Decision 201/2007 | Scottish Information Commissioner

Home Decisions

Decision 201/2007

Decision 201/2007 Mr Allan McLeod and the Scottish Prison Service

Request for dates of temporary release for a named prisoner

Applicant: Mr Allan McLeod
Authority: Scottish Prison Service
Case No: 200700676
Decision Date: 30 October 2007

Kevin Dunion
Scottish Information Commissioner

Request for dates of temporary release of a named prisoner ? notice that information not held ? application of section 17 of FOISA not upheld ? application of section 38(1)(b) of FOISA upheld by the Commissioner

Relevant Statutory Provisions and Other Sources

Freedom of Information (Scotland) Act 2002 (FOISA): sections 1(1) (General entitlement); 17(1) (Notice that information is not held) and 38(1)(b), (2)(a)(i) and (b) (Personal Information)

Data Protection Act 1998 (the DPA): sections 1(1) (Basic interpretative provisions); 2(h) (Sensitive personal data); Part 1 of schedule 1 (The data protection principles) (the first data protection principle); schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1)) and schedule 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data)

The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Other sources:

Information Commissioner: "Freedom of Information Awareness Guidance 1" http://www.ico.gov.uk/documentUploads/AG%201%20personal%20info.pdf

The Chief Constable Northumbria Police (Reference:FS50090750)3 October 2006 http://www.ico.gov.uk/upload/documents/decisionnotices/2006/decision_noticefs50090750_v2.pdf

Transport for London (acting on behalf of any subsidiary authority) (Reference FS50075171) 5th May 2006 http://www.ico.gov.uk/upload/documents/decisionnotices/2006/Decision_Notice_FS50075171.pdf

Facts

Mr Allan Mcleod requested information concerning dates of temporary release for a named prisoner from the Scottish Prison Service (the SPS). The SPS responded by advising Mr McLeod that this information was not held. Mr McLeod was not satisfied with this response and asked the SPS to review its decision. The SPS carried out a review and, as a result, notified Mr McLeod that the original decision had been upheld and confirmed that the information was not held by it. Mr McLeod remained dissatisfied and applied to the Commissioner for a decision. During the course of his investigation, it was found that some relevant information was held electronically, however it was submitted that the information constituted sensitive personal data and was exempt from disclosure under section 38(1)(b) of FOISA.

Following an investigation, the Commissioner found that the SPS had partially dealt with Mr McLeod's request for information in accordance with Part 1 of FOISA. He found that it incorrectly notified Mr McLeod that it did not hold some of theinformation he requested. However, the Commissioner found that any relevant information that was held was exempt from disclosure under section 38(1)(b).

Background

1.On 23 April 2007, Mr McLeod wrote to the SPS requesting the following information: "any record of day or weekend release (named prisoner) may have had during the course of his 2 year sentence. Also his final release date in 1997."

2.The SPS responded on 24 April 2007. The SPS disclosed the release date of the prisoner to Mr McLeod. However, the SPS advised Mr McLeod that, in terms of section 17 of FOISA (Notice that information is not held) it was unable to provide any dates of day or weekend release for the prisoner as the information was no longer held.

3.On 25 April 2007, Mr McLeod wrote to the SPS requesting a review of its decision. In particular, Mr McLeod advised the SPS that, in his view, this information would be retained and never destroyed and was not exempt from disclosure.

4.The SPS notified Mr McLeod of the outcome of its review on 4 May 2007. The SPS upheld its initial decision and advised Mr McLeod that this information was no longer held. The SPS went on to advise Mr McLeod that the paper records for any prisoner serving a sentence of less than four years would only be retained for three years after the prisoner's release, this being in accordance with the SPS Records Management Policy and Guidelines. The SPS also advised Mr McLeod that the only data it still held electronically regarding the named prisoner did not accurately record any day or weekend release that he may have had during the course of his sentence.

5.On 9 May 2007, Mr McLeod wrote to my Office, stating that he was dissatisfied with the outcome of the SPS's review and applying to me for a decision in terms of section 47(1) of FOISA. He submitted that it was his view that the information requested must be held on record, retained and never destroyed.

6.The application was validated by establishing that Mr McLeod had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.

The Investigation

7.The SPS is an Executive Agency of the Scottish Ministers (the Ministers) and a letter was sent to the Ministers' Freedom of Information Unit on 14 June 2007 in line with agreed procedures giving notice that an application had been received and that an investigation into the matter had commenced. The Ministers were asked to provide comments on behalf of the SPS in terms of section 49(3) of FOISA and to respond to specific questions on the application. In particular, the investigating officer sought details of the types of records held in relation to temporary release of prisoners, and associated records management policy and practice.

