| Decision 237/2014: Mrs X and Stirling Council Significant Case Review Reference No: 201400159
Decision Date: 20 November 2014 Summary On 17 October 2013, Mrs X asked Stirling Council (the Council) for the report of the Significant Case Review into the death of her grandchild. Following a review, in which the Council provided Mrs X with a redacted version of the report, Mrs X remained dissatisfied and applied to the Commissioner for a decision. During the investigation, the Council disclosed more of the report to Mrs X. Following an investigation, the Commissioner accepted that the remainder of the report was exempt from disclosure. |
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections sections 1(1) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 38(1)(b) and (d) and (2)(a)(i) and (b), and (5) (definition of "the data protection principles", "data subject", "personal data" and "health record") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data) and 2 (Sensitive personal data); Schedules 1 (The data protection principles) (the first data protection principle); 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1)) and 3 (Conditions relevant for the purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
Access to Health Records Act 1990 section 1(1) ("Health record" and related expressions")
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 17 October 2013, Mrs X wrote to the Council requesting the Significant Case Review ('SCR') into the death of her grandchild ('Baby C').
2. The Council acknowledged receipt of this request on 22 October 2013.
3. On 20 November 2013, Mrs X wrote to the Council requesting a review because it had failed to respond to her request.
4. The Council notified Mrs X of the outcome of its review on 18 December 2013. The Council disclosed a redacted version of the SCR Report ('the Report'). The Council withheld information from the Report under the exemptions in sections 38(1)(b) and (d) of FOISA. The Chair of the Multi-Agency Child Protection Committee also wrote to Mrs X and offered to meet with her about the SCR, should she so wish.
5. On 23 January 2014, Mrs X applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mrs X was dissatisfied with the outcome of the Council's review because she wanted access to the full Report.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mrs X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to the Commissioner for a decision.
7. On 3 February 2014, the Council was notified in writing that Mrs X had made a valid application. The Council was asked to send the Commissioner a copy of the Report. The Council did so and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.
9. During the investigation, on 9 May 2014, the Council disclosed to Mrs X some information that it had originally redacted from the Report, in particular the names of the SCR Review Team members and their positions.
10. Mrs X subsequently confirmed that she wanted access to the remaining withheld information.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both
Mrs X and the Council. She is satisfied that no matter of relevance has been overlooked.
12. The Council disclosed additional information to Mrs X during the investigation, having concluded that it was not exempt from disclosure under Part 2 of FOISA. The Commissioner finds that the Council breached section 1(1) of FOISA in failing to provide this information to Mrs X when responding to her request.
13. The Council submitted that the remaining information was exempt from disclosure under sections 38(1)(b) and (d) (Personal information) and section 36(2) (Confidentiality) of FOISA. For each redaction, the Council specified which exemption, or exemptions, it believed applied to the information.
14. The Report is labelled "Confidential" and states:
"This report has been redacted to protect the identity and privacy of family members and practitioners involved in this case."
15. The full Report anonymises persons with the intention of eliminating or reducing the risk of identifying those individuals. The Council supplied Mrs X with a redacted version of the Report. That is, the Council removed further information from the already anonymised Report, and it is this redacted information that Mrs X sought to obtain. The Commissioner will consider whether the Council complied with FOISA in withholding this redacted information.
Section 38(1)(b) - Personal information
16. The Council has applied the exemption in section 38(1)(b), read in conjunction with section 38(2)(a)(i) of FOISA, to information in the Report. This provision exempts information from disclosure if it is "personal data" as defined in section 1(1) of the DPA, and disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
17. To rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA, and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles.
Is the withheld information personal data?
18. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
19. Having considered the withheld information, the Commissioner is satisfied that information is personal data: it is possible to identify individuals from the data itself, in line with the above definition (a) of personal data. The withheld information is largely the personal data of the individual represented as "M" in the Report.
20. The Commissioner accepts that, in this case, the dates redacted from the Report also constitute personal data of the data subject M. The dates relate to the specific entries or descriptions or events in the report relating to the data subject, M.
Is the withheld information sensitive personal data?
21. In its submissions, the Council submitted that the redacted information comprised sensitive personal data.
22. The definition of sensitive personal data is contained in section 2 of the DPA (see the Appendix).
23. The Commissioner has carefully reviewed the Report in order to establish how much of it (if any) is the sensitive personal data of M. The Commissioner considers that most of the personal data of M falls into at least one of the categories in section 2, and therefore represents the sensitive personal data of an individual in terms of section 2 of the DPA. (The Commissioner is unable to confirm which of the categories of sensitive personal data are relevant here without, in effect, disclosing sensitive personal data.)
