Home Decisions

Decision 287/2024

Decision Notice 287/2024: Complaints received relating to occupants of a named address

Authority: Police Service of Scotland
Case Ref: 202400068

Summary

The Applicant asked the Authority for information relating to complaints received by the Authority concerning the occupants of a named address.  The Authority refused to confirm nor deny whether the information existed or was held.  The Commissioner investigated and found that the Authority was entitled to refuse to confirm or deny whether the information existed or was held.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provisions as respects responses to request); 38(1)(b), (2A)(a), (5) (definitions of “the data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR” and (5A) (Personal information)); 47(1) and (2) (Application for decision by Commissioner
United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data and 6(1)(f) (Lawfulness of processing) 
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), 10 and (14)(a), (c) and (d) (Terms relating to the processing of personal data)

Background

1.    On 26 August 2023, the Applicant made a request for information to the Authority.  He asked the following three questions:

(a)    Over the last three years, how many complaints has the Authority received concerning the occupants of a named address by a person who was not living at that address?

(b)    What the substance was of each complaint?

(c)    What action did the Authority take on each occasion?

2.    The Authority responded on 19 September 2023.  The Authority refused to confirm or deny whether it held the information requested or whether it existed, relying on section 18(1) of FOISA in conjunction with section 38(1)(b) (Personal information).

3.    On 15 October 2023, the Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that he was dissatisfied with the decision because he disagreed that the information requested was third party personal data and he also disagreed that it was contrary to the public interest to reveal whether the information requested existed or was held.  The Applicant stated that he had permission from the occupants of the named address to provide the information requested, which he affixed to his requirement for review.

4.    The Authority notified the Applicant of the outcome of its review on 14 January 2024, which fully upheld its original decision.  The Authority also informed the Applicant of his right, as a landlord, to request under the DPA 2018 information in connection with prospective or ongoing legal proceedings (e.g. eviction).

5.    On 22 January 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he did not agree that the exemptions cited by the Authority applied.

6.    In his application, the Applicant confirmed that the occupant of the named property was his son.

Investigation

7.    The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.

8.    On 27 February 2024, the Authority was notified in writing that the Applicant had made a valid application.  The case was subsequently allocated to an investigating officer.

9.    Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  
These related to the Authority’s reasons for neither confirming nor denying whether it held the information, or whether it existed, and to the potential application of the exemption in section 38(1)(b) of FOISA.  The Authority provided its comments.

10.    Further submissions were also sought and obtained from the Applicant.

Commissioner’s analysis and findings

11.    The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Section 18(1) – “neither confirm nor deny”

12.    Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

  • a request has been made to the authority for information which may or may not be held by it; and
  • if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the 
    exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and
  • the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

13.    Section 18(1) of FOISA makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information it held would be exempt information under one or more of the listed exemptions.  It is not sufficient for the public authority to simply claim that one or more of the relevant exemptions applies.

14.    Where a public authority has chosen to rely on section 18(1) of FOISA, the Commissioner must first establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions provided for by sections 28 to 35, 38, 39(1) or 41 of FOISA (including any relevant public interest test).  If so, he must then go on to establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest.

15.    Where section 18(1) is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority.  This means he is unable to comment in any detail on the Authority’s reliance on any of the exemption referred to, or on other matters which could have the effect of indicating whether the information exists or is held by the Authority.

16.    In this case, the Authority submitted that, if it held any information falling within scope of the Applicant’s request, it would be exempt from disclosure under section 38(1)(b) of FOISA.

17.    The Commissioner must first, therefore, consider whether, in relation to section 38(1)(b) of FOISA, the Authority could have given a refusal notice under section 16(1) in relation to the information in question, if it existed and were held.

Section 38(1)(b) – Personal information

18.    Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.

Would the information be personal data?

19.    "Personal data" is defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual".  Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular with reference to –

(a)    an identifier such as a name, an identification number, location data or an online identifier, or

(b)    one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."

20.    Given that the information request is framed with reference to a living individual or living individuals (the occupants of a named address), the Commissioner is satisfied that, if this information existed and were held by the Authority, any information captured by the request would be personal data as defined in section 3(2) of the DPA 2018.

