Home Decisions

Decision Notice 294/2024

Decision Notice 294/2024: Number of patients from a specific ethnic group admitted to hospital with specific medical conditions

Authority: NHS Dumfries and Galloway
Case Ref: 202301459

Summary

The Applicant asked the Authority for the number of patients from a specific ethnic group admitted to hospital with specific medical conditions over a particular period.  The Authority refused to confirm nor deny whether it held the information requested.  The Commissioner investigated and found that the Authority was not entitled to refuse to reveal whether the information existed or was held.  He required the Authority to issue a revised review response to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 18(1) (Further provision as respects responses to request); 38(1)(b), (2A)(a), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing).
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3),4(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)

Background

1.    On 11 October 2023, the Applicant made a request for information to the Authority.  He asked for the total number of ethnic group 1K patients admitted to hospital between 2016 and 2022 (inclusive) with:

  • Ulcerative colitis (and the number with ulcerative colitis who underwent a panproctocolectomy)
  • Crohn’s disease (and the number with Crohn’s disease who underwent a hemicolectomy)

2.    By way of background, “ethnic group” refers to a standard classification used by the NHS in Scotland, which classifies persons “according to their own perceived ethnic group and cultural background”.  Ethnic group “1K” denotes “Gypsy/Traveller” within a broader “White” category.

3.    The Authority responded on 27 October 2023.  The Authority refused to confirm nor deny whether it held the information requested or whether it existed, relying on section 18(1) of FOISA in conjunction with section 38(1)(b).

4.    On 28 October 2023, the Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that he was dissatisfied with the decision because he disagreed that he had requested personal information and that, in any event, the public interest favoured disclosure.  

5.    The Authority notified the Applicant of the outcome of its review on 17 November 2023, which fully upheld its original decision without modification.

6.    On the same day, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated that he was dissatisfied with the outcome of the Authority’s review for the reasons set out in his requirement for review.

Investigation

7.    The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.

8.    On 12 January 2024, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments.  The Authority provided its comments.

9.    The case was subsequently allocated to an investigating officer.

10.    Further submissions were also sought and obtained from the Applicant.

Commissioner’s analysis and findings

11.    The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.  

Section 18(1) - Neither confirm nor deny

12.    Section 18(1) of FOISA allows public authorities to refuse to confirm nor deny whether they hold information in the following limited circumstances:

  • a request has been made to the authority for information which may or may not be held by it; and
  • if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and
  • the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

13.    Where section 18(1) of FOISA is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority.  This means he is unable to comment in any detail on the Authority’s reliance on any of the exemption referred to, or on other matters which could have the effect of indicating whether the information exists or is held by the Authority.

14.    In this case, the Authority submitted that, if it held any information falling within scope of the Applicant’s request, it would be exempt from disclosure under section 38(1)(b) of FOISA.

15.    It is not sufficient to claim that one or more of the relevant exemptions applies.  Section 18(1) of FOISA makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information (if it existed and was held) would be exempt information under one or more of the listed exemptions.  

16.    The Commissioner must first, therefore, consider whether the Authority could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and was held.

Section 38(1)(b) – Personal information

17.    Section 38(1)(b), read in conjunction with section 38(2A)(a) (or (b)), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.  

Would the information be personal data?

18.    “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.  Section 3(3) of the DPA 2018 defines “identifiable living individual” as “a living individual who can be identified, directly or indirectly, in particular with reference to –

(a)    an identifier such as a name, an identification number, location data or an online identifier, or

(b)    one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

19.    Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.

20.    In this case, the Commissioner needs to carefully consider whether the information requested (if it existed and was held) would relate to identified (or identifiable) individuals.

21.    In the case of Breyer v Bundesrepublik Deutschland (C-582/14), the Court of Justice of the European Union took the view that the correct test to consider is whether there is a realistic prospect of someone being identified.  In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party.  However, there must be a realistic causal chain – if the risk of identification is "insignificant", the information will not be personal data.  (Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply.)

The Applicant’s submissions on identifiability

22.    The Applicant considered it “preposterous” to suggest that it would be possible to identify individual patients from the information requested, which was for “simple numbers” covering a period of seven years.  He submitted that the information requested would simply provide evidence of disease frequency in certain communities, without implying anything about individuals.

