Decision 198/2018: Identity of officers

Public authority: Chief Constable of the Police Service of Scotland
Reference No: 201801089

Summary

Police Scotland were asked about the officers who were present at the requester's address on a specified date. Police Scotland refused to confirm or deny whether the information existed or was held by them. The Commissioner accepted that, in the circumstances of this case, Police Scotland complied with FOISA in their response to the request.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(a) and (b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA 1998) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle), 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1))

Data Protection Act 2018 (the DPA 2018) Schedule 20 (Transitional provision etc - paragraph 56)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 23 February 2018, Mr C made a request for information to the Chief Constable of the Police Service of Scotland (Police Scotland). The information requested was the name, rank and officer number of all officers who were present at Mr C's address on a specified date. Mr C asked for this information under FOISA and "for the purposes of my own solicitor."

2. Police Scotland responded on 13 March 2018. They refused to confirm or deny whether they held the information or whether it existed, relying on section 18(1) of FOISA with section 38 of FOISA (Personal information). They provided Mr C with information about his rights under the DPA 1998, and stated that his request for personal information had been passed to their Data Protection Team.

3. On 16 March 2018, Mr C wrote to Police Scotland requesting a review of their decision. He stated that "the information is known to exist" and it was "ludicrous and futile" for Police Scotland to refuse the request in terms of section 18 of FOISA and to claim this was in the public interest. Mr C requested the information be given to him, particularly the information about one officer present, whom he described as the "female officer".

4. Police Scotland notified Mr C of the outcome of their review on 11 April 2018. Police Scotland upheld their use of section 18 of FOISA, and clarified that their reference to "section 38" was to section 38(1)(a) of FOISA. They claimed it was not in the public interest to confirm whether or not information was held as to do so would confirm that Police Scotland had some involvement with Mr C. They referred to section 7 of the DPA 1998 "as the more appropriate route to access personal data", and acknowledged how frustrating a section 18 response can be to an individual who may have personal knowledge that effectively confirms whether or not the requested information is held. However, Police Scotland stated that, as FOISA deals with the public disclosure of information, they could only disclose information under FOISA where they would release that information to anyone.

5. On 25 June 2018, the Commissioner received an application from Mr C for a decision in terms of section 47(1) of FOISA. Mr C explained that he was dissatisfied with the outcome of Police Scotland's review because he had requested the personal data of the officers, not his own personal data. Mr C indicated that he would have no objection "to the police confirming that they had involvement with me to the public."

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr C made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions including justifying their reliance on any provisions of FOISA they considered applicable to the information requested.

8. During the investigation, Police Scotland stated that a person, such as Mr C, making such a request, may be able to access recorded information (if held) by making a Subject Access Request (SAR) under the DPA. If Police Scotland received a SAR, and proof of identity, they would process the request and may, if information was held, supply that information to the requester.

9. Police Scotland also commented that, in general, there would be no reason why officers would have disclosed their full names in the type of situation described in Mr C's request. It is normal protocol that an officer attending would provide their collar number (this is their unique identifier) and rank. This information would allow a person, "to make a complaint against the officer or similar" if they wished.

10. Mr C was informed of this and was advised that he may be able to access information from Police Scotland by way of the DPA 2018, if he wrote to Police Scotland and supplied proof of his identity. It is the Commissioner's understanding that that option is still available to Mr C under the DPA 2018.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to him by both Mr C and Police Scotland. He is satisfied that no matter of relevance has been overlooked.

Section 18(1) of FOISA - "neither confirm nor deny"

12. Police Scotland refused to confirm or deny under FOISA whether they held any information falling within Mr C's request for information; i.e. names, ranks and officer numbers of all officers who were present at his address on a specified date.

13. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

(i) a request has been made to the authority for information which may or may not be held by it;

(ii) if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and

(iii) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

14. Where a public authority has chosen to rely on section 18(1), the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. He must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1) and cited by the authority.

15. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if it exists and is held, would be exempt information under one or more of the listed exemptions.

16. In any case where section 18(1) is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that he is unable to comment in any detail on the reliance by the public authority on any of the exemptions listed in relation to section 18(1), or on other matters which could have the effect of indicating whether the information existed.

Section 38 - Personal information

17. In their initial response to Mr C, Police Scotland referred to "section 38" of FOISA but did not specify whether this was section 38(1)(a) or section 38(1)(b), or both. After review, Police Scotland relied on section 18 with section 38(1)(a) of FOISA, indicating that if information were held it would be Mr C's personal data. In their submission to the Commissioner, Police Scotland confirmed that they wished to rely on section 38(1)(a) of FOISA, with section 18, but they also submitted that information about the officers (if held) was not Mr C's personal data "and that this should have been addressed separately": they submitted that information about the officers (if held) may attract the exemption in section 38(1)(b) of FOISA.

18. It must be said that some of Police Scotland's references to section 38 in their submissions and correspondence are not completely clear, though their review response is clear in referring specifically to section 38(1)(a) of FOISA. Whilst both section 38(1)(a) and (b) fall within the terms of section 18, the Commissioner would expect more clarity on which subsection is referred to, especially in the context of a refusal issued under section 18 of FOISA. From the submissions, the Commissioner has taken Police Scotland's position to be that the requested information (if held) is the personal data of Mr C and the officers. As Police Scotland's review response referred to section 38(1)(a) of FOISA, the Commissioner will consider that first.