21.    The Commissioner notes that the Applicant considered that he had not requested personal data, because he had advised the Authority in his requirement for review that it could “redact” the number of the named address to “remove” any “confidentiality concerns”.  However, the Commissioner is still satisfied that the Applicant’s request of 26 August 2023 (the request under consideration here) requested personal data for the reasons set out in the preceding paragraph.

Would disclosure contravene one of the data protection principles?

22.    The Authority argued that disclosing the personal data, if it existed and were held, would breach the first data protection principle.  This requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject" (Article 5(1)(a) of the UK GDPR).

23.    The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available".  For the purposes of FOISA, personal data are processed when disclosed in response to a request.  This means that personal data could only be disclosed if disclosure would be both lawful (i.e. it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.

Lawful processing: Article 6(1)(f) of the UK GDPR

24.    In considering lawfulness, the Commissioner must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the personal data, if it existed and were held, to be disclosed.

25.    The Authority considered the only lawful basis in Article 6(1) of the UK GDPR which could potentially allow disclosure of the personal data, if it existed and were held, would be condition (f).

26.    The Commissioner agrees that condition (f) is the only one which could potentially apply, assuming the personal data existed and were held.  This condition states that processing shall be lawful if it is "necessary for the purposes of the legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…"

27.    Although Article 6(1) states that this condition cannot apply to processing carried out by a public authority in performance of its tasks, section 38(5)(a) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

28.    The tests which must be met before Article 6(1)(f) can be met are as follows:

(i)    Would the Applicant have a legitimate interest in obtaining personal data, if held?

(ii)    If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

(iii)    Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?

29.    The Authority stated that it was prepared to accept that the Applicant had a legitimate interest in the personal data (if it existed and were held), given he was asking for information relating to a property he owned and rented out.

30.    In the circumstances, the Commissioner agrees that the Applicant would have a legitimate interest in obtaining the personal data (if it existed and were held).

Would disclosure be necessary?

31.    The next question is whether, if the personal data existed and were held, disclosure would be necessary to achieve that legitimate interest.  "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.

32.    When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests could reasonably be met by means which interfered less with the privacy of the data subject(s).

33.    While the Authority accepted that the Applicant has a legitimate interest in obtaining the personal data (if it existed and were held), it did not accept that disclosure of the personal data would be necessary to achieve that legitimate interest.

34.    The Authority noted that the Applicant, as a landlord, has the right to some “limited information”, in terms of the Private Housing (Tenancies) (Scotland) Act 2016, about any police involvement with the named property.  The Authority reiterated that it had advised the Applicant in its review outcome that he could, as a landlord, make a request under the DPA 2018 for information in connection with prospective or ongoing legal proceedings (e.g. eviction).  

35.    The Authority stated that the tenant also has a right to information about police involvement with them, personally, in terms of the DPA 2018 and the UK GDPR.

36.    The Authority noted that disclosure, under FOISA, of the personal data (if it existed and were held) would be disclosure to the world at large, not just to the Applicant.  The Authority submitted that public disclosure about police activity with any property (and, by association, any individual) could not be considered necessary even in general terms, but it was particularly not necessary in this case given the alternative routes available to the Applicant.

37.    Given the alternative routes available to the Applicant, the Commissioner accepts that the Applicant’s legitimate interest could be satisfied to some extent by means which would interfere less with the privacy of the data subject than disclosure of the personal data (if it existed and were held) under FOISA which, as stated above, would be disclosure to the world at large.

38.    However, given the Authority stated that the alternative routes identified only provided the Applicant with a right to “limited information” about any police involvement at the named property, the Commissioner accepts, on balance, that disclosure of the personal data (if it existed and were held) would be necessary to fully achieve the Applicant’s legitimate interest.

The interests or fundamental rights and freedoms of the data subject(s) (and balancing exercise)

39.    The Commissioner has concluded that the disclosure of the information (if in existence and held) would be necessary to fully achieve the Applicant's legitimate interest.  However, this must be balanced against the interests, fundamental rights and freedoms of the data subject(s).  Only if the legitimate interests of the Applicant outweighed those of the data subject(s) could personal data be disclosed without breaching the first data protection principle.

40.    The Commissioner's guidance on section 38 of FOISA notes that, in carrying out the balancing exercise, much will depend on the reasonable expectations of the data subject(s). Factors which will be relevant in determining reasonable expectations include:

(i)    whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

(ii)    the potential harm or distress that may be caused by disclosure

(iii)    whether the individual objected to the disclosure.