8.The Ministers responded on 3 July 2007. The response initially explained that information such as periods of temporary absence and a prisoner's release date would normally be held in the prisoner's file (inmate's record (IR)) and on the computerised prison records system (PR2). The Ministers explained that every time a prisoner is granted temporary absence (also known as temporary release), a copy of his or her license would be placed in the IR and should also be recorded on the PR2 system.

9.The Ministers advised my Office that, at the time of the named prisoner's release, when a prisoner was liberated, the IR was either retained by the establishment from which he or she was released or forwarded to the SPS headquarters. In either case, the file would be reviewed and either retained or destroyed. The Ministers went on to explain that there was no consistency of practice at that time. However, the usual practice was to destroy IRs five years after a prisoner's liberation date unless the prisoner was a sex offender, life sentence prisoner or a high profile prisoner.

10.The Ministers also advised my Office that, although there is no record of the destruction of the named prisoner's file, checks had been made with the last establishment where the prisoner was held prior to liberation and with the SPS headquarters in an attempt to locate the file. As it could not be located, the Ministers concluded that the file was destroyed in accordance with practice at that time.

11.The Ministers explained that, although some information was recorded electronically on the PR2 system, it was not considered sufficiently accurate to enable the SPS to identify if the prisoner had been granted day or weekend release. The Ministers supplied my Office with details of the information that was retained on the PR2 system in relation to the individual in question, and which would be capable of confirming whether (and, if so, when) he had been granted temporary release.

12.The Ministers explained that, when Mr McLeod's initial request had been received, the SPS had considered that the information was not sensitive personal data for the purposes of the DPA and, if held, would be releasable under FOISA. As such, the SPS disclosed the release date for the prisoner and attempted to find the information that had been requested in relation to day and weekend release dates.

13.The Ministers went on to state that the SPS had subsequently obtained legal advice to the effect that any information showing or tending to show that a named individual is, or has been serving a prison sentence is "sensitive personal data" for the purposes of the DPA and would consequently be exempt from release under section 38(1)(b) of FOISA.

14.The Ministers therefore concluded that any information contained on the PR2 system within the scope of Mr McLeod's request was sensitive personal information and was therefore exempt from disclosure in terms of section 38(1)(b) of FOISA. The Ministers considered that disclosure would contravene the first data protection principle on fair processing. The Ministers also considered that, of the six conditions for processing as set out in schedule 2 of the DPA, only the sixth might be of relevance but was not in practice met. The Ministers considered that the processing of the data was not necessary for the purposes of any legitimate interest and, even if it were, the processing would be prejudicial to the rights and freedoms or legitimate interests of the particular individual concerned. The Ministers also stated that they did not consider that any of the conditions in schedule 3 of the DPA were met.

15.The Ministers concluded that the SPS has a duty to individual prisoners to protect their personal data. The Ministers considered that prisoners would have an expectation that their personal data would not be released and made publicly available and that they were entitled to the same privacy rights as others.

16.On 10 July 2007, the investigating officer wrote to Mr McLeod advising him that the Ministers were relying on the exemption contained in section 38(1)(b) of FOISA and inviting him to submit comments on this matter.

17.Mr McLeod subsequently made representations to my Office which have been fully taken into account in what follows.

The Commissioner's Analysis and Findings

18.In coming to a decision on this matter, I have considered all of the information and the submissions that have been presented to me by both Mr McLeod and the SPS and I am satisfied that no matter of relevance has been overlooked.

Section 17 ? information not held

19.As indicated at paragraphs 8 ? 10 above, the Ministers have advised me that, although information would have been held on the prisoner's paper file (IR), they were satisfied that the IR in question was no longer held and had been destroyed. In view of the information supplied to me by the Ministers concerning the searches that have been carried out by the SPS to establish whether the IR still exists, I am satisfied that it was reasonable for the Ministers to conclude that the file in question has indeed been destroyed and, indeed, am satisfied that the IR is no longer held by the SPS.

20.I have examined the information contained within the electronic PR2 records that have been supplied to my Office by the Ministers. These records contain information that would allow confirmation of whether (and, if so, when) the named prisoner had been granted temporary release. I have noted the Ministers' comments that they did not consider the information to be sufficiently accurate to enable the SPS to identify whether it fell within the scope of Mr McLeod's request i.e. to identify periods of day or weekend release as requested by Mr McLeod.

