential nature of the submissions provided by Police Scotland on this point, the Commissioner is unable to state these in full in her decision notice, but she can assure the authority and others that she has taken full account of them. The courts have recognised that there will be instances where it is difficult for the Commissioner to state her reasoning or to refer to all the information supplied by a public authority to the Commissioner for the purposes of her investigation. In an early decision, The Scottish Ministers v The Scottish Information Commissioner (William Alexander's Application) [2007] CSIH 8[4] the Court of Session stated, at paragraph 18;

"It is important, in our view, when considering these authorities to bear in mind that the respondent [the Commissioner], in giving reasons for his decision, is necessarily restrained by the need to avoid, deliberately or accidentally, disclosing information which ought not to be disclosed."

30. Mr Howarth has said he does not wish to cause distress to any individual as a result of his request, but he "fail[ed] to perceive any certainty or even likelihood - and the threshold has intentionally been set this high - of endangerment of mental health as a result of this information being provided". He explained that the victims have never been named as part of the legal process so there is no chance of unwanted publicity or recognition as a result of the information being disclosed. He stressed that he had not underestimated the gravity of the case or the long-lasting effects on the victims; however, he had asked for information about peripheral matters concerning police procedures, in a request made some years after the crime.

31. Mr Howarth also referred to information in the public domain, some of which appeared to be inconsistent with Police Scotland's position, by showing that professionals and other persons associated with the case had discussed it publicly on several occasions.

Commissioner's conclusions

32. Section 39(1) of FOISA is intended to protect people from being harmed by the disclosure of information which would endanger them: in this case, the individuals in question are the victims and their families. The Commissioner must consider whether disclosure of the information in question would, or would be likely to, endanger the physical or mental health or safety of these individuals. She must focus her decision on the actual information which has been withheld.

33. Police Scotland has argued that disclosure of the information into the public domain was highly likely to endanger the mental health or safety of the individuals. They would be harmed by the distress caused by disclosure of information associated with the crime, and by renewed public scrutiny of the case.

34. The Commissioner accepts that disclosure of information under FOISA effectively puts it in the public domain, with the possibility that the information will be disseminated further (e.g. by being the subject of a media article). It is reasonable for Police Scotland to take this into account in anticipating the effect that disclosure is likely to have on the victims and families.

35. The Commissioner recognises and shares Police Scotland's clear concern for the victims and the families of the victims. She appreciates that victims and their families would be distressed because of the fear that something about them in the SCR report might be disclosed under FOISA and so, effectively, made public. This is understandable and in considering the actual withheld information the Commissioner has taken this into account.

36. The Commissioner has been asked to decide whether parts 10 and 11 of the SCR report were correctly withheld under section 39(1) of FOISA. It is important to be clear that (as suggested by the title headings of parts 10 and 11) these parts of the report do not contain any information about the crime, or the victims.

37. The Commissioner is satisfied that disclosure of the withheld information would not increase the likelihood that any victim or individual affected by the crime would be identified. With the exception of the information withheld under section 38(1)(b), there is no personal data in the information.

38. The Commissioner acknowledges that disclosure of any information with a link to the crime, no matter how impersonal, may distress the victims or their families. However, given the nature of the information in question, it is likely that, in practice, disclosure of this information would be less distressing than might be anticipated if the information was about the crime itself, or the criminal.

39. The passage of time is also relevant in this case. Both Mr Howarth and Police Scotland have referred to the fact that the case to which the SCR report refers to events that took place some years ago. This is not to suggest that the passage of time has necessarily diminished the distress of victims or families, but there is now less likely to be further detailed scrutiny of the case (the outcome anticipated by Police Scotland if parts 10 and 11 of the SCR report are disclosed under FOISA).

40. While it is possible that disclosure of the withheld information would likely to result in public debate about the general circumstances of the case, or a more focussed debate about the subjects considered in parts 10 and 11 of the SCR report, the Commissioner must consider to what extent that would be likely to impact on the victims and their families and in what way. The Commissioner acknowledges there is a significant public interest in the SCR process and SCR reports and that disclosure under FOISA may result in media attention to the case. Against this, she must balance the fact that there is already information about the case in the public domain, including information which relates much more directly to the actual crime itself, and the case has been the subject of some public discussion.

41. The report as a whole relates to a highly distressing crime, and the Commissioner acknowledges that the effects of this crime on the victims and their families are likely to be profound and long-lasting. However, Mr Howarth's request was for parts of the report in which the information is impersonal and concerns police practice and procedure, not the crime itself.

42. On the evidence presented to her, and in all the circumstances, the Commissioner does not accept that disclosure of the information under consideration is likely to cause the level of distress suggested by Police Scotland. The information does not include any direct reference to the crime or the victims, and the Commissioner has accepted that the small amount of personal data which it contains was correctly withheld. Consequently, for the reasons set out above, the Commissioner has concluded that the exemption in section 39(1) of FOISA was incorrectly applied by Police Scotland to the information requested by Mr Howarth.

43. Section 39(1) is a qualified exemption, which means that its application is subject to the public interest test in section 2(1)(b) of FOISA. However, having reached the conclusion that section 39(1) was wrongly applied to the information, the Commissioner is not required to consider the public interest test.

44. The Commissioner therefore finds that Police Scotland were not entitled to withhold the information under section 39(1) of FOISA. She requires Police Scotland to disclose the information which was wrongly withheld from Mr Howarth.

Decision The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Howarth. The Commissioner finds Police Scotland correctly withheld some personal data under section 38(1)(b) of FOISA. However, by wrongly withholding the remaining information in terms of section 39(1), the Commissioner finds that by Police Scotland failed to comply with part 1 of FOISA. The Commissioner therefore requires Police Scotland to provide Mr Howarth with the information which was wrongly withheld under section 39(1) by 28 October 2016.

Appeal

Should either Mr Howarth or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If Police Scotland fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that Police Scotland has failed to comply. The Court has the right to inquire into the matter and may deal with Police Scotland as if it had committed a contempt of court.

Rosemary Agnew
Scottish Information Commissioner

13 September 2016

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress); and

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

39 Health, safety and the environment

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, endanger the physical or mental health or the safety of an individual.

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

(a) the racial or ethnic origin of the data subject,

(b) his political opinions,

(c) his religious beliefs or other beliefs of a similar nature,

(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),

(e) his physical or mental health or condition,

(f) his sexual life,

(g) the commission or alleged commission by him of any offence, or

(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

 

Schedule 3 - Conditions relevant for the purposes of the first principle: processing of sensitive personal data

1. The data subject has given his explicit consent to the processing of the personal data.

?

5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

?

---