|
Decision 223/2014: Mr E and the Chief Constable of the Police Service of Scotland
Criminal investigations
Reference No: 201401050
Decision Date: 15 October 2014
Summary
On 3 February 2014, Mr E asked the Chief Constable of the Police Service of Scotland (the Police) for information pertaining to investigations undertaken by the Police. The Police refused to confirm or deny whether they held any information, but stated that if the information was held it would be personal data and its disclosure would be unlawful.
During the investigation, the Police provided a response to one part of Mr E's request. They also stated that, if information relating to the other parts was held (which they refused to confirm or deny), most of it would be Mr E's own personal data.
The Commissioner found that the Police had generally responded to Mr E's request for information in accordance with Part 1 of FOISA. The Commissioner concluded that the Police had been incorrect to refuse to confirm or deny the existence of information which they later disclosed, but that they were entitled to refuse to confirm or deny whether they held the remainder of the information.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 16(1) (Refusal of request); 18(1) (Further provision as respects responses to requests); 38(1)(a), (b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); 2(g) (Sensitive personal data); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 3 February 2014, Mr E made a 13-part request to the Police for information pertaining to investigations they had undertaken.
2. The Police responded on 11 March 2014, citing section 18(1) of FOISA and notifying Mr E that they were unable to confirm or deny whether they held any information falling within the scope of his request. The Police stated that if they held any such information, it would be exempt under section 38(1)(b) of FOISA.
3. On 23 March 2014, Mr E wrote to the Police, requesting a review of their decision as he did not agree with the Police's application of section 18(1) of FOISA.
4. The Police notified Mr E of the outcome of their review on 29 April 2014, upholding their initial decision.
5. On 16 May 2014, Mr E applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr E stated he was dissatisfied with the outcome of the Police's review because he wanted to know what information the Police had recorded. He believed this would enable the Police Independent Review Commissioner to understand the decisions taken and the activities undertaken by police personnel.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr E made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
7. On 7 July 2014, the Police were notified in writing that Mr E had made a valid application. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Police were invited to comment on this application and answer specific questions, including justifying their reliance on any provisions of FOISA they considered applicable to the information requested. The Police were also asked whether they still considered that section 18(1) was engaged, in relation to parts 12 and 13 of the request.
8. The Police responded on 26 July 2014 and stated that section 18(1) was engaged by parts 1 to 12 of the request. They stated that if they held the information requested in parts 1 to 12 of the request, which they would neither confirm or deny, it would be exempt from disclosure under sections 38(1)(a) and (b) of FOISA. The Police provided a copy of a letter they had sent to Mr E on 24 July 2014, informing him that they were now relying on section 38(1)(a) of FOISA as well as section 38(1)(b), in conjunction with section 18(1), in refusing to comply with parts 1 to 12 of his request. In response to part 13 of the request, the Police provided Mr E with an explanation and some information, and confirmed that they no longer considered section 18(1) of FOISA to be engaged.
9. The investigating officer asked for Mr E's comments on the letter from the Police, dated 24 July 2014. His response included additional comments on his legitimate interest in obtaining the requested information, if it was held by the Police. He also provided some clarification of the terms of request 12.
10. The Police were provided with Mr E's comments on the interpretation of part 12 of his request. The Police reiterated that section 18(1) of FOISA was engaged in relation to part 12, stating that if any information was held (which they would neither confirm or deny) it would be exempt under section 38(1)(a) of FOISA.
11. On 11 September 2014, the Police were asked for, and provided, their comments on the public interest test in relation to section 18(1) of FOISA.
Commissioner's analysis and findings
12. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr E and the Police. She is satisfied that no matter of relevance has been overlooked.
Part 13 of the request
13. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received, subject to qualifications which are not applicable here.
14. The investigating officer asked the Police to reconsider their response to part 13 of Mr E's request. The Police stated that they no longer considered that section 18(1) of FOISA applied to this part of the request and provided some information to Mr E.
15. As the Police initially failed to provide Mr E with information which was not exempt from disclosure, the Commissioner must find that the Police failed to comply fully with section 1(1) of FOISA in dealing with this part of the request.
