Decision 009/2006 Mr Stewart Mackenzie and the Scottish Executive

Requests for all information held by the Minister for Justice and the Access to Justice Division of the Scottish Executive which relates to Mr Mackenzie – whether exempt under section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 – personal information

Requests for all information relating to the applicant held by the Minister for Justice and the Access to Justice Division of the Scottish Executive

Applicant: Mr Stewart Mackenzie
Authority: The Scottish Executive
Case No: 200501864
Decision Date: 30 January 2006

Kevin Dunion
Scottish Information Commissioner

Facts

Mr Mackenzie wrote to the Minister for Justice and to the Head of Access to Justice Division in the Justice Department of the Scottish Executive. In both instances, Mr Mackenzie requested all information that related to him. The Scottish Executive responded to Mr Mackenzie’s requests and informed him that access to his own personal information was regulated by the Data Protection Act 1998 (DPA), not the Freedom of Information (Scotland) Act 2002 (FOISA), and that his requests would be dealt with under the DPA.

Mr Mackenzie was not content with the responses he received and requested a review of the Scottish Executive’s decision not to provide him with the information under FOISA. The Scottish Executive carried out a review in which it upheld its decision to deal with Mr Mackenzie’s requests under the DPA. In its letter detailing the outcome of the review the Scottish Executive stated that on this occasion it was prepared to waive any fee for dealing with the requests under the DPA and asked Mr Mackenzie to forward proof of his identity to enable the requests to be processed. Mr Mackenzie was dissatisfied with the Scottish Executive’s response and applied to the Scottish Information Commissioner for a decision.

Outcome

The Commissioner found that the Scottish Executive was correct to consider Mr Mackenzie’s requests for information as being requests for personal information of which he was the data subject and that such information was exempt from disclosure by virtue of section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 (FOISA).

The Commissioner found that the Scottish Executive failed in its duties under section 16(1) of FOISA, by failing to specify the exemption it had relied upon in relation to Mr Mackenzie’s requests.

The Commissioner also found that the Scottish Executive failed in its duties under section 19 of FOISA, by failing to provide information to Mr Mackenzie concerning his rights of application to the Scottish Executive for a review or of the procedure provided by the Scottish Executive for dealing with complaints about its handling of requests for information.

The Commissioner does not require the Scottish Executive to take any remedial action in relation to this case.

Appeal

Should Mr Mackenzie or the Scottish Executive wish to appeal against this decision, there is a right of appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.

Background

1. On 24 April 2005, Mr Mackenzie wrote to Ms Cathy Jamieson, Minister for Justice. In his letter, entitled “Freedom of Information Act”, Mr Mackenzie stated, “Under the above Act, I request that I be provided with all information held by you personally as Justice Minister, and all information held by your own office which relates to me, and includes information by way of emails, minutes of meetings, internal memorandums, and within correspondence.”

2. Mr Mackenzie also wrote to Mr Andrew Dickson, Head of Access to Justice Division at the Scottish Executive, on 24 April 2005. In his letter, entitled “Freedom of Information Act”, Mr Mackenzie stated, “Under the above Act, I request that I be provided with all information held by the Access to Justice Division of the Scottish Executive, which relates to me, and includes information be way of emails, minutes of meetings, internal memorandums, and within correspondence.”

3. On 29 April 2005, the Scottish Executive’s Data Protection Liaison Officer responded to Mr Mackenzie’s request to the Head of Access to Justice Division. In its letter, entitled “Subject access request under the Data Protection Act 1998”, the Data Protection Liaison Officer stated that Mr Mackenzie’s request would be dealt with in terms of the Data Protection Act 1998 (DPA). Details were provided which set out Mr Mackenzie’s rights concerning access to data under the DPA. Mr Mackenzie was provided with a remittance advice note for the £10 fee which is chargeable under the DPA. He was also asked to provide proof of his identity to allow his request to be processed.

4. The Scottish Executive’s Data Protection Liaison Officer responded to Mr Mackenzie’s request to the Minister for Justice on 10 May 2005, in a letter entitled “Freedom of Information Act”. The Data Protection Liaison Officer stated that Mr Mackenzie’s letter constituted a request for his own personal information and would therefore be dealt with under the Data Protection Act 1998 (DPA), which is overseen by the UK Information Commissioner. Mr Mackenzie was provided with a remittance advice note for the £10 fee which is chargeable under the DPA. He was also asked to provide proof of his identity to allow his request to be processed.

5. Mr Mackenzie was unhappy with both of the responses he had received from the Scottish Executive in relation to his requests. He telephoned the Data Protection Liaison Officer to complain that his request should be dealt with under FOISA and, on 14 May 2005, he wrote to the Scottish Executive and requested a review of both decisions not to supply him with the information he had requested under FOISA.

