|
Decision 241/2016: Mrs Carolyn Neilson and Greater Glasgow and Clyde Health Board
Significant Clinical Incident investigation
Reference Nos: 201600864, 201600865, 201601125
Decision Date: 9 November 2016
Summary
NHS Greater Glasgow and Clyde was asked for information relating to a specified Significant Clinical Incident (SCI) investigation and report.
NHS Greater Glasgow and Clyde disclosed some information, but stated that other information was not held or was personal data and exempt from disclosure.
The Commissioner found that NHS Greater Glasgow and Clyde failed to comply with timescales for responding, failed to identify all the relevant information it held and incorrectly withheld some information as personal data. She was satisfied that NHS Greater Glasgow and Clyde could withhold a limited amount of information.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 10(1) (Time for compliance); 15 (Duty to provide advice and assistance); 21(1), (4), (5), and (10) (Review by Scottish public authority) and 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions) and 2(e) (Sensitive personal data); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle), Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendices form part of this decision.
Background
Request 1
1. On 30 June 2015, Mrs Neilson made a request for information to Greater Glasgow and Clyde Health Board (NHS Greater Glasgow and Clyde). The information request was in 13 parts and related to a specific Significant Clinical Incident (SCI) investigation and report. The details of the request are attached at Appendix 2.
2. NHS Greater Glasgow and Clyde responded on 30 July 2015. It provided information in response to part 1 of the request, with personal data redacted in terms of section 38(1)(b) of FOISA. It explained that this was all the information it held which fell within the scope of parts 2 to 5 (inclusive), 9, 12 and 13 of her request. In response to part 10, it provided a copy of the action plan. It stated that it held no information falling within the scope of parts 7, 8 and 11 of the request.
3. In relation to part 6, NHS Greater Glasgow and Clyde withheld the information (statements obtained from staff) under sections 30(b), 30(c) and 38(1)(b) of FOISA.
Request 2
4. Within an email of 6 August 2015, which also sought clarification of aspects of NHS Greater Glasgow and Clyde's response to request 1, Mrs Neilson submitted a further request for information (relating to the same SCI, in 15 parts). Full details are attached at Appendix 3.
5. The request for clarification was responded to on 18 August 2015.
6. On 14 September 2015, NHS Greater Glasgow and Clyde responded to request 2. It provided information in response to parts 3, 7, 9 to 12 (inclusive) and 15 of the request. In relation to parts 1, 2, 4, 5, 6, 8, 13 and 14, it notified Mrs Neilson that it did not hold any information, explaining that any information it held covered by part 14 had been disclosed in response to request 1.
Request 3
7. On 21 August 2015, Mrs Neilson wrote to NHS Greater Glasgow and Clyde again. She sought further clarification in relation to the response of 18 August 2015. She also submitted a new request for information in three parts (request 3, attached at Appendix 4). NHS Greater Glasgow and Clyde subsequently interpreted two of the points for clarification as new requests for information (confirmed on 2 September 2015). The Commissioner accepts that this was appropriate and these are listed as parts 4 and 5 of request 3.
8. In its communication of 2 September 2015, NHS Greater Glasgow and Clyde confirmed it was treating parts 4 and 5 above as new requests. It also asked Mrs Neilson to clarify what she meant by "contemporaneous" in part 1 of the request 3. On 3 September 2015, Mrs Neilson confirmed that she was seeking the first record or report of the incident by the person who discovered the incident, which prompted local investigation and fact finding.
Requirement for review: requests 1 - 3
9. On 1 October 2015, Mrs Neilson wrote to NHS Greater Glasgow and Clyde, requesting a review of its responses to requests 1 and 2 and its failure to respond to request 3. She also referred to delays in responding to her requests.
10. In summary, Mrs Neilson submitted that she believed requests 1 and 2 could be interpreted as seeking all information held in connection with the SCI, created by anyone from the date of the incident until (and including) the final SCI report and any consequent decisions or actions. She believed NHS Greater Glasgow and Clyde had taken an unduly narrow view of the requests, submitting that this was not consistent with the duty in section 15 of FOISA or paragraph 5.3.1 or 5.3.3 of the Scottish Ministers' Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004[1] (the Section 60 Code).
11. Mrs Neilson believed further information should be held for both of requests 1 and 2, explaining in some detail why she considered this to be the case. She also challenged the application of section 30 and 38(1)(b) of FOISA to withhold information, submitting that she had a legitimate interest in obtaining the information.
Review outcome: requests 1 and 2
12. On 22 November 2015, NHS Greater Glasgow and Clyde responded to Mrs Neilson's requirement for review in relation to requests 1 and 2. It apologised for the delay in responding.
