Decision 293/2013 Mr Sergio Sabato and Highland Health Board
Keys and CCTV at residential accommodation
Reference No: 201301862
Decision Date: 18 December 2013
Summary
On 27 June 2013, Mr Sabato asked Highland Health Board (NHS Highland) for information concerning keys and CCTV at a specified residential accommodation complex. NHS Highland withheld the information under the exemption in section 39(1) of FOISA.
Following an investigation, the Commissioner found that NHS Highland was entitled to withhold some of the information under section 39(1) of FOISA. However, she found that NHS Highland had incorrectly withheld some information and required it to disclose this information to Mr Sabato.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 20(1), (2) and (3)(c)(ii) (Requirement for review of refusal etc.); 21(1) (Review by Scottish public authority); 39(1) (Health, safety and the environment)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 27 June 2013, Mr Sabato emailed NHS Highland asking for the following information in relation to a specified residential accommodation complex:
a) How many keys are available for each door with a lock installed?
b) How many master keys are available, and what kind of doors can they open?
c) How many individuals (include job position) have access to these keys?
d) How is the use of these keys being recorded?
e) Who records the use of these keys?
f) How are these keys being stored?
g) How many CCTV cameras are currently in use at the staff accommodation? Where are they located?"
2. NHS Highland responded on 3 July 2013. NHS Highland informed Mr Sabato that, in the interests of the security of residents and staff, it was not able to provide the information that he had requested. (NHS Highland made no reference to FOISA in its response.)
3. On 4 July 2013, Mr Sabato emailed NHS Highland requesting a review of its decision. Mr Sabato stated that he was not satisfied with the explanation that NHS Highland had provided.
4. On 12 July 2013, NHS Highland wrote to Mr Sabato asking him to explain why he was dissatisfied with its response.
5. Mr Sabato responded on 12 July 2013. Mr Sabato informed NHS Highland that its response had not answered the questions that he had posed.
6. NHS Highland notified Mr Sabato of the outcome of its review on 8 August 2013. NHS Highland informed Mr Sabato that it considered the requested information to be exempt from disclosure in terms of section 39(1) of FOISA. This was on the basis that its disclosure would compromise the safety and security of residents of the accommodation.
7. On 9 August 2013, Mr Sabato wrote to the Commissioner, stating that he was dissatisfied with the outcome of NHS Highland's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
8. The application was validated by establishing that Mr Sabato made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.
Investigation
9. The investigating officer subsequently contacted NHS Highland, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. NHS Highland was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
10. NHS Highland responded by providing submissions on why it considered the information was exempt from disclosure in terms of section 39(1) of FOISA.
11. During subsequent correspondence with the investigating officer, NHS Highland clarified its reasons for withholding the requested information. NHS Highland also supplied the investigating officer with the information that it was withholding from Mr Sabato.
12. During the investigation, the investigating officer also sought, and received, submissions from Mr Sabato concerning NHS Highland's application of the exemption in section 39(1) of FOISA, and the related public interest test.
Commissioner's analysis and findings
13. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr Sabato and NHS Highland. She is satisfied that no matter of relevance has been overlooked.
Section 39(1) of FOISA - Health, safety and the environment
14. Section 39(1) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual. This is a qualified exemption and is subject to the public interest test required by section 2(1)(b) of FOISA.
15. In the Commissioner's briefing[1] on this exemption, it is noted that section 39(1) does not contain the usual harm test. Instead of the "substantial prejudice" test found in various other exemptions contained in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety. The briefing also notes that the test of "endangerment" is less demanding than the "substantial prejudice" test applied in other exemptions.
16. The Commissioner's view is that the term "endanger" is broad enough to apply where there is a (direct or indirect) threat to the safety of a person which would foreseeably arise in the future as well as immediate harm, since the exemption does not specify that any threat should be imminent before it applies. The Commissioner considers that for endangerment to be considered likely there must, however, be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.
17. NHS Highland submitted that disclosure of the information could be used either to gain access to the keys or tamper with the CCTV, which could, in turn, result in access being gained unlawfully to residents' property. NHS Highland also submitted that information could be passed on to third parties.
18. NHS Highland argued that the knowledge of this information could lead to a breach in security and a loss of confidence in the security of the premises by residents. In NHS Highland's view, the disclosure of the information into the public domain would make residents feel that their security and safety had been, or could be, compromised. NHS Highland stated that the accommodation was safe, that residents did not have issues with security and that it wished to maintain that feeling.
19. Additionally, NHS Highland stated that, whilst it could not categorically state that the disclosure of the information would lead to unauthorised access, it considered that it would lead to an increased risk of this occurring.
20. In this case, the Commissioner considers that NHS Highland has not sufficiently evidenced any specific threats to the security of the accommodation that would result from disclosure of the information sought in parts a) to e) of Mr Sabato's request. Its submissions have not demonstrated how access to the information it holds would bring about harm in the way suggested, by increasing the risk of unauthorised access.
21. The Commissioner is not persuaded that disclosure of the information covered by parts a) to e) of the request would assist anyone seeking to gain access to residents' accommodation, or that non-disclosure would prevent anyone from doing so. Accordingly, she considers that the disclosure of this information would not be likely to increase or extend the probability of harmful events, or endanger the safety of the residents of the accommodation.