6. The Scottish Executive carried out a review and responded to Mr Mackenzie on 26 May 2005. In its letter the Scottish Executive upheld the previous decision that the information sought by Mr Mackenzie should be dealt with under the terms of the DPA. It stated that both of Mr Mackenzie’s requests specifically asked for information “which relates to me” and therefore related to Mr Mackenzie’s own personal data.

7. The letter from the Scottish Executive explained that the rights of access by data subjects to their own personal data were set out in section 7 of the DPA. The letter described the section 38(1)(a) provision of FOISA, which exempts information if it constitutes personal data of which the applicant is the data subject. The Scottish Executive also recognised that this should have been explained to Mr Mackenzie in the Scottish Executive’s letters of 29 April 2005 and 10 May 2005.

8. The Scottish Executive stated that Mr Mackenzie’s requests would not be dealt with under FOISA, but that it was required to comply with his rights of access to his own personal data under section 7 of the DPA. Proof of identity was again requested from Mr Mackenzie in order to enable the Scottish Executive to process his request. It was also stated that on this occasion the Scottish Executive was prepared to waive its right to obtain a fee of £10 from Mr Mackenzie for processing the request under the DPA.

9. Mr Mackenzie was also informed of his right to appeal to the Scottish Information Commissioner if he was not happy with the outcome of the review, within 6 months of receiving the Scottish Executive’s decision.

10. On 31 May 2005, Mr Mackenzie wrote to my Office, requesting an investigation into the matter.

11. The case was then allocated to an investigating officer.

The Investigation

12. Mr Mackenzie’s appeal was validated by establishing that he had made a written request for information to a Scottish public authority, and had appealed to me only after requesting that the authority review its response to his request.

13. The investigating officer contacted the Scottish Executive on 20 June 2005, giving notice that an appeal had been received and that an investigation into the matter had begun. The Scottish Executive was asked to comment on the issues raised by Mr Mackenzie’s case and to provide supporting documentation for the purposes of the investigation.

14. In particular, the Scottish Executive was asked to provide a summary of the information it held which it considered as being applicable to Mr Mackenzie’s request. It was also asked if any information it held in relation to Mr Mackenzie’s request would not be made available to the applicant as a result of treating his request for information as a subject access request.

15. The Scottish Executive responded on 5 July 2005, and provided the requested documentation which enabled the investigation to proceed. In its letter, the Scottish Executive stated that Mr Mackenzie had been a frequent correspondent in relation to matters dealt with by the Access to Justice Division. It was stated that the Access to Justice Division held a specific file relating to Mr Mackenzie and that this file would contain information relating to his correspondence. No search had been made up to that time for any other personal data relating to Mr Mackenzie and held by the Scottish Executive since he had not submitted a subject access request under the DPA.

16. In response to the question of whether or not there was any information that would not be made available to Mr Mackenzie by the Scottish Executive as a result of treating his request under the DPA, the Scottish Executive contended that this was not relevant to the matter in hand.

17. It was explained that when the Scottish Executive receives a request for information its first task is to determine whether the request should be dealt with under FOISA, the DPA or the Environmental Information (Scotland) Regulations 2004, or whether the request involves consideration of a combination of these three access regimes.

18. The Scottish Executive argued that in this particular case the requests were clear – Mr Mackenzie had requested information that related to him and was therefore seeking personal data which was exempt from disclosure under FOISA. No information had therefore been considered which was not relevant to Mr Mackenzie’s subject access request. It was also mentioned out that Mr Mackenzie had not sought to amend the terms of his request and had simply insisted that the Scottish Executive should deal with his request under FOISA. It was pointed out that this would not have been helpful to Mr Mackenzie since he was not entitled to receive information relating to him under FOISA.

19. The investigating officer suggested to Mr Mackenzie on a number of occasions that the most practical means of taking this matter forward would be for Mr Mackenzie to make a subject access request to the relevant departments at the Scottish Executive and if any information was withheld because it did not constitute personal data he could then make a request under FOISA to be provided with that information. However, Mr Mackenzie declined to do this.

20. The investigating officer then contacted the Scottish Executive by e-mail on 20 July 2005. In relation to Mr Mackenzie’s request to the Access to Justice Division, the investigating officer asked if the Scottish Executive could categorically state that none of the information held would be exempt from the DPA and therefore fall to be considered under FOISA, e.g. under section 38(1)(b) which concerns third party data.

21. The Scottish Executive replied by e-mail on 28 July 2005. It maintained that, on the basis of the wording used in Mr Mackenzie’s request, the Scottish Executive had been correct in determining that access to the information required by Mr Mackenzie would be through the provisions of the DPA and not through FOISA. It was also mentioned that it was difficult to understand how else the requests could have been dealt with.

22. In order to allow progress to be made in this particular case, the Scottish Executive offered to obtain, from the Access to Justice Division in the Scottish Executive’s Justice Department, the information that it held in relation to Mr Mackenzie. The Minister for Justice’s Office would also be contacted to undertake a search for any information that it might hold. The information would then be examined to ascertain what information was releasable to Mr Mackenzie under the DPA and what other information was held which was not releasable under the DPA.