13. In relation to part 6 of request 1, NHS Greater Glasgow and Clyde withdrew its reliance on section 30 of FOISA and provided information previously withheld, subject to redaction of personal data under section 38(1)(b).
14. Generally, NHS Greater Glasgow and Clyde upheld its conclusions that information was not held. It confirmed that it should have made clearer that this was the position in relation to parts 12 and 13 of request 1, and parts 1 and 2 of request 2.
15. In relation to other parts of the requests, NHS Greater Glasgow and Clyde provided some additional information. It was satisfied that it had provided adequate advice and assistance in the circumstances.
Review outcome: request 3
16. On 6 November 2015, NHS Greater Glasgow and Clyde responded to request 3. In relation to part 1 of the request, NHS Greater Glasgow and Clyde referred to the information provided in response to Requests 1 and 2. It provided information in response to part 5, again referring back to these earlier responses.
17. NHS Greater Glasgow and Clyde confirmed that it did not hold any information falling within the scope of parts 2, 3 and 4 of request 3.
18. The response of 6 November 2015 advised Mrs Neilson that she had the right to request a review if she was dissatisfied. This was incorrect: NHS Greater Glasgow and Clyde had clearly received Mrs Neilson's requirement for review dated 1 October 2015 and the communication of 6 November 2015 must be read as a response to that requirement for review, in terms of section 21(4)(c) of FOISA. Mrs Neilson's next recourse in relation to request 3 was to apply to the Commissioner.
19. On 12 November 2015, NHS Greater Glasgow and Clyde provided a separate response to Mrs Neilson's requirement for review at it related to its failure to respond to Request 3. NHS Greater Glasgow and Clyde apologised for the failure to respond to request 3 within the time allowed and referred Mrs Neilson to its response of 6 November 2015. This letter advised Mrs Neilson of her right to apply to the Commissioner if dissatisfied.
20. On 23 November 2015, Mrs Neilson wrote to NHS Greater Glasgow and Clyde, requesting a review of its response of 6 November 2015. Mrs Neilson believed an "executive summary" of the report should have been provided as she believed this fell within the scope of her request. She also stated that other information should be held. NHS Greater Glasgow and Clyde responded on 21 December 2015, providing a copy of the "executive summary" with explanations regarding the creation of other records.
Request 4
21. Mrs Neilson made a further information request to NHS Greater Glasgow and Clyde on 6 October 2016. This request, which also related to the SCI, was in seven parts and is attached in full at Appendix 5.
22. On 30 October 2015, NHS Greater Glasgow and Clyde responded to request 4. This purported to provide all the information requested, with redaction of information not considered to fall within the scope of the request.
Requirement for review: request 4
23. On 16 November 2015, Mrs Neilson wrote to NHS Greater Glasgow and Clyde requesting a review of its response to request 4. She did not accept that she had been given all the relevant information NHS Greater Glasgow and Clyde held, referring in particular to the responses she had received to parts 4 and 5 of the request.
Review outcome: request 4
24. On 17 December 2015, NHS Greater Glasgow and Clyde responded to Mrs Neilson's requirement for review regarding request 4. In summary, NHS Greater Glasgow and Clyde informed Mrs Neilson that it held no further information, in addition to that provided previously. It informed her that the earlier email and handbook, referred to in her requirement for review, could not be located.
Applications to the Commissioner
25. On 5 May 2016, Mrs Neilson wrote to the Commissioner. She applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mrs Neilson stated she was dissatisfied with the outcome of NHS Greater Glasgow and Clyde's reviews in relation to requests 1, 2 and 3. In this application, she expressed dissatisfaction with the time taken to respond to her requests and requirements for review.
26. On 16 June 2016, Mrs Neilson further applied to the Commissioner for a decision, as she was dissatisfied with the outcome of NHS Greater Glasgow and Clyde's review in relation to request 4.
27. In each application, Mrs Neilson made a number of comments regarding the information provided which cannot be taken as dissatisfaction with the responses received.
28. In summary, Mrs Neilson was not satisfied that NHS Greater Glasgow and Clyde had provided all the information it held and which fell within the scope of her requests. She provided reasons why she believed further information should be held.
29. Mrs Neilson disputed the withholding of personal data under section 38(1)(b) of FOISA, and also questioned whether some redactions actually related to personal data. She considered some redactions to be unexplained.
30. Mrs Neilson continued to argue that she had not been provided with adequate advice and assistance in relation to requests 1 and 2, which she believed had been interpreted too narrowly. In relation to request 3, she questioned whether she had been given adequate notice of the review outcome.
31. Given the related subject matter of the four requests, the Commissioner considers it appropriate to address Mrs Neilson's applications in a single decision.
Investigation
32. The applications were accepted as valid. The Commissioner confirmed that Mrs Neilson made requests for information to a Scottish public authority and asked NHS Greater Glasgow and Clyde to review its responses to those requests before applying to her for a decision.
33. On 8 June 2016 (in relation to request 3), 9 June 2016 (in relation to requests 1 and 2) and 14 July 2016 (in relation to request 4), NHS Greater Glasgow and Clyde was notified in writing that Mrs Neilson had made valid applications as outlined above. NHS Greater Glasgow and Clyde was asked to send the Commissioner the information withheld from Mrs Neilson. NHS Greater Glasgow and Clyde provided the information and the cases were allocated to an investigating officer.
34. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Greater Glasgow and Clyde was invited to comment on Mrs Neilson's applications, and to answer specific questions in relation to its handling of her requests and the application of any exemptions it considered applicable. Further correspondence followed between NHS Greater Glasgow and Clyde and the investigating officer.
35. NHS Greater Glasgow and Clyde accepted that it had failed to comply with sections 10 and 21 of FOISA in responding to requests 1, 2 and 3. For these failures, NHS Greater Glasgow and Clyde offered apologies.
36. In relation to all four requests under consideration, NHS Greater Glasgow and Clyde described the searches conducted to identify the information requested. It provided evidence of these searches and the instructions given to those asked to search, submitting that these demonstrated the requests had not been treated narrowly as suggested by Mrs Neilson.
37. NHS Greater Glasgow and Clyde accepted that it had failed to identify some information falling within the scope of parts 1 and 11 of request 1 and parts 1 and 2 of request 2. It also acknowledged that the information provided in response to a later request of 2 November 2015, not under consideration here, should have been identified (as falling within the scope of requests 2 and 4) when it responded to the requests under investigation here. NHS Greater Glasgow and Clyde provided Mrs Neilson with the information it had identified and located during the investigation.
38. Mrs Neilson acknowledged receipt of the information, but made additional submissions to the effect that she believed other information should be held. Following further correspondence with the investigating officer, NHS Greater Glasgow and Clyde was asked to conduct further searches in order to ensure that all information falling within the scope of Mrs Neilson's requests had been identified.
39. NHS Greater Glasgow and Clyde provided evidence to show that at the time of the requests, and during the investigation, relevant staff members had been asked to confirm whether or not they held any information falling within the scope of Mrs Neilson's requests.
40. NHS Greater Glasgow and Clyde also provided submissions to the effect that any remaining information it had identified was considered to be exempt under section 38(1)(b) of FOISA, on the basis that disclosure would breach the first data protection principle.
41. Mrs Neilson also provided submissions as to why she had a legitimate interest in the information being withheld.
Commissioner's analysis and findings
42. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mrs Neilson and NHS Greater Glasgow and Clyde. She is satisfied that no matter of relevance has been overlooked.
43. The Commissioner must emphasise that FOISA gives applicants the right to recorded information held by a Scottish public authority. Rights under FOISA do not extend to providing individuals the right to require explanation why particular procedures were or were not followed, if that information is not recorded. In these cases, Mrs Neilson made a number of submissions regarding her interpretation of the information disclosed, and to the effect that NHS Greater Glasgow and Clyde failed to follow its own internal guidance.
44. The Commissioner cannot draw any conclusions from information that is held (or not held, as the case may be). A number of Mrs Neilson's submissions cannot be considered relevant to NHS Greater Glasgow and Clyde's handling of her requests in terms of FOISA.
Was all relevant information identified, located and provided by NHS Greater Glasgow and Clyde?
45. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to certain qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.
46. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information the authority should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.
47. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. She also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information.
48. The Commissioner has taken account of all of the submissions made by Mrs Neilson as to why she considered further information should be held by NHS Greater Glasgow and Clyde. She identified issues raised by a particular member of staff and their representative. She also referred to particular members of staff for whom she expected correspondence should be held, and other descriptions of information she expected to be held: these comments included conclusions drawn from information she held or had access to. She provided reasons for her conclusions.
49. NHS Greater Glasgow and Clyde provided background information in relation to all four requests. It explained that the earliest recorded documentation relating to the incident that it was able to identify was dated 9 January 2014 and, while this (and other documentation) would suggest that some earlier documentation should be held, it confirmed that no earlier dated documentation could be found. It also confirmed that while Mrs Neilson was aware that specific emails had been sent by an individual to NHS Greater Glasgow and Clyde, and while it might be expected that other particular documents should be held, searches confirmed that no further information was held.
50. NHS Greater Glasgow and Clyde explained the searches that had been conducted to ascertain what information it held falling within the scope of each of the four requests under consideration here. It confirmed the staff consulted, which included those Mrs Neilson believed should be consulted, and the responses to those consultations (with evidence).
51. NHS Greater Glasgow and Clyde also confirmed that, with the assistance of the IT Department, further searches were conducted during the investigation to ascertain whether it held any further information falling within the scope of request 1 to 4.
52. NHS Greater Glasgow and Clyde submitted that the conclusion of further searches was that information was located which was considered to fall within the scope of parts 1 and 11 of request 1 and parts 1 and 2 of request 2. It confirmed that this additional information was provided to Mrs Neilson during the investigation, along with an apology for not locating it sooner.
53. NHS Greater Glasgow and Clyde also withdrew its reliance on section 38(1)(b) of FOISA as it related to some of the redaction made to previous disclosures. It provided further information to Mrs Neilson, with those redactions re-instated.
54. NHS Greater Glasgow and Clyde also acknowledged that, as outlined by Mrs Neilson in her application to the Commissioner, its response to a later request of 2 November 2015 provided information (relating to the Integrated Care General Practitioner ICGP Handbook) which should have been identified as falling within the scope of requests 2 and 4. It apologised for not identifying this information at the time it responded to the requests under consideration here.
55. Having considered NHS Greater Glasgow and Clyde's submissions, the Commissioner finds that in responding to Mrs Neilson's requests 1, 2 and 4, NHS Greater Glasgow and Clyde failed to identify and locate all of the information it held and which fell within the scope of those requests. This was clearly a failure to comply with section 1(1) of FOISA and is indicative of inadequate consideration of the request, followed by inadequate searches. Had these matters been addressed adequately in responding to the requests, all relevant information should have been identified earlier, additional information should have been provided to Mrs Neilson at that point and considerable resources might have been saved by both NHS Greater Glasgow and Clyde and the Commissioner.
56. In particular, the Commissioner finds NHS Greater Glasgow and Clyde was incorrect to give Mrs Neilson notice, in terms of section 17(1) of FOISA, that it held no information falling within the scope of parts 1 and 11 of request 1 or parts 1 and 2 of request 2.
57. The Commissioner accepts NHS Greater Glasgow and Clyde's interpretation of each of the requests under consideration here and, having considered all relevant submissions and the terms of the requests, accepts, on the balance of probabilities, that searches carried out that by the close of the investigation identified and located all of the information held by NHS Greater Glasgow and Clyde and falling within the scope of Mrs Neilson's requests.
Section 38(1)(b) - Personal Information
58. During the investigation, NHS Greater Glasgow and Clyde confirmed that the only information it now wished to withhold was information that it considered to be the personal data of a patient and medical staff on duty at the time of the incident. NHS Greater Glasgow and Clyde submitted that this was exempt from disclosure in terms of section 38(1)((b) of FOISA, on the basis that disclosure would breach the first data protection principle.
59. As mentioned above, NHS Greater Glasgow and Clyde provided Mrs Neilson with information that it had previously redacted in terms of section 38(1)(b) of FOISA. In the absence of any submissions justifying the withholding of that information at the time NHS Greater Glasgow and Clyde handled Mrs Neilson's request, the Commissioner finds that it was not entitled to rely upon section 38(1)(b) of FOISA to withhold the information later disclosed.
60. Given that this information was disclosed during the investigation, the Commissioner does not require NHS Greater Glasgow and Clyde to take any action in this connection.
61. The Commissioner will now consider whether NHS Greater Glasgow and Clyde was entitled to withhold the remaining information to which it applied section 38(1)(b) of FOISA.
62. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
63. NHS Greater Glasgow and Clyde submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first data protection principle.
64. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle, as claimed.
65. This particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
66. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).
67. NHS Greater Glasgow and Clyde provided submissions to the effect that the information still withheld under this section was considered to be personal data relating to a patient and members of medical or nursing staff who were on duty at the time of the incident, which led to the SCI report.
68. The Commissioner has considered the submissions received from NHS Greater Glasgow and Clyde and Mrs Neilson on this point, along with the withheld information. She is satisfied that living individuals could be identified from the information, either by itself or with other information reasonably likely to be accessible to Mrs Neilson (and others). In the circumstances, she does not believe it would be possible to anonymise the information fully, thus removing the risk of identification. Given the nature of the information, the Commissioner agrees with NHS Greater Glasgow and Clyde's submission that it is of biographical significance and thus relates to the individuals concerned. Consequently, the Commissioner accepts that the information would be those individuals' personal data, as defined by section 1(1) of the DPA.
69. The Commissioner also notes that Mrs Neilson is in a unique position, in that she is aware of some of the information that has been withheld and has confirmed she had some knowledge of the subject matter prior to making her requests.
70. As NHS Greater Glasgow and Clyde submitted that some of the information redacted related to patient data, the Commissioner requires to consider whether this is sensitive personal data as defined by section 2 of the DPA.
Sensitive personal data
71. NHS Greater Glasgow and Clyde submitted that any information relating to individual patients was sensitive personal data.
72. Section 2 of the DPA provides that certain types of personal data are to be considered as sensitive personal data, which is afforded additional protection under the DPA. This includes, at section 2(e), personal data consisting of information about the physical or mental health or condition of an individual. The Commissioner is satisfied that the information under consideration here, and redacted as patient data, clearly relates to the physical or mental health or condition of an individual and is therefore sensitive personal data.
The first data protection principle
73. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain in response to Mrs Neilson's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, as defined in section 2 of the DPA, at least one of the conditions in schedule 3 to the DPA must also be met.
74. As mentioned above, the Commission considers that patient data falls to be considered as sensitive personal data, and so a condition in schedule 3 of the DPA would have to be met to allow disclosure into the public domain.
Can any of the conditions in Schedule 3 to the DPA be met?
75. The Commissioner's guidance[2] on the section 38 exemption concludes that (in practical terms) there are only two conditions in Schedule 3 which would allow sensitive personal data to be processed in the context of a request for information under FOISA, namely:
? Condition 1 - the data subject has given explicit consent to disclosure of the information; or
? Condition 5 - the information contained in the personal data has been made public as a result of steps taken deliberately by the data subject.
76. In relation to the withheld information, the Commissioner accepts that the data subject has not given explicit consent to the disclosure of the information and she would not expect NHS Greater Glasgow and Clyde to attempt to obtain such consent. Consequently, she is satisfied that condition 1 in Schedule 3 cannot be met.
77. Similarly, from the information available to her, the Commissioner is unable to conclude that condition 5 in Schedule 3 can be met in this case.
78. Having also considered the other conditions in Schedule 3, the Commissioner has come to the conclusion that there is no condition which would permit disclosure of the sensitive personal data under consideration here. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of any information consisting of patients' personal data would breach the first data protection principle, and that this information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.
Can any of the conditions in Schedule 2 to the DPA be met?
79. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the withheld personal data of the medical staff to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.
80. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
81. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
82. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
? Is Mrs Neilson pursuing a legitimate interest or interests?
? If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject(s)?
? Even if the processing is necessary for Mrs Neilson's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
83. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mrs Neilson must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that NHS Greater Glasgow and Clyde was correct to refuse to disclose the personal data to Mrs Neilson.
84. NHS Greater Glasgow and Clyde submitted that it has a duty of confidentiality to both staff and patients and would not provide information which could identify them to third parties, unless required by law. It stated that disclosing the identities of the individuals concerned would be considered unlawful processing and therefore a breach of the first data protection principle.
Is the applicant pursuing a legitimate interest or interests?
85. NHS Greater Glasgow and Clyde submitted that it was aware that Mrs Neilson is unhappy with the handling of the investigation into the SCI and acknowledged her view that it had failed to give full consideration to whether condition 6 applied. NHS Greater Glasgow and Clyde submitted that apart from her dissatisfaction with the handling of the investigation, it did not consider Mrs Neilson had sufficiently set out what she believed her legitimate interests to be in relation to being provided with the names of the individuals.
86. NHS Greater Glasgow and Clyde submitted that, initially, the staff statements were withheld from Mrs Neilson, but the contents were subsequently released following review, with the names redacted. NHS Greater Glasgow and Clyde considered the content of the statements to be of more importance than the necessity to attribute them to a particular individual.
87. Whilst acknowledging that Mrs Neilson might have an interest in identifying the individuals who provided the statements and establishing which person gave which statement, NHS Greater Glasgow and Clyde did not consider that disclosure of the names of individual staff would be in the wider public interest or provide further transparency in relation to the handling of the SCI investigation, given that the content of the statements was already in the public domain. In the circumstances, it did not believe her interest amounted to a legitimate interest.
88. Mrs Neilson provided a number of submissions as to what she believed to be her legitimate interest regarding the handling of the SCI and the policies NHS Greater Glasgow and Clyde should have followed. These submissions were pertinent to the names disclosed during the investigation. Mrs Neilson submitted that, considering the background to her information requests, she had a legitimate interest in the information, given her connection to a staff member involved in the incident and also as a member of the public.
89. She submitted that there are legitimate public interests in scrutinising the implementation of the policy and the standard of investigation, and in assessing the probity of all staff involved in managing an incident. She further submitted that there was a legitimate interest in assessing the accuracy of the SCI report and the role of those involved, and in independent oversight and transparency in order to foster trust in the authority.
90. Having considered all relevant submissions she has received on this point, along with the withheld personal data, the Commissioner accepts that Ms Neilson, as an individual, may have an interest in this specific SCI. She acknowledges a wider public interest in scrutiny of the handling of such matters and in whether, in a given case, NHS Greater Glasgow and Clyde followed its own policies. In this regard, the Commissioner notes the information NHS Greater Glasgow and Clyde has provided to Mrs Neilson, which goes a reasonable way towards satisfying any legitimate interest Mrs Neilson might have.
91. The Commissioner does not accept that any legitimate interest Mrs Neilson might have in whether NHS Greater Glasgow and Clyde followed its own policies in dealing with the SCI, and in the related matters she has identified, would extend to the personal data under consideration in this case. She does not consider the specific information being withheld to be relevant to fulfilling the legitimate interest she has identified.
92. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the personal data under consideration. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.
Section 15(1) - Duty to provide advice and assistance
93. Section 15(1) of FOISA requires a Scottish public authority, so far as it is reasonable to expect it to do so, to provide advice and assistance to a person who has made, or proposes to make, a request for information to it. Section 15(2) states that a Scottish public authority shall be taken to have complied with this duty if it conforms with the relevant sections of the Section 60 Code (see paragraph 10).
94. In her applications to the Commissioner, and in her requirements for review, Mrs Nelson commented on NHS Greater Glasgow and Clyde's duty to provide advice and assistance in line with section 15 of FOISA and in conformity with the Section 60 Code. These concerns focused on requests 1 and 2 in particular.
95. The Commissioner notes Mrs Neilson's belief that her requests were wide-ranging, seeking all information held in relation to the SCI. They are in fact for a number of specific items, although their broad range (taken together) would have become apparent in time. NHS Greater Glasgow and Clyde could hardly ignore the specifics on which the request focused.
96. The Commissioner notes the detail in all of the correspondence and NHS Greater Glasgow and Clyde's efforts to provide her with clarification when this was sought. She notes the lengths to which NHS Greater Glasgow and Clyde went to provide full explanation. Whilst it is apparent that Mrs Neilson believed further information was held (which it was, albeit to a limited extent), the Commissioner is satisfied that NHS Greater Glasgow and Clyde explained its position on this matter adequately within the review outcome of 12 November 2015. It was not an unreasonable position to take in the circumstances.
97. Taking all of the correspondence and the relevant circumstances into consideration, the Commissioner is satisfied that NHS Greater Glasgow and Clyde was not obliged to provide Mrs Neilson with additional advice and assistance to Mrs Neilson in handling her request.
Handling of the requests - timescales and content of notices
98. In relation to requests 1, 2 and 3, Mrs Neilson expressed dissatisfaction that NHS Greater Glasgow and Clyde failed to comply with the timescales required by FOISA in responding to her requests and requirements for review.
99. Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days after receipt of the request to comply with a request for information, subject to qualifications which are not relevant in this case.
100. Section 21(1) of FOISA gives authorities a maximum of 20 working days after receipt of the requirement to comply with a requirement for review, again subject to qualifications which are not relevant in this case.
101. As NHS Greater Glasgow and Clyde has acknowledged, it failed to respond to Mrs Neilson's request and requirements for review within these timescales, so the Commissioner must find that in these respects it failed to comply with sections 10(1) and 21(1) of FOISA.
102. With regard to request 3, Mrs Neilson questioned whether she had been given adequate notice of the review outcome. The Commissioner notes that Mrs Neilson received (in effect) two responses to her requirement for review, dated 6 and 12 November 2016. Taken together, she is satisfied that these met the relevant requirements of section 21 of FOISA. However, given that both of these letters can only be interpreted as responding to the same requirement for review, it would have been helpful if their content could have been combined in a single communication. If this had been done, presumably the wholly unnecessary (and confusing) advice on submitting a further requirement for review (see paragraph 18 above) would not have been included.
103. The Commissioner notes NHS Greater Glasgow and Clyde's apology regarding the time taken to deal with Mrs Neilson's requests and review requirements.
104. NHS Greater Glasgow and Clyde submitted that the complexity of the requests, including "clarifications" added by Mrs Neilson, had contributed to the time taken to respond. The Commissioner acknowledges this, but must also emphasise that public authorities are obliged to comply with the timescales for compliance set down in FOISA. She is pleased to note that NHS Greater Glasgow and Clyde appears to have taken on board the lessons learned during this investigation.
Commissioner's observations
105. The following observations are not part of the Commissioner's findings on compliance with FOISA, but cover practice issues the Commissioner has identified during this investigation and about which she has concerns.
106. The Commissioner has concerns about NHS Greater Glasgow and Clyde's approach to searching for, locating and retrieving information and its ability to evidence to the Commissioner that those searches were adequate and appropriate. As mentioned above, where information is located during an investigation, it is apparent that an authority has failed to conduct adequate searches at the time it dealt with the request and requirement for review. Failure to conduct adequate searches at that point can result in avoidable delays, and additional demands on the time and resources of both the authority and the Commissioner, during the investigation. Ultimately, it impacts on the applicant's right to receive an outcome (and, where appropriate, information) at the earliest opportunity.
107. During this investigation, it is evident to the Commissioner that NHS Greater Glasgow and Clyde failed to provide submissions of the standard she expects, particularly in relation to demonstrating that adequate searches were carried out to identify, locate and retrieve information. Providing submissions of the right standard should not be a challenge, providing adequate searches have been carried out and recorded. In this case, while there is evidence to show that the freedom of information officer asked staff members to confirm whether they held information at the time the requests were received, there is a lack of evidence confirming that a number of individuals responded. The need to ask NHS Greater Glasgow and Clyde to obtain the necessary confirmation from those individuals caused substantial delay in this investigation.
108. Section 6 of Part 2 of the Section 60 Code provides good practice advice on searching for information, advising on factors to be considered in relation to the scope and focus of searches, and on maintaining records of searches carried out.
109. The Commissioner would also draw NHS Greater Glasgow and Clyde's attention to Module 2 of the Self-Assessment Toolkit "Searching for, Locating and Retrieving Information"[3]. This resource is intended to assist authorities by giving them a tool which they can use to evaluate and, where necessary, improve practice in searching for, locating, identifying and retrieving information.
|
Decision
The Commissioner finds that NHS Greater Glasgow and Clyde partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information requests made by Mrs Neilson. In particular she finds that NHS Greater Glasgow and Clyde:
? failed to identify and locate all information that fell within the scope of Mrs Neilson's requests 1, 2 and 4
? was incorrect to give notice in terms of section 17(1) of FOISA in relation to parts of requests 1 and 2
? incorrectly withheld information in terms of section 38(1)(b) of FOISA
? failed to respond to requests 1, 2 and 3 within the timescale required by section 10(1) of FOISA and
? failed to conduct reviews in compliance with section 21(1) of FOISA.
However, the Commissioner finds that, by the close of the investigation, the searches conducted were adequate and that NHS Greater Glasgow and Clyde had identified all relevant information it held by that point. She also finds that it provided adequate advice and assistance as required by section 15 of FOISA and properly withheld the remaining information under section 38(1)(b) of FOISA.
|
Appeal
Should either Mrs Neilson or NHS Greater Glasgow and Clyde wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
9 November 2016
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
10 Time for compliance
(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-
(a) in a case other than that mentioned in paragraph (b), the receipt by the authority of the request; or
?
15 Duty to provide advice and assistance
(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.
(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
?
(4) The authority may, as respects the request for information to which the requirement relates-
(a) confirm a decision complained of, with or without such modifications as it considers appropriate;
(b) substitute for any such decision a different decision; or
(c) reach a decision, where the complaint is that no decision had been reached.
(5) Within the time allowed by subsection (1) for complying with the requirement for review, the authority must give the applicant notice in writing of what it has done under subsection (4) and a statement of its reasons for so doing.
?
(10) A notice under subsection (5) or (9) must contain particulars about the rights of application to the Commissioner and of appeal conferred by sections 47(1) and 56.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to-
?
(e) his physical or mental health or condition,
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
Schedule 3 - Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps
deliberately taken by the data subject.
?
Appendix 2
Request 1: 30 June 2015
1. All information held in relation to the escalation of the incident including the Rapid Alert (SCI alert email), the Datix Form and the incident report.
2. All information held confirming agreement and progression of the incident as an SCI including the date of confirmation of SCI status.
3. All information held in relation to the appointment of the commissioner and the investigators.
4. All information held in relation to (a) the commissioning of the investigation including the exact date of commissioning and (b) instructions and formal requests made by the commissioner of the investigators.
5. All reports held in relation to the progress of the investigation submitted by the lead investigator or any other person who carried out an investigatory role.
6. All information gathered through the investigation process including staff statements submitted as part of the investigation and reports and documented information provided to support the investigation and the findings.
7. The investigation timeline.
8. All information held in relation to quality assurance review of the investigation report by the commissioner.
9. The final SCI investigation report indicating the date of approval and any addendums to the report.
10. The action plan and sign off sheet.
11. All Information held confirming lessons learnt and changes to the NHS Greater Glasgow and Clyde policy on the management of significant clinical incidents that have arisen as a consequence of the investigation and management of this SCI.
12. All reviews of the investigation report by Clinical Risk.
13. All information held, including emails, confirming assimilation, consideration and reflection by the investigation team on factual accuracy checks of the investigation report made by key contributors.
Appendix 3
Request 2: 6 August 2015
1. The rapid alert email that communicated the rapid alert / briefing note template document provided.
2. The distribution list for that significant clinical incident rapid alert email.
3. The "other information" held by the review team referred to in the email 2 doc.
4. The SCI checklist.
5. Information gathered during the investigation process on the handover at the beginning of the shift between medical staff and communication about duties.
6. Information held by the review team that evidenced that the ICGP Handbook had been previously issued to all 18 ICGPs on the rota and the source of that information.
7. The number of clinical risk managers employed by NHS Greater Glasgow and Clyde and the name and designation of the person to whom they report.
8. Information held evidencing that staff involved in the SCI were offered support during the investigation process including the support of the Occupational Health Service.
9. The name and designation of the person(s) who approved the final SCI investigation report.
10. Information explaining the severity factor "4-Major" (see Datix form)
11. Information explaining the remediable causes "2.1 3.3 4.3 5.4 6.3" (see Datix form)
12. The NHS Greater Glasgow and Clyde incident management policy applicable to the reporting of this incident.
13. Information held in relation to the incident constituting records of meetings that took place on, before and after 9 January 2014 involving, in any combination, clinical and management leads, the lead investigator and the investigation team, and the commissioner.
14. Email correspondence held evidencing that the review team "went through every ? comments and considered all of them in the light of the witness interviews and other information we had" (see email 2)
15. All other email correspondence held in relation to the incident dated on, before and after 9 January 2014.
Appendix 4
Request 3: 21 August 2015
1. The contemporaneous or near contemporaneous report of the incident and its date.
2. Information showing when and how the ICGP Handbook was communicated to the review team.
3. The report by the lead investigator explaining why it was not possible to complete and report the investigation within three months following the incident.
4. The relevance of the Vale of Leven Integrated Care GP Handbook as an addendum to the Report, in particular clarification as to:
(a) which part of the Handbook states that it is an ICGP's responsibility to inform the OOH nurse prior to leaving the site for a home visit, and
(b) which part of the Handbook states that the ICGP in OOH must inform the ICGP working in MAU prior to departing for a home visit when there are 2 ICGPs left on site (not a single ICGP).
5. Which of the documents provided with the response dated 30 July, with the exception of email 1, was created or dated between the date of the incident and 9 January 2014 and the evidence for this.
Appendix 5
Request 4: 6 October 2015
1. The "copy" of the ICGP Handbook sent by email at 16.33 on 9 January 2014 and information showing the created on date, modified date, last printed date and revision number of that copy of the Handbook (see email correspondence doc sent with your response dated 14 September).
2. The copy of the "attached handbook" sent by email at 16.49 on 9 January 2014 and information showing the created date, modified date, last printed date and revision number of that Handbook (see email correspondence doc sent with your response dated 14 September).
3. The information (for example email confirmation) evidencing the completion of the action in the action plan detailed as "The ICGP Handbook is reissued to all 18 GP's on the rota as well as any new GP joining the rota" (see the action plan attached to your response dated 30th July).
4. The copy of that ICGP Handbook apparently "reissued" to ICGPs in April 2014 under the action plan and information showing the created date, modified date, last printed date and revision number of that copy of the Handbook.
5. All additional information held relating to the ICGP Handbook including additional information evidencing the transmission of the Handbook by email or any other means to senior staff within NHS Greater Glasgow and Clyde (including HR) and/or any ICGP or group of ICGPs (a) before 13 December 2010 and (b) between 13 December 2010 and April 2014.
6. The identity of the creator(s) or author(s) of the ICGP Handbook.
7. The creation date of the "Datix incident form" and "rapid alert/briefing note template" provided with your response dated 30th July (prior to information being redacted from these documents).