Would disclosure contravene the first data protection principle?
24. In its submissions, the Council argued that disclosure of the personal data of the data subjects would contravene the first data protection principle.
25. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing under consideration is disclosure of the personal data into the public domain in response to Mrs X's information request.
First data protection principle: sensitive personal data
26. Given the additional restrictions surrounding the disclosure of sensitive personal data, it is necessary to consider whether there are any conditions in Schedule 3 which would permit the data to be disclosed, before considering the Schedule 2 conditions. The conditions listed in Schedule 3 to the DPA have been considered by the Commissioner, as have the additional conditions for processing sensitive personal data as contained in legislation such as the Data Protection (Processing of Sensitive Personal Data) Order 2000. The processing here is disclosure of the personal data into the public domain in response to Mrs X's information request.
27. Guidance[1] issued by the Commissioner regarding the exemption in section 38(1)(b) notes that, generally, only the first and fifth conditions are likely to be relevant when considering a request for sensitive personal data under FOISA. Condition 1 would allow personal data to be disclosed where the data subject has given explicit, and fully-informed, consent to their release. Condition 5 would allow the personal data to be disclosed if the data have been made public as a result of steps deliberately taken by the data subject.
28. The Council informed the Commissioner that it had not considered it appropriate to ask the data subject, M, if she would consent to the disclosure of her personal information. The Commissioner agrees that, in the circumstances, it would be inappropriate for the Council to ask M for consent. As the Council does not have the data subject's consent to disclose the requested information, the Commissioner is satisfied that condition 1 is not met in this case.
29. The Commissioner is also satisfied that the information has not been made public as a result of steps deliberately taken by the data subject M, and so condition 5 is not met in this case.
30. Having reached these conclusions, and having concluded that no other condition in Schedule 3 applies in this case, the Commissioner finds that disclosure of M's sensitive personal data would breach the first principle of the DPA and that, as a consequence, the sensitive personal data is exempt from disclosure under section 38(1)(b) of FOISA.
31. Not all of the withheld information is sensitive personal data as defined by the DPA. The Commissioner will now go on to consider the personal data that does not fall within the definition of sensitive personal data. This personal data also relates to M.
First data protection principle: non-sensitive personal data
32. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2], that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).
33. The Council was asked if any of the conditions in Schedule 2 to the DPA would allow the information to be disclosed. It confirmed that it had considered the application of condition 6, which the Commissioner agrees is the only condition which might apply in this case. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
34. The tests which must be met before condition 6(1) can apply are:
(i) Does Mrs X have a legitimate interest in obtaining the personal data?
(ii) If so, is the disclosure necessary for the purposes of those interests? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could the interests be met by means which interfered less with the privacy of the data subject?
(iii) Even if disclosure is necessary for those purposes, would it nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? As noted by Lord Hope in the above judgment, there is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Mrs X must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed.
Does Mrs X have a legitimate interest in obtaining the personal data?
35. The Council acknowledged that Mrs X has a legitimate interest in obtaining the personal data. The Council accepted that Mrs X's relationship to M and to Baby C gave her a legitimate interest in obtaining information which would let her know the circumstances leading up to and surrounding Baby C's death, and the findings of the Report in terms of its conclusions, recommendations, and lessons learnt from it.
36. The Commissioner agrees with the Council's submission on this point. The Report is about Mrs X's grandchild (Baby C) and her interest is therefore a highly personal interest as a grandmother seeking the fullest information possible about the SCR into her grandchild's death. There is also a more general legitimate interest in the public obtaining as full an understanding as possible of the case, in order to ensure that the appropriate lessons are learned and that cases of this type are investigated thoroughly.
Is disclosure of the information necessary for the purposes of these legitimate interests?
37. The Commissioner must now consider whether disclosure of the personal data is necessary for the legitimate interest identified above. In doing so, she must consider whether these interests might reasonably be met by any alternative means.
38. The Council submitted that, whilst the part of the Report entitled "Outline of Circumstances" was more heavily redacted, other parts (such as the Interim Findings and Recommendations, the Final Recommendations, the Findings and the Part Four Conclusions and Recommendations) were largely unredacted and it was possible for Mrs X's legitimate interests to be met, at least in part, without her obtaining the redacted personal data.
39. The Council also commented that it had invited Mrs X to meet with the Chair of the Child Protection Committee so that he could explain to her the background to the Report and address any concerns which she had about the SCR process or conclusions.