Section 18(1) of FOISA - "neither confirm nor deny"
16. The Police refused to confirm or deny whether they held any information falling within the scope of parts 1 to 12 of Mr E's request. The Police adhered to this position in their submissions to the Commissioner.
17. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:
? a request has been made to the authority for information which may or may not be held by it;
? if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA;
? the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
18. Where a public authority has chosen to rely on section 18(1), the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions listed in section 18(1).
19. In any case where section 18(1) is under consideration, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
20. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if held, would be exempt information under one or more of the listed exemptions. Where the exemption(s) is/are subject to the public interest test in section 2(1)(b) of FOISA, the authority must also be able to satisfy the Commissioner that the public interest in maintaining the exemption(s) outweighs any public interest there would be in releasing any relevant information, if held.
21. In this case, the Police submitted that if they held any information falling within the scope of Mr E's request, it would be exempt from disclosure under sections 38(1)(a) and 38(1)(b) of FOISA.
22. The Commissioner must first consider whether the Police could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and was held; in other words, whether the Police could have refused to provide the information on the grounds that it was exempt from disclosure under either section 38(1)(a) or section 38(1)(b) of FOISA, if they held it.
Section 38(1)(a) - Personal information of the data subject
23. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject. The fact that it is an absolute exemption means that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.
24. This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a "subject access request") under section 7 of the DPA. This ensures that such information is disclosed to the data subject (rather than to the world at large, which is the effect of disclosure under FOISA) under a regime designed for such purposes.
25. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
26. The Police considered that some or all of the information sought by Mr E in his request would comprise his own personal data, if held.
27. Having considered the terms of Mr E's request, the Commissioner is satisfied that, if held, parts 1, 2, 5, 6, 7, 8, 9, 10, 11 and 12 of the request would be for information which is Mr E's own personal data, as defined in section 1(1) of the DPA. It is likely that, if held, some of the information captured by parts 3 and 4 of the request would also comprise Mr E's own personal data. She accepts that such information would be exempt from disclosure under section 38(1)(a) of FOISA.
Section 38(1)(b) - Personal information of third parties
28. As the Commissioner has concluded that, if held, parts 1, 2, 5, 6, 7, 8, 9, 10, 11 and 12 of the request relate to Mr E's own personal information, only parts 3 and 4 of the request will be considered in relation to section 38(1)(b) of FOISA.
29. The Police stated that if they held information covered by parts 3 and 4 of the request (relating to other identifiable individuals), they would apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
30. In order to rely on this exemption, the Police must show, firstly, that any such information would be personal data for the purposes of the DPA and, secondly, that disclosure of that data would contravene one or more of the data protection principles to be found in Schedule 1.
Is the information personal data?
31. The definition of "personal data" is set out in paragraph 25 above.
32. The Police stated that, if they held it, the information asked for by Mr E would be the personal data of the individuals referred to in requests 3 and 4. The information, by definition, would relate to the individuals and would identify them. Having considered the type of information Mr E is seeking, the Commissioner accepts this.
Would disclosure contravene the first data protection principle?
33. In their submissions, the Police argued that disclosure of the information, if held, would contravene the first data protection principle. They submitted that the information would be sensitive personal data and no conditions would permit disclosure. Consequently, disclosure would be unlawful.
34. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
35. The processing under consideration in this case would be the disclosure of any personal data that might be held by the Police into the public domain, in response to Mr E's information request.
36. The Police submitted that, if they held any relevant information, it would be sensitive personal data in terms of section 2(g) of the DPA. This applies to personal data "consisting of information as to the commission or alleged commission of any offence".
37. The Commissioner notes that the requests are for information about actions taken or not taken by the Police in relation to matters described by Mr E, relating to named individuals and alleged criminal activities. The Commissioner accepts that any relevant information held by the Police would, if held, be sensitive personal data falling within the description in section 2(g) of the DPA.
38. Given the additional restrictions surrounding the disclosure of sensitive personal data, it makes sense to look at whether there are any conditions in Schedule 3 which would permit any relevant data to be disclosed, before considering the Schedule 2 conditions.