Data Protection Act 2018 (Transitional provisions)

19. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amended section 38 of FOISA. It also introduced a set of transitional provisions which set out what should happen where a public authority dealt with an information request before FOISA was amended on 25 May 2018, but where the matter is being considered by the Commissioner after that date.

20. In line with paragraph 56 of Schedule 20 to the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018 (as is the case here), the Commissioner must consider the law as it was before 25 May 2018 when determining whether the authority dealt with the request in accordance with Part 1 of FOISA.

21. The Commissioner will therefore consider whether Police Scotland were entitled to apply the exemption in section 38(1)(a) and/or (b) of FOISA under the old law. If he finds that Police Scotland were not entitled apply the exemption in section 38(1)(a) and/or (b) with section 18, he will order Police Scotland to respond otherwise to Mr C's request.

Section 38(1)(a) - Personal data of the applicant

22. "Personal data" are defined in section 1(1) of the DPA 1998 as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

23. The same information may relate to a number of individuals and may constitute personal data for each of them - provided that those persons are identified or identifiable - within the meaning of the DPA 1998. In this instance, acceptance that information (if held) is the personal data of the officers is not called into question by the fact that that information may also constitute information relating to Mr C.

24. The Commissioner is satisfied that, if held, the information covered by the request would be personal data, as defined by section 1(1) of the DPA. Mr C is seeking the name, rank and officer number of officers who were present at his address on a specified date. The information would be data that relate to living individuals who can be identified. The nature of the information means that, if held, it must relate to those persons.

25. The information would show the identity of those who attended Mr C's house on a specified date. Such information would therefore relate to him, as a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (Police Scotland).

26. The situation is analogous to that in Decision 016/2018: Mr Z and the Chief Constable of the Police Service of Scotland[1] where the Commissioner stated:

"The Commissioner has considered the precise wording of Mr Z's request for information. He accepts that while Mr Z is ostensibly seeking only the name of the Chief Inspector who attended a particular meeting, the context created by the wording of his request means that the information, if held, would comprise his own personal data, as defined by section 1(1) of the DPA. The alleged actions of the Chief Inspector relate to an alleged discussion of Mr Z and his actions. The Commissioner therefore accepts that the information covered by Mr Z's request, if it exists and is held, would be exempt from disclosure under section 38(1)(a) of FOISA. Disclosure of the Chief Inspector's name, in response to the request as worded, would effectively disclose Mr Z's personal data."

27. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA 1998 is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA 1998 is also met. "Processing" in the context of a disclosure under FOISA means disclosing the personal data into the public domain. The withheld information (if held) is not sensitive personal data under section 2 of the DPA 1998.

28. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.

29. The exemption in section 38(1)(a) exists under FOISA because individuals have a separate right to make a request for their own personal data under section 7 of the DPA 1998 (post-25 May 2018, separate rights now exist under the General Data Protection Regulation and the DPA 2018). The DPA 1998 will therefore usually determine whether a person has a right to their own personal data, and govern the exercise of that right. Section 38(1)(a) of FOISA does not deny individuals a right to access to information about themselves, but ensures that the right is exercised under the DPA 1998 and not under FOISA.

30. Disclosure under FOISA is accepted to be disclosure into the public domain. The Commissioner is satisfied that disclosure of Mr C's personal data in the circumstances described above would breach the first data protection principle.

31. Having accepted that Police Scotland could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(a) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether Police Scotland were entitled to conclude that it would be contrary to the public interest to reveal whether the information exists or is held.

Section 18(1) - The public interest

32. Police Scotland's initial response identified the "strong public interest in protecting individuals' privacy". They argued that disclosure of such information into the public domain, through FOISA, would be unfair, unlawful and would otherwise breach the DPA 1998. Police Scotland therefore believed that any legitimate interest Mr C had in the personal data (if held) was outweighed by the public interest in ensuring that personal data is processed in accordance with the DPA.

33. As recognised in previous decisions, the Commissioner accepts that there is a strong public interest in protecting the privacy of individuals in general and in relation to their dealings with Police Scotland. He also accepts that there is a strong public interest in ensuring that Police Scotland do not breach data protection law.

34. As stated above, disclosure under FOISA is not simply disclosure to the person requesting the information, but is understood to be a public disclosure. This must always be borne in mind when considering the effects of disclosure; a disclosure of this kind to one individual cannot, therefore, be considered in isolation. Police Scotland referred to this, and they are correct to give this important concept weight.

35. The Commissioner has considered Mr C's arguments and attributes weight to them too. However, as stated above, there exist other ways for a person in Mr C's position to obtain, from Police Scotland, the information he requires (if it is held).

36. The Commissioner accepts that revealing (to the public) whether or not Police Scotland held the requested information, or whether it exists, would, in all the circumstances of this case, be contrary to the public interest. As a result, the Commissioner is satisfied that Police Scotland were entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether they held the information requested by Mr C.

Decision

The Commissioner finds that, in respect of the matters specified in the application, the Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr C.

Appeal

Should either Mr C or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

11 December 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

….

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

(i) paragraphs (a), (c) and (d); and

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

….

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

…

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Data Protection Act 2018

Schedule 2 - Transitional provision etc

56 Freedom of Information (Scotland) Act 2002

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 ("the 2002 Act") before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

(3) To the extent that the request was dealt with before the relevant time -

(a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act as amended by Schedule 19 to this Act, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.

(4) In this paragraph -

"Scottish public authority" has the same meaning as in the 2002 Act;

"the relevant time" means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.

---