21.Having examined this information and the wording of Mr McLeod's request, I am satisfied that the information does in fact fall within the scope of the request. I must therefore disagree with the Ministers' assertion that the recorded information was insufficiently accurate to enable the SPS to identify whether the information was held. I consider that the SPS placed too narrow an interpretation on the wording of the request and, as a result, I consider the SPS was wrong to inform Mr McLeod that the information was no longer recorded.

22.Accordingly, I consider that the SPS breached Part 1 of FOISA by advising Mr McLeod that the requested information was no longer recorded and, consequently, that it was not held in terms of section 17(1).

23.The Ministers have advised me that, notwithstanding the foregoing, the information which is retained on the computerised prison records system is considered by them to be exempt from disclosure in terms of section 38(1)(b) of FOISA.

24.I must therefore go on to consider whether the Ministers correctly applied the exemption in section 38(1)(b) to the information identified and withheld.

Section 38(1)(b) ? Personal information

25.Under section 38(1)(b) of FOISA, (read in conjunction with section 38(2)(a)(i) or (b)), information is exempt information if it constitutes personal data (as defined within the DPA) and disclosure of the information to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in Schedule 1 to the DPA.

26.The Ministers have asserted that the information withheld from Mr McLeod falls within the definition of "sensitive personal data" of the named prisoner. They submitted that disclosure of the information would contravene the first data protection principle on fair processing of personal data which states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 of the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Is the information (sensitive) personal data?

27.In considering this matter, I must firstly consider whether the information requested by Mr McLeod constitutes personal data and, if so, whether this should also be considered to be sensitive personal data.

28.Section 38(2)(a) of FOISA refers explicitly to the definition of "personal data"contained in section 1(1) of the DPA. Personal data is defined in section 1 of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of or is likely to come into the possession of, the data controller (see the full definition in the Appendix).

29.I am satisfied that the information withheld from Mr McLeod in this case constitutes the named prisoner's personal data. This prisoner can clearly be identified from the information in question or from that and other information in the possession of the SPS. The information also relates to this person. I am satisfied that details of this person's presence within, and any temporary absence from, a prison relate to him personally in a significant sense.

30.Section 2 of the DPA goes on to define "sensitive personal data". The Ministers have indicated that they believe the withheld information falls within the scope of subsection (h) of this definition, i.e. information as to any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

31.Having considered the information withheld from Mr McLeod, I am satisfied that it falls within the scope of the definition of sensitive personal data. The information has the named individual as its locus and it relates to the matters set out in section 2(h) of the DPA.

32.In reaching this conclusion, I have made the logical assumption that the release of the requested information will, by direct implication, confirm that the individual in question has a criminal record and has been tried and imprisoned as a result of a criminal offence.

33.I have also taken cognisance of the fact that, as a society, we recognise that information relating to offences can be worthy of additional protection which is why section 2(h) appears in the DPA. It is generally accepted in society that information about a person's criminal record should be given some protection in order to allow them to re-enter society after they have served their sentence and have undergone a period of rehabilitation.

Would disclosure breach the first data protection principle?

34.As noted above, the first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless one of the conditions in Schedule 2 of the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA is also met.

35.In their submissions, the Ministers explained they had considered the conditions for processing contained within Schedule 2 of the DPA and had concluded that only the sixth may be of relevance, but in practice was not met. The Ministers did not consider that any of the conditions within Schedule 3 were met.

36.I will firstly consider whether the disclosure of the information requested by Mr McLeod would be fair to the named individual. As I have noted, I consider this to be sensitive personal data. As sensitive personal data, it is afforded a level of protection through the DPA that goes beyond that provided to non-sensitive personal data.

37.I am satisfied in this case that disclosure would be unfair to the individual named in Mr McLeod's request.

38.In reaching this conclusion, I have noted the guidance from the Information Commissioner ("Freedom of Information Awareness Guidance 1"). The assessment of fairness includes looking at whether the third party would expect that his/her information might be disclosed to others and/or whether the third party would expect that his/her information would be kept private.

39.I am satisfied that there is a general expectation amongst individuals that information of this type will not be made publicly available. The personal data held by the SPS is for the primary purpose of recording the movements of prisoners and an offender would reasonably only expect such information to be processed in connection with this purpose.