23. On 16 August 2005, the Scottish Executive contacted the investigating officer to inform him that the only information that was held concerning Mr Mackenzie was held by the Access to Justice Division. The investigating officer was informed that virtually all of the documents held would be able to be released under the DPA - very little, if any, would fall under FOISA. The Scottish Executive emphasised that it was trying as hard as it could to provide Mr Mackenzie with as much information as possible but that he was complicating this by insisting on going down the FOI route which would only result in him at best obtaining a few documents that he could not get under the DPA. It was pointed out that the information that Mr Mackenzie appeared to be interested in was the information that would be provided under the DPA.

24. The investigating officer contacted Mr Mackenzie in order to invite him to submit subject access requests for the information requested. Mr Mackenzie again declined. The investigating officer then contacted the Scottish Executive with a view to resolving the matter. He suggested considering section 66 of FOISA which states: “Nothing in this Act is to be taken to limit the powers of a Scottish public authority to disclose information held by it.” For example, assuming that none of the data protection principles would be breached, it was suggested that the Scottish Executive could waive its right to cite the section 38(1)(a) exemption and provide Mr Mackenzie with all of the information it held.

25. The Scottish Executive sent the investigating officer an e-mail on 18 August 2005. It stated that it would try to provide Mr Mackenzie with everything that it held in relation to his request (i.e. it would provide Mr Mackenzie with information which would fall under the DPA and FOISA). In addition, information would also be released which was not directly related to Mr Mackenzie and which did not come within the scope of his request but which dealt with issues he appeared to be concerned about.

26. It was stated that Mr Mackenzie would not be provided with information relating to third parties – i.e. parts of a file note (the rest of which would be released) and also correspondence with a third party which did not relate to either Mr Mackenzie or the issue affecting him. In effect, Mr Mackenzie would receive all of the information held on the file held by the Access to Justice Division (apart from that described).

27. On 19 August 2005, the Scottish Executive sent Mr Mackenzie a large number of documents. In its covering letter to Mr Mackenzie, it stated that all of the information had been obtained from the Access to Justice Division which related to Mr Mackenzie and fell within the scope of his request. It confirmed that the information was personal data of which Mr Mackenzie was the data subject and therefore fell to be dealt with under the DPA and was therefore exempt under section 38(1)(a) of FOISA. It also stated that in order to process Mr Mackenzie’s requests the Scottish Executive had decided on this occasion not to apply the section 38(1)(a) exemption.

28. In relation to Mr Mackenzie’s request to the Minister for Justice, the Scottish Executive informed Mr Mackenzie that the Private Office of the Minister for Justice had been contacted and asked to carry out a search for any information held which related to Mr Mackenzie. No information was found. One of the reasons given for the lack of information held was that the Private Offices of Ministers handled large volumes of correspondence each day and retained very little information. Mr Mackenzie was informed that most relevant information would therefore be held by the associated policy Division within the Minister’s department. In this case, the information relating to Mr Mackenzie would be held by the Access to Justice Division.

29. Additional documentation held by the Access to Justice Division which did not relate directly to Mr Mackenzie but which was related to certain issues that Mr Mackenzie was concerned about had been included within the information provided. It was also pointed out to Mr Mackenzie that some personal information relating to third parties had been removed from a file note dated 9 June 2004.

30. The information which had been redacted (i.e. edited out) from the file note was considered to be exempt under section 38(1)(b) of FOISA. This exemption concerns the personal information of third parties and such information is held to be exempt from disclosure under FOISA where it would breach one or more of the data protection principles. The Scottish Executive claimed that disclosure of the third party personal information would be unfair to the third parties involved and would therefore breach the first data protection principle. This exemption is absolute (i.e. it is not subject to the public interest test) where disclosure of the information would breach any of the data protection principles.

31. Upon receiving the information from the Scottish Executive, Mr Mackenzie contacted my Office to complain that he had not received all of the documentation that related to him which was held by the Access to Justice Division. Mr Mackenzie did not contest the use of the section 38(1)(b) exemption in relation to the file note of 9 June 2004.

32. The investigating officer discussed the matter with Mr Mackenzie on 29 August 2005. Mr Mackenzie maintained that he had only received a couple of documents which were dated 2005 and was convinced that more information existed in relation to his request which had not been provided. The investigating officer asked Mr Mackenzie to send in a letter detailing the information he believed he had not been provided with. Mr Mackenzie was reminded on a number of occasions to send in the letter but did not provide the details requested until the investigating officer sent him a letter on 26 October 2005, stating that if no details were provided within two weeks take this would be taken to mean that Mr Mackenzie wished to withdraw his application to the Commissioner.

33. On 1 November 2005, Mr Mackenzie sent a 7-page fax to the investigating officer which