41.    The Authority explained that, when dealing with information requests of this nature, the application of section 18 of FOISA was essential so as not to breach the first data protection principle.  The Authority argued that even a response in terms of section 17 of FOISA (information not held) or a refusal notice in terms of section 16 (information held but exempted from disclosure) would provide significant insight into whether an individual (or individuals) had or had not had dealings with the police.

42.    The Commissioner has considered the reasonable expectations of the data subject(s) in this case and the potential harm or distress that could be caused by disclosure of the personal data (if it existed and were held).

43.    As stated above, disclosure under FOISA is a public disclosure.  The Commissioner has considered the nature and scope of the request.  Having done so, he agrees with the Authority that, at the most general level, disclosing whether an individual (or individuals) had or had not had any dealings with the police in relation to the subject matter specified in the request would be likely to impact on the reasonable expectations of that individual (or those individuals) and cause some degree of harm or distress.

44.    After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights and freedoms of the data subject(s), the Commissioner finds that the legitimate interests served by disclosure of any information held would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subject(s) in question in this case.

45.    In all the circumstances of this particular case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the personal data sought by the Applicant (assuming it existed and were held).

Fairness and transparency

46.    Given that the Commissioner has concluded that the processing of the personal data, if it existed and were held, would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject(s).

Conclusion on the data protection principles

47.    For the reasons set out above, the Commissioner is satisfied that disclosure of any relevant personal data, if it existed and were held, would breach the data protection principle in Article 5(1)(a) of the UK GDPR.

48.    Consequently, the Commissioner is satisfied that such personal data would be exempt from disclosure under section 38(1)(b) of FOISA and that the Authority could give a refusal notice under section 16(1) of FOISA, on the basis that the information would be exempt by virtue of section 38(1)(b).

Section 18(1) – the public interest

49.    The Commissioner must now consider whether the Authority was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

The Applicant’s submissions

50.    The Applicant disagreed that it was contrary to the public interest to reveal whether the information requested existed or was held.

51.    The Applicant explained that his son (the occupant of the named property in request) had been subject to unpleasant antisocial behaviour, which included “multiple unfounded accusations” being made to the Authority.

52.    The Applicant stated that was the information he was interested in receiving and that he considered none of the public interest qualified exemptions applied to withhold that information.

The Authority’s submissions

53.    The Authority accepted there was a public interest in terms of better informing the public as to the prevalence of incidents in their local area.  However, the Authority argued that this must be balanced with the rights of individuals to a private life.

54.    The Authority noted the Applicant’s clear personal interest in the information requested (if it existed and were held) and it recognised the public interest in providing such individuals with information to further their cause, 
particularly where they are aggrieved by a situation.

55.    Overall, however, the Authority concluded that the public interest lay in favour of protecting the rights of individuals.

56.    The Authority submitted that it could not be in the public interest to confirm or deny whether information was held or existed about identifiable individuals, where doing so would provide an insight into whether they had or had not had dealings with the police.  The Authority argued that such information was “rightly private”.

The Commissioner’s conclusions

57.    The test the Commissioner must consider is whether (having already concluded that the information, if it existed and were held, would be exempt from disclosure) it would be contrary to the public interest to reveal whether the information existed or was held.

58.    The Commissioner has fully considered the submissions from the Applicant and the Authority.

59.    Having done so, he is satisfied, in all the circumstances of this case, that the action of confirming or denying whether the information requested existed or was held would have had the effect of revealing, through public disclosure, whether an individual (or individuals) had or had not had dealings with the police.  This would, in the circumstances, lead to the Authority breaching its duties as data controller under data protection legislation.

60.    In the circumstances, therefore, the Commissioner must find that it would have been contrary to the public interest for the Authority to reveal whether it held the information requested or whether that information existed.

61.    Consequently, the Commissioner is satisfied that the Authority was entitled to refuse to confirm or deny whether the information requested by the Applicant existed or was held, in accordance with section 18(1) of FOISA.

62.    The Commissioner does not accept, however, that the intention of including section 38 in the provisions to which section 18 might apply was to allow any Scottish public authority to assume that entire categories of personal data could automatically be dealt with in this way.  The application of section 18 must always be one specific to the circumstances of each individual case.

Decision

The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch 
Head of Enforcement 
9 December 2024