40.I have also noted the comments below made by the Information Commissioner in his decision (under the terms of the Freedom of Information Act 2000) The Chief Constable Northumbria Police (Reference:FS50090750)3 October 2006. Although this decision relates to a police file, I consider the circumstances analogous to the appeal under consideration. In his decision, the Commissioner commented:

"It is long established public policy that the release of information held by the

police concerning its criminal investigations of an individual would be unfair. The criminal records of individuals are not available to the public and are protected except in extremely limited circumstances such as to protect vulnerable members of society or to assist the police in criminal investigations."

41.In considering the matter of fairness, I have had regard to the fact that the individual would have been tried in open court and I accept that the decision of the court would have been a matter of public record. However, I have noted comments made by the Information Commissioner in his decision Transport for London (acting on behalf of any subsidiary authority) [FS50075171] 5th May 2006, which states:

"The Commissioner recognises that at the time a case is heard in court, personal data is inevitably disclosed to those attending court, and in the absence of restriction on reporting, could be made known to the wider world. However the Commissioner believes that in practice public knowledge of the issues is only short lived and may be limited to only a small number of people?.There is established public policy on controlling access to the records of those who have been involved with the criminal justice system?. It is clearly not desirable for the Freedom of Information Act to undermine these principles" [Paragraph 5.3.3].

42.On these matters, I find that my thinking is in line with that of the Information Commissioner. I have considered the reasons for which Mr McLeod is seeking the information but I am not persuaded that any of the conditions set out in schedule 3 of the DPA can be met in this instance.

43.Therefore, I am satisfied that disclosure of the information requested by Mr McLeod would breach the first data protection principle.

44.I am therefore satisfied that the information that has been withheld by the SPS in this instance is exempt from disclosure in terms of section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (b).

Decision

I find that the SPS partially acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr McLeod.

I have found that the SPS failed to correctly apply section 17 of FOISA by advising Mr McLeod that the information he requested was not held.

However, I have found that the information identified in the course of my investigation as falling within the scope of Mr McLeod's information request is exempt from disclosure under section 38(1)(b) of FOISA read in conjunction with section 38(2)(a)(i) or (b).

I do not require the SPS to take any action in response to this decision.

Appeal

Should either Mr McLeod or the SPS wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
30 October 2007

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1General entitlement

(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

17Notice that information is not held

(1)Where ?

(a)a Scottish public authority receives a request which would require it either

(i)to comply with section 1(1); or

(ii)to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b)the authority does not hold that information,

It must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

38Personal information

(1) Information is exempt information if it constitutes-

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

...

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

Data Protection Act 1998

1Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

"personal data" means data which relate to a living individual who can be identified ?

(a)from those data, or

(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual

2In this Act "sensitive personal data" means personal data consisting of information as to ?

(h)any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

SCHEDULE 1

THE DATA PROTECTION PRINCIPLES

PART I

THE PRINCIPLES

1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-

(a)at least one of the conditions in Schedule 2 is met, and

(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

SCHEDULE 2

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF ANY PERSONAL DATA

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

SCHEDULE 3

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF SENSITIVE PERSONAL DATA

1 The data subject has given his explicit consent to the processing of the personal data.

2 (1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

(2) The Secretary of State may by order?

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

3 The processing is necessary?

(a) in order to protect the vital interests of the data subject or another person, in a case where?

(i) consent cannot be given by or on behalf of the data subject, or

(ii) the data controller cannot reasonably be expected to obtain the consent of the data subject, or

(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

4 The processing?

(a) is carried out in the course of its legitimate activities by any body or association which?

(i) is not established or conducted for profit, and

(ii) exists for political, philosophical, religious or trade-union purposes,

(b) is carried out with appropriate safeguards for the rights and freedoms of data subjects,

(c) relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and

(d) does not involve disclosure of the personal data to a third party without the consent of the data subject.

5 The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

6 The processing?

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

7 (1) The processing is necessary?

(a) for the administration of justice,

(b) for the exercise of any functions conferred on any person by or under an enactment, or

(2) The Secretary of State may by order?

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

8 (1) The processing is necessary for medical purposes and is undertaken by?

(a) a health professional, or

(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(2) In this paragraph "medical purposes" includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

9 (1) The processing?

(a) is of sensitive personal data consisting of information as to racial or ethnic origin,

(b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

(2) The Secretary of State may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)(c) to be carried out with appropriate safeguards for the rights and freedoms of data subjects.

10 The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph.