|
Decision 234/2016: Tom Gordon and the Chief Constable of the Police Service of Scotland
Production and issuing of letter
Reference No: 201601259
Decision Date: 3 November 2016
Summary
On 8 March 2016, Police Scotland were asked for information about the production and issuing of a specified letter. Initially, Police Scotland refused to confirm or deny whether they held the information, or whether it existed. Later, they confirmed they held it but withheld it as personal data, and under other exemptions.
During the Commissioner's investigation, Police Scotland carried out additional searches and located further information covered by the request. As this information was not located during Police Scotland's handling of the request and review request, the Commissioner found that Police Scotland failed to comply with FOISA.
The Commissioner accepted that Police Scotland were entitled to withhold all of the information as personal data; this included reaching a view about whether the data subject had already put personal data into the public domain.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); 2 (Sensitive personal data); Schedules 1 (The data protection principles) (the first data protection principle); 3 (Conditions relevant for the purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 8 March 2016, Mr Gordon made an information request to the Chief Constable of the Police Service of Scotland (Police Scotland). He asked Police Scotland to supply all items of information they held relating to the production and issuing of a specific letter. Mr Gordon emphasised that his request related specifically to this letter and the circumstances behind its production and issue. He stated that he did not require the material contained in any police investigation.
2. Police Scotland responded on 12 April 2016. They notified Mr Gordon that, under section 18(1) of FOISA, they would neither confirm nor deny whether they held any information falling within the scope of his request, or whether that information existed. They stated that if they held any such information it would be exempt from disclosure under section 38(1)(b) of FOISA (Personal information).
3. On 18 May 2016, Mr Gordon wrote to Police Scotland requesting a review of their decision. He explained why it was apparent that the information did exist.
4. Police Scotland notified Mr Gordon of the outcome of their review on 15 June 2016. They confirmed that they did hold information, which they withheld under sections 38(1)(b), 34 and 35(1) of FOISA.
5. On 12 July 2016, Mr Gordon wrote to the Commissioner, applying to her for a decision in terms of section 47(1) of FOISA. Mr Gordon stated he was dissatisfied with the outcome of Police Scotland's review, challenging Police Scotland's application of exemptions and arguing that disclosure was in the public interest. In addition, he believed the authority's response had focused on the letter rather than material relating to its production and issue.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr Gordon made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
7. On 26 July 2016, Police Scotland were notified in writing that Mr Gordon had made a valid application. They were asked to send the Commissioner the information withheld from Mr Gordon. Police Scotland provided a copy of the letter Mr Gordon referred to in his request. The case was then allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions, focusing on the searches carried out to establish what information was held and the exemptions applied to that information.
9. Police Scotland provided submissions. Having considered these and the content of the letter, the investigating officer asked Police Scotland to carry out further searches. These resulted in further information being identified (see below).
10. Mr Gordon also provided submissions as to why he believed the information should be disclosed.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Gordon and Police Scotland. She is satisfied that no matter of relevance has been overlooked.
Information held by Police Scotland
12. Police Scotland initially provided the investigating officer with a copy of the letter Mr Gordon referred to in his application. During the investigation, Police Scotland were asked to carry out further searches to ascertain whether any additional information might be held in relation to the production and issuing of the letter.
13. Police Scotland carried out further searches and located additional information falling within the scope of the request.
14. In their submissions to the Commissioner, Police Scotland explained the searches and enquiries they undertook (both initially and during the investigation) to ascertain what relevant information they held. They described the nature and outcomes of these searches, explaining why these would be expected to find any relevant information held by Police Scotland.
15. Having considered all relevant submissions and the terms of Mr Gordon's request, the Commissioner accepts that (by the close of the investigation) Police Scotland had taken adequate, proportionate steps to establish whether they held any information falling within the scope of the request. She is satisfied that all the information held was identified and provided to her.
16. However, it is evident that adequate searches were not carried out in responding to Mr Gordon's information request and requirement for review. The search information initially provided to the investigating officer was inadequate. The Commissioner is concerned that the investigating officer had to go back to Police Scotland before they conducted adequate searches to locate all the relevant information they held.
17. Taking account of all of the circumstances, the Commissioner concludes that Police Scotland failed to comply with section 1(1) of FOISA, by failing (in handling Mr Gordon's request and requirement for review) to identify and locate all of the information they held and which fell within the scope of the request.
18. As all the information was eventually located and considered in this decision, the Commissioner does not require any action from Police Scotland in respect of this breach.
Section 38(1)(b) - Personal information
19. Police Scotland withheld all of the information on the basis that section 38(1)(b) of FOISA applied. Section 38(1)(b) (read in conjunction with section 38(2)(a)(i) or 38(2)(b)) exempts personal data if disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
Is the information under consideration personal data?
20. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).
21. The Commissioner has considered the submissions received from Police Scotland on this point, along with the withheld information.
22. The Commissioner is satisfied that the information withheld is personal data. It is possible to identify an individual from the data themselves. The information is biographical in relation to the individual and therefore can be said to relate to them.
23. Police Scotland submitted that the information was sensitive personal data. The definition of sensitive personal data is contained in section 2 of the DPA (see Appendix 1).
24. The Commissioner has reviewed the withheld personal data and is satisfied that all of those personal data fall into one of the categories of sensitive personal data in section 2 of the DPA.
Would disclosure contravene the first data protection principle?
25. In their submissions, Police Scotland argued that the disclosure of the withheld personal data would contravene the first data protection principle. This principle requires that personal data are processed fairly and lawfully and, in particular, are not processed unless at least one of the conditions in Schedule 2 to the DPA is met. For sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.
26. Given the additional restrictions surrounding the disclosure of sensitive personal data, it is necessary in this case to consider whether there are any conditions in Schedule 3 which would permit the data to be disclosed, before considering the Schedule 2 conditions. In Police Scotland's view, no Schedule 3 conditions could be met in this case.
27. The conditions listed in Schedule 3 have been considered by the Commissioner, as have the additional conditions for processing sensitive personal data contained in secondary legislation, primarily the Data Protection (Processing of Sensitive Personal Data) Order 2000. The Commissioner has not identified any of these additional conditions as potentially applicable in this case.
28. Guidance[1] issued by the Commissioner regarding the exemption in section 38(1)(b) notes that, generally, only the first and fifth conditions are likely to be relevant when considering a request for sensitive personal data under FOISA. Condition 1 would allow personal data to be disclosed where the data subject has given explicit (i.e. specific, fully informed and freely given) consent to their disclosure. Condition 5 would allow the personal data to be disclosed if the data had been made public as a result of steps deliberately taken by the data subject.
29. Having considered all relevant submissions, the Commissioner accepts that neither condition 1 nor condition 5 can be met in this case. In reaching this conclusion, the Commissioner considered Mr Gordon's submissions in relation to this. While she acknowledges that the existence of the letter and a very brief partial reference to its content may have been disclosed in the media, apparently with the data subject's approval, she does not consider that such media disclosure is sufficient to meet the requirements of either condition.
30. Having reached this conclusion, and finding that no other condition in Schedule 3 is capable of applying in this case, the Commissioner is of the view that disclosure of the withheld sensitive personal data would breach the first data protection principle. She therefore finds that such disclosure would be unlawful, and that Police Scotland were correct to withhold this information under section 38(1)(b) of FOISA.
31. As the Commissioner has found that the withheld information has been correctly withheld under section 38(1)(b) of FOISA, there is no requirement for her to consider the application of sections 34(1) or 35(1) of FOISA to the same information.
|
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland (Police Scotland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made Mr Gordon.
The Commissioner accepts that Police Scotland correctly withheld all of the information under the exemption in section 38(1)(b) of FOISA.
Police Scotland failed to comply with section 1(1) of FOISA, by failing (in handling Mr Gordon's information request and requirement for review) to identify and locate all of the information they held and which fell within the scope of the request. The Commissioner does not require any action to be taken by Police Scotland in respect of this failure, in response to Mr Gordon's application.
|
Appeal
Should either Mr Gordon or the Chief Constable of Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Rosemary Agnew
Scottish Information Commissioner
3 November 2016
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