40. The Commissioner has considered these submissions carefully and in the light of the decision by the Supreme Court in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55. In this case the Supreme Court stated (at paragraph 27 of the judgment):
"? A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less."
41. The Commissioner is of the view that disclosure of the withheld information would allow additional scrutiny and understanding in relation to the Report. The Commissioner acknowledges that the Council has already given Mrs X a redacted version of the Report which contains a significant amount of information, including information about the findings of the SCR. However, the Commissioner accepts that disclosure of the remaining withheld information is necessary to meet Mrs X's legitimate interests: she could not acquire a full understanding of the Report and the circumstances with which it is concerned other than through disclosure of the withheld information.
42. Similarly, the Council did not indicate that any meeting with Mrs X would allow her access to the full Report or that all the information redacted from the Report would be summarised for her at such a meeting. Again, the Commissioner accepts that disclosure of the redacted information is necessary to meet Mrs X's legitimate interests: she could not acquire a complete understanding of the Report and the circumstances with which it is concerned other than through disclosure of the withheld information.
43. Having decided this, the Commissioner must, therefore, go on to consider the interests of the data subject.
Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
44. The Commissioner must consider whether disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject ("M"). This involves a balancing exercise between the legitimate interests of Mrs X and those of the data subject, M. Only if the legitimate interests of Mrs X outweigh those of M can the information be disclosed without breaching the first data protection principle.
45. In the Commissioner's briefing on section 38 of FOISA, the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise. These include:
? whether the information relates the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);
? the potential harm or distress that may be caused to by the disclosure;
? whether the individual has objected to the disclosure; and
? the reasonable expectations of the individual as to whether the information would be disclosed.
46. The Commissioner is satisfied that the information in question pertains wholly to M's private life.
47. The Council submitted that disclosure could cause harm to the health and safety of M, and distress to M and other persons.
48. The Commissioner accepts that disclosure of the information would be likely to cause distress to M, who would have a reasonable expectation of privacy that personal data relating to such distressing events would not be disclosed under FOISA.
49. M has not been given the opportunity to consent or object to disclosure of her personal data, and the Commissioner has accepted that this was appropriate, in the circumstances of the case.
50. The Commissioner considered whether there is a general expectation that some or all of the information from an SCR Report would be made public. The statutory guidance for conducting a significant case review is "Protecting children and young people: interim guidance for Child Protection Committees for conducting a significant case review" (Scottish Executive, 2007)[3] ("the Guidance").
51. The Council noted that paragraph 75 of the Guidance makes reference to the need to take account of FOISA and the DPA in "both the conduct and reporting of the review."
52. The Council's submission referred to paragraph 72 of the Guidance:
"? it would normally be expected that final versions of each report would be published by the CPC (but detailed information on names and circumstances should be anonymised before publication)."
53. In respect of paragraph 72, the Short Life Working Group on Significant Case Reviews and Multi-Agency Resource Service[4] comments:
"A letter of clarification on the 'norm of publication' was disseminated in October 2007 and was expected to sit alongside the guidance as a note to CPCs, Chief Officers Group, Inspectors and other interested agencies on how paragraph 72 may be understood and implemented. This letter sets out that, 'dissemination' rather than 'publication', should be the key term used. From each particular SCR, Chief Officers should select from a range of dissemination options available to them (including the option of publication aimed at the general public) that best serves the public interest and the purpose of improving service delivery (Scottish Executive 2007)."
54. The Guidance addresses the expectations of family and/or carers, and states (paragraph 81):
"As set out in paras 72-75, the expectation is that the full report will normally be published and that the Executive Summary and Recommendations will always be published. Family/carers and/or other significant adults in the child's life should receive a copy of any report in advance of publication."
55. The Commissioner must consider what expectation M might reasonably have regarding disclosure of information from the SCR Report, in view of the guidance described above. In considering whether the information was exempt from disclosure under section 38(1)(b) of FOISA, the Commissioner can only consider M's expectations regarding disclosure to the public at large, rather than expectations relating to any limited disclosure to family members and/or carers, as described in the preceding paragraph (bearing in mind disclosure under FOISA is disclosure to the public at large).
56. Having regard to the guidance under which the SCR was conducted, the Commissioner is satisfied that M would have a reasonable expectation that although some information from the Report was likely to be published, this would not include information which was capable of identifying her or Baby C. In all the circumstances, the Commissioner accepts that M would not have any reasonable expectation that her personal data would be publicly disclosed (which is the effect of the disclosure of information under FOISA) in the context of Mrs X's information request.
