|
Decision 201/2016: Mr E and the Scottish Prison Service
Internet searches
Reference No: 201601071
Decision Date: 20 September 2016
Summary
On 23 January 2016, Mr E asked the Scottish Prison Service (the SPS) for all and any information obtained by a named staff member from a number of specified online searches. The SPS informed Mr E that it did not hold the information requested.
Following investigation, the Commissioner accepted that the SPS did not hold the information.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 17(1) (Notice that information is not held)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 23 January 2016, Mr E wrote to the SPS and made reference to his parents having made a complaint to the SPS regarding a staff member using their address for a purpose they considered inappropriate. He also made reference to Decision 178/2015 Mr T and the Scottish Prison Service, following which the SPS had disclosed a list of URLs within that staff member's internet browsing history. This list, which amounted to some 32,000 URLs, was disclosed to Mr T.
2. Mr E requested all and any information derived from the websites accessed by the staff member, as designated in the staff member's URL browsing history, in terms of the outcomes of nine specific searches carried out on 20 March 2015.
3. The SPS responded on 15 February 2016. The SPS explained that following a search of its electronic and paper files, it had concluded that the information requested was not held. It had been routinely destroyed, in accordance with the SPS's standard records management practice, before the date of Mr E' request. In effect, the SPS responded in terms of section 17(1) of FOISA.
4. On 27 February 2016, Mr E wrote to the SPS, requesting a review of its decision. He believed the information would still be held.
5. The SPS notified Mr E of the outcome of its review on 29 March 2016. The SPS upheld the original response, with modification by way of advice and assistance.
6. The SPS explained that information gleaned from any of the URLs on the list provided to Mr T would have been held in the form of notes, in paper form, to assist the staff member concerned in preparing a report. Thereafter, the notes would have been destroyed: they would have no relevance once the report was completed. The SPS confirmed the report had been completed in April 2015 and that no such notes existed. Insofar as any information derived from any of the URLs existed, it was contained in the report and was the personal data of the subject of the report: this, it submitted, would be exempt under section 38(1)(b) of FOISA.
7. The SPS also confirmed that its IT systems did not record or capture material downloaded from the sites in question, only the URLs visited.
8. On 4 June 2016, Mr E wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr E stated he believed that the SPS had failed to conduct appropriate searches to establish that it did not hold any information. He also stated that he had seen the report referred to by the SPS and repudiated did not believe it could be said to contain any information that could have been derived from the URLs listed in this particular request. In the absence of any information in the report which could have been so obtained, the SPS was not entitled to rely upon section 38(1)(b) of FOISA.
Investigation
9. The application was accepted as valid. The Commissioner confirmed that Mr E made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
10. On 5 July 2016, the SPS was notified in writing that Mr E had made a valid application. The case was allocated to an investigating officer.
11. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 27 July 2016, the SPS was invited to comment on this application and to answer specific questions, in particular to explain the steps it had taken to identify and locate the information requested. It was also asked to explain its position in relation to section 38(1)(b) of FOISA.
12. The SPS responded, providing submissions in support of its position that it did not hold the information requested. It explained its previous reference to section 38(1)(b) of FOISA.
13. Mr E made submissions to the effect that the SPS failed to carry out adequate searches, referring to previous Information Rights Tribunal cases and providing reasons why he believed the information should still be held (considered below).
Commissioner's analysis and findings
14. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr E and the SPS. She is satisfied that no matter of relevance has been overlooked.
15. The Commissioner notes that in providing a response to Mr E' requirement for review it upheld the original response with modifications. The review outcome went on to say: "In order to further advise and assist I would make the following observations". The review then explained that information obtained from any of the URLs (as supplied to Mr T) would have been held on paper and was no longer available. It is apparent to the Commissioner that the reference to section 38(1)(b) was made as advice and assistance, providing context but not relating directly to the information under consideration here, and cannot be construed as the SPS relying upon that section to withhold information.
16. In its submissions, the SPS confirmed the reference to section 38(1)(b) of FOISA did not relate to any information that may have been gleaned from the internet when searching the nine URLs listed in Mr E' request, but from the complete list of URLs provided to Mr T. This list was in excess of 32,000 URLs.
17. The Commissioner notes that on making his application, Mr E acknowledged that he had seen the report in question and stated that it did not include information that could have been obtained as a result of the nine searches referred to in his request. In the circumstances, the Commissioner will not consider the reference to section 38(1)(b) any further.
Information held by the SPS
18. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority. This is subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not relevant in this case.
19. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the authority holds, or should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.
20. The Commissioner has taken into account the submissions provided by Mr E, in which he provides reasons why he believes the SPS should hold further information. In this regard, Mr E, made reference to two Information Rights Tribunal cases by way of example; Harper and the Information Commissioner and Royal Mail Group EA/2005/0001[1], and Keiller and the Information Commissioner and University of East Anglia EA/2011/0152[2]. From the guidance provided by such decisions, he concluded that information held electronically, but apparently deleted, by a public authority fell to be regarded as held by the authority, albeit that excessive cost implications might arise where specialist recovery services were required.
21. Mr E submitted that the SPS should have been in a position, from a technical standpoint, to interrogate its own electronic records of the material accessed to determine the nature of the searching and any data returned. This, he submitted, should have been done by the SPS, at the review stage if not earlier. He highlighted the ways in which he understood downloaded material might be retained by the authority.
22. Mr E also highlighted the possibility that relevant information might have been destroyed following receipt of his request. This will be taken into account in assessing the SPS's submissions.
23. In its submissions to the Commissioner, the SPS provided a full explanation of the workings of its IT system in relation to searches conducted on the internet. It explained that when staff conduct a search of the internet, such searches are retained in temporary internet files (which are, by definition "temporary"). It explained that temporary internet files, by default, are overwritten after the storage taken up exceeds 250Mb, as and when other temporary files are created.
24. The SPS stated that a moderate user could expect these files to be overwritten within two weeks. However, heavier use of the internet will mean the 250Mb limit is reached much more quickly. It explained that the URLs contained in Mr E' request date back to March 2015. His request was dated 23 January 2016, almost a year past when any such record might have been recoverable.
25. It provided evidence to show that where internet searches are carried out, the computers on which they are conducted are set to delete search history information after 20 days.
26. The SPS further explained that the web proxy server, through which internet searches are routed, retains a list of all URLs thrown up in an internet search for a period of 3 months (i.e. the information under consideration in Decision 178/2015). It explained that a search of the proxy server was carried out and no further relevant information was identified.
27. The SPS confirmed that information deleted from the temporary internet files was no longer held, and submitted that it was not technically feasible to retrieve information that might have been generated by any searches, for the reasons set out above (i.e. overwriting).
28. In this case, the Commissioner is satisfied that the SPS has provided ample explanation to show that its systems did not hold any of the information requested by Mr E in this case. As the Tribunal said in the Harper decision, whether potentially recoverable material is still held will be a question of fact and degree, dependent on the circumstances of each individual case. In this particular case, she can identify no basis for concluding that relevant information was held at the time the request was received, and therefore none for concluding such information was destroyed following receipt of the request.
29. Having considered all relevant submissions and the terms of Mr E' request, the Commissioner accepts that the SPS took adequate, proportionate steps to establish whether it held any information falling within the scope of the request. She also accepts that it was reasonable in all the circumstances for the SPS to conclude that it did not hold any relevant information.
|
Decision
The Commissioner finds that the Scottish Prison Service complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr E.
|
Appeal
Should either Mr E or the Scottish Prison Service wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Rosemary Agnew
Scottish Information Commissioner
20 September 2016
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
?
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
?