23.    The Applicant also noted that the Authority’s approach was not in line with that taken by other public authorities, with other authorities in all four UK nations responding to the same request without considering the information personal data.  

The Authority’s submissions on identifiability

24.    The Authority considered that providing the information requested would help to identify the area and potentially the Gypsy/Traveller site where an individual who was treated for one or both of the medical conditions specified in the request lived.

25.    The Authority explained that Scotland does not have a large number of Gypsy/Traveller sites. In Dumfries and Galloway, the Authority understood there were no more than two such sites.  

26.    The Authority submitted that if an information request was submitted to Dumfries and Galloway Council, it would be able to provide the full addresses of the Gypsy/Traveller sites within the region, which would narrow down the location of the individual(s), if any, who were treated for either of the two medical conditions specified in the request.

The Commissioner’s view

27.    The Commissioner has fully considered the Authority’s submissions.  Having done so, he is not satisfied that he has been provided with sufficiently compelling arguments to conclude that disclosure of the information requested (if it existed and was held) would lead to a realistic prospect of someone being identified.

28.    The Commissioner accepts that disclosure of the information requested (if it existed and was held) might, under certain circumstances, present the slight hypothetical possibility of identification of an individual.  However, he is not satisfied that disclosure of the information requested (if it existed and was held) would result in a realistic prospect of identification, particularly given the timeframe specified in the request.

29.    The Commissioner has considered the Authority’s suggestion that, were the information requested to be disclosed (if it existed and was held), obtaining further information about the Gypsy/Traveller sites in the area served by the Authority would assist in the identification individuals.  

30.    The Commissioner notes that both Shelter and the Scottish Government mention Gypsy/Traveller sites as just one area, among many, where Gypsy/Travellers reside.  The Scottish Government also noted that some Gypsy/Travellers choose to live in “bricks and mortar” housing.  In addition to the two official Gypsy/Traveller sites mentioned by the Authority, the Commissioner has identified information published by the Scottish Government indicating that there is a further privately owned site, and that there may be unauthorised Gypsy/Traveller sites, in the Dumfries and Galloway area.  

31.    With the above in mind, the Commissioner is not persuaded that obtaining further information about Gypsy/Traveller sites would aid identification in any meaningful way or result in a realistic prospect of identification.  In all the circumstances, he is not satisfied that there is the link between an individual’s perceived ethnic group and their location that would be required for this to be the case.

32.    In this case, therefore, taking account of all the circumstances, the Commissioner is not persuaded that there is a realistic prospect of individuals being identified from disclosure of the information in question (if it existed and was held).  Having taken account of the arguments presented by both parties, he is of the view that the risk of identification is insignificant and, consequently, that the information requested (if it existed and was held) would not be personal data.

33.    As the Commissioner is not satisfied that the information requested (if it existed and was held) would be personal data, he must find that the Authority would not be entitled to withhold such information under section 38(1)(b) of FOISA (if it existed and was held).

34.    Having accepted that the Authority could not have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information of the type described by the Applicant, if it existed and was held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is not required by section 18(1) to go on to consider whether the Authority was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

35.    Consequently, the Commissioner concludes that the Authority was not entitled to refuse to reveal whether any information of the type described by the Applicant existed or was held by it in terms of section 18(1) of FOISA.  He has set out below the steps he requires the Authority to take as a result of this conclusion.

Decision

The Commissioner finds that the Authority failed to comply with Part 1 (and, in particular, section 18) of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that the Authority was not entitled to issue a refusal notice under 16(1) of FOISA on the basis that any relevant information, if it existed and was held, would be exempt information by virtue of section 38(1)(b) of FOISA.  Consequently, he finds that, by refusing to reveal, in terms of section 18 of FOISA, whether the requested information existed or was held by it, the Authority failed to comply with Part 1 of FOISA.
The Commissioner therefore requires the Authority to reveal to the Applicant whether the information requested exists or is held by it.  If the information is held, he requires the Authority to provide that information to the Applicant, or to issue a refusal notice in line with the requirements of section 16 of FOISA.  If the information is not held, he requires the Authority to give notice of this, in line with the requirements of section 17 of FOISA. 
The Commissioner requires the Authority to do this by 27 January 2025.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement  

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.


Euan McCulloch 
Head of Enforcement 
11 December 2024