57. On balance, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfil Mrs X's legitimate interests, in this instance she does not agree that this outweighs the prejudice that would be caused by disclosure to the data subject M's rights and freedoms or legitimate interests. Consequently, she finds that such prejudice would be unwarranted. The Commissioner is therefore satisfied that condition 6 of Schedule 2 is not met in this case.
58. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of M, the Commissioner must also conclude that disclosure would be unfair. In the absence of a condition permitting disclosure, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was properly withheld under section 38(1)(b) of FOISA.
Information withheld under section 38(1)(d) of FOISA
59. Section 38(1)(d) of FOISA specifically exempts information if it constitutes a deceased person's health record. Section 38(1)(d) is an absolute exemption and so a public authority is not required to consider the public interest test for information which falls within its terms.
60. The Council submitted that some of the information in the Report which related to Baby C's health constituted a health record as defined in section 1(1) of the Access to Health Records Act 1990, having been extracted from Baby C's health record. It relied on section 38(1)(d) of FOISA to withhold the following information: the date and place of birth; the date and details of discharge from hospital; the date and place of death; the date and cause of death.
61. The Council commented that some of the above data also comprises the sensitive personal data of M. The Commissioner agrees. There will be cases where information relating to a deceased person may also constitute the personal data of another identifiable living individual. In this case, the Commissioner accepts that disclosure of some of the information withheld under section 38(1)(d) would involve disclosure of M's personal data. She has found that M's personal data should not be disclosed under FOISA. In relation to the exemption in section 38(1)(d) of FOISA, therefore, the Commissioner will only consider information which is not M's personal data.
62. The Commissioner is satisfied that the information in question came from a record that can be defined as a health record in terms of section 1(1) of the Access to Health Records Act 1990 (see Appendix for the full definition). The Commissioner find that the information withheld from paragraphs 1.1.4 and 2.0.1 of the SCR Report is exempt from disclosure in terms of section 38(1)(d) of FOISA.
Conclusion
63. The Commissioner has accepted that all the remaining withheld information in the Report is exempt from disclosure under either section 38(1)(b) or section 38(1)(d) of FOISA. Given this conclusion, she is not required to consider whether the exemption in section 36(2) of FOISA should be upheld in relation to the same information.
Other issues
64. During the investigation, the Council commented that the Commissioner cannot decide whether Mrs X's relationship to the individuals discussed in the Report should have entitled her to receive a copy of the Report at the time it was completed or disseminated. The Commissioner agrees with this, except insofar as Mrs X's relationship with the individuals is relevant to considering her legitimate interests (see paragraphs 38 and 39 above).
65. The Commissioner's powers do not entitle her to decide whether the Report should have been published by the Council, or by any other person, at the time it was completed, or at any time before Mrs X made her request. The Commissioner can only consider whether the Council complied with Part 1 of FOISA in responding to Mrs X's request, and whether the information should have been disclosed under FOISA. This is not the same as disclosing it privately to Mrs X.
66. Mrs X also drew the Commissioner's attention to the fact that some SCR Reports have been published and, although the Reports have been anonymised, they include information of the type that Mrs X believed had been redacted from the Report. The Commissioner considered examples of published reports, but these did not persuade her that, in this case, the remaining information should be disclosed.
| Decision The Commissioner finds that Stirling Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mrs X. The Commissioner finds that the Council: (i) was entitled to withhold information under the exemptions in section 38(1)(b) and (d) of FOISA. (ii) was not entitled to withhold the information it provided to Mrs X during the investigation. By initially withholding this information, the Council breached Part 1 (in particular, section 1(1)) of FOISA. The Commissioner does not require the Council to take any action in respect of this failure. |
Appeal
Should either Mrs X or Stirling Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Rosemary Agnew
Scottish Information Commissioner
20 November 2014
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(d) a deceased person's health record.
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(ii) ?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
"health record" has the meaning assigned to that term by section 1(1) of the Access to Health Records Act 1990 (c.23); and
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
Schedule 3 - Conditions relevant for the purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
?
Access to Health Records Act 1990
1 "Health record" and related expressions
(1) In this Act "health record" means a record which -
(a) consists of information relating to the physical or mental health of an individual who can be identified from that information, or from that and other information in the possession of the holder of the record; and
(b) has been made by or on behalf of a health professional in connection with the care of that individual;
?
[1] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
[2] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[3] http://www.scotland.gov.uk/Resource/Doc/174043/0048532.pdf
[4] http://withscotland.org/resources/significant-case-reviews-developing-best-practice/download_document