22. Having concluded that disclosure of this information would not be likely to endanger the safety of any person, the Commissioner has found that the exemption in section 39(1) was incorrectly applied by NHS Highland to the withheld information sought in parts a) to e) of the request. Having reached this conclusion, the Commissioner is not required to consider the public interest test in relation to this information. She requires NHS Highland to disclose the information covered by parts a) to e) of the request to Mr Sabato.
23. The Commissioner has reached a different conclusion in relation to the information sought in requests f) and g). In this case, the Commissioner accepts that disclosure of this information could potentially allow or help someone to access the keys and subsequently access residents' accommodation. The Commissioner accepts also that disclosure of the information relating to the CCTV coverage of the accommodation could allow tampering with the cameras and would provide an indication of the parts of the accommodation that are, and are not, monitored by cameras.
24. Having reached this conclusion, the Commissioner will now go on to consider the public interest test required by section 2(1)(b) of FOISA in relation to parts f) and g) of the request.
The public interest test
25. In his submissions to the Commissioner, Mr Sabato argued that he had a right to know what security measures NHS Highland had in place at the accommodation. He argued that disclosure of the information would allow reassurance about security arrangements. He also submitted that it would allow scrutiny of the measures taken by NHS Highland to ensure the security of the accommodation and access to the accommodation, and that those measures were being properly monitored.
26. NHS Highland submitted that maintaining the exemption in this case would protect the security and safety of residents. NHS Highland stated that it had put itself in the position of residents and would not want this sort of information disclosed. NHS Highland stated that it wished to maintain a safe and secure environment for its residents. In its view, disclosure of the information would result in residents believing that their security and safety could be compromised.
27. The Commissioner accepts that there is a general public interest in ensuring scrutiny of security arrangements at residential accommodation of this nature. This would allow some reassurance to residents and the wider public that adequate arrangements were in place for the safety and security of the accommodation and its residents.
28. The Commissioner must also consider the potential effects of disclosure of the information on the integrity of those security arrangements and the consequential harm to the safety and security of the residents and their accommodation.
29. In this case, on balance, the Commissioner finds that the public interest would be better served by the exemption being maintained in relation to parts f) and g) of the request than by the information being released. She therefore upholds NHS Highland's decision not to provide Mr Sabato with the information requested in parts f) and g) of the request.
Compliance with timescales
30. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review, subject to certain exceptions which are not relevant in this case.
31. In his application to the Commissioner, Mr Sabato noted that, in his view, NHS Highland had not complied with the timescale in section 21(1) in responding to his requirement for review. Mr Sabato stated that he had submitted his requirement for review on 4 July 2013, but had not received a response until 8 August 2013.
32. In this case, the Commissioner notes that Mr Sabato did indeed ask NHS Highland to review its initial decision on 4 July 2013. As noted above, however, Mr Sabato gave no indication of his reasons for dissatisfaction with NHS Highland's initial response beyond stating that he was not satisfied with it.
33. Section 20 of FOISA provides that an applicant who is dissatisfied with the way in which a Scottish public authority has dealt with a request for information may require the authority to review its actions and decisions in relation to that request. Section 20(3)(c)(ii) states that a requirement for review must specify the matter which gives rise to the applicant's dissatisfaction.
34. In this case, as Mr Sabato gave no indication in his email of 4 July 2013 of his reasons for dissatisfaction, the Commissioner does not consider that his requirement for review was valid in terms of section 20 of FOISA. Accordingly, NHS Highland was entitled to ask Mr Sabato to provide it with his reasons for dissatisfaction with its response to his request. Mr Sabato subsequently provided NHS Highland with his reasons for dissatisfaction on 12 July 2013; at this point, NHS Highland had received a valid requirement for review and had 20 working days (in terms of section 21(1) of FOISA) in which to provide a response.
35. NHS Highland notified Mr Sabato of the outcome of its review on 8 August 2013. As this was within the 20 working days specified in section 21(1) of FOISA, the Commissioner finds that NHS Highland complied with the timescale allowed in section 21(1) of FOISA in responding to Mr Sabato's requirement for review.
DECISION
The Commissioner finds that Highland Health Board (NHS Highland) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Sabato.
The Commissioner finds that NHS Highland was entitled to withhold the information sought in parts f) and g) of Mr Sabato's request under the exemption in section 39(1) of FOISA.
The Commissioner also finds that NHS Highland responded to Mr Sabato's requirement for review within the timescale laid down by section 21(1) of FOISA.
However, by wrongly withholding the information sought in parts a) to e) of the request under the exemption in section 39(1), NHS Highland breached section 1(1) of FOISA.
The Commissioner therefore requires NHS Highland to disclose the information withheld in parts a) to e) of the request to Mr Sabato by 1 February 2014.
Appeal
Should either Mr Sabato or Highland Health Board wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
18 December 2013
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
?
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
?
20 Requirement for review of refusal etc.
(1) An applicant who is dissatisfied with the way in which a Scottish public authority has dealt with a request for information made under this Part of this Act may require the authority to review its actions and decisions in relation to that request.
(2) A requirement under subsection (1) is referred to in this Act as a "requirement for review".
(3) A requirement for review must-
?
(c) specify-
?
(ii) the matter which gives rise to the applicant's dissatisfaction mentioned in subsection (1).
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
?
39 Health, safety and the environment
(1) Information is exempt information if its disclosure under this Act would, or would be likely to, endanger the physical or mental health or the safety of an individual.
?
[1] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section39/Section39.aspx