Can any of the conditions in Schedule 3 be met?
39. There are 10 conditions listed in Schedule 3 to the DPA. One of these, condition 10, allows sensitive personal data to be processed in circumstances specified in an order made by the Secretary of State. The Commissioner has therefore considered the additional conditions for processing sensitive personal data contained in secondary legislation, such as the Data Protection (Processing of Sensitive Personal Data) Order 2000. None of these are applicable in this case.
40. The Commissioner's guidance[1] on the section 38 exemptions concludes that (in practical terms) there are only two conditions in Schedule 3 which would allow sensitive personal data to be processed in the context of a request for information under FOISA, namely:
? the data subject has given explicit consent to the processing (condition 1); or
? the information contained in the personal data has been made public as a result of steps taken deliberately by the data subject (condition 5).
41. The Commissioner is satisfied that neither of these conditions would apply, if the information existed and was held.
42. Having considered the other conditions in Schedule 3 and (as indicated above) the additional conditions contained in secondary legislation, the Commissioner has come to the conclusion that there is no condition which would permit disclosure of the type of sensitive personal data under consideration here, should any relevant data be held by the Police.
43. In the absence of a condition permitting disclosure, any such disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of any relevant data if held by the Police would breach the first data protection principle and that the information, if held, would therefore be exempt from disclosure under section 38(1)(b) of FOISA.
Conclusion on section 16(1)
44. Having accepted that the Police could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of sections 38(1)(a) and 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether the Police were entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.
The public interest - section 18(1)
45. Mr E provided reasons why he believed the information he was seeking, if held, should be disclosed, in the interests of justice and the public interest. These related to his belief that certain public employees had acted in dereliction of their legal duties and that their actions and decisions should be subject to legitimate public scrutiny.
46. The Police argued that it was in the public interest that they should neither confirm nor deny whether they held information covered by Mr E's request, under section 18(1) of FOISA. The information, if held, would relate to a complaint or allegation made. The Police took the view that the confidentiality of such reported matters is crucial in maintaining public trust.
47. The Police argued that to disclose such information, if it were held, would jeopardise the candour and freedom with which the Police are able to gather relevant evidence and make reports to the Procurator Fiscal. They argued that it was in the public interest that any individual coming to the attention of the Police as a witness, suspect or accused should remain confident that confirmation of their involvement will only be disclosed to the proper authorities in appropriate circumstances.
48. The Police considered that confirmation of the existence or otherwise of the information covered by Mr E's request would deter people from reporting such matters for fear that the information or its existence would be revealed. Over a period of time, this would severely prejudice the ability of the Police to carry out a key enforcement role in terms of the prevention and detection of crime. Any disclosure of such allegations or investigations may also place those providing information to the police at risk of retribution.
49. For these reason, the Police took the view that the public interest lay in refusing to confirm or deny whether they held the information requested by Mr E, by applying section 18(1) of FOISA.
50. Having considered the submissions of both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for the Police to reveal whether the information requested by Mr E existed or was held by them.
51. As a result, the Commissioner is satisfied that the Police were entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether they held the information requested by Mr E, or whether such information existed.
|
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland (the Police) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr E.
The Commissioner finds the Police were entitled, under section 18(1) of FOISA, to refuse to reveal whether the information requested in parts 1 to 12 of Mr E's request existed or was held.
However, by initially refusing to reveal whether information requested in part 13 of Mr E's request existed or was held and later providing Mr E with information, the Police failed to comply with Part 1 of FOISA and, in particular, with section 1(1) of FOISA.
The Commissioner does not require the Police to take any further action in respect of this failure, in response to Mr E's application.
|
Appeal
Should either Mr E or the Police wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
15 October 2014
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
(e) in subsection (1) of section 38 -
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
16 Refusal of request
(1) Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-
(a) discloses that it holds the information;
(b) states that it so claims;
(c) specifies the exemption in question; and
(d) states (if not otherwise apparent) why the exemption applies.
?
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
?
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
?
(g) the commission or alleged commission by him of any offence, or
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
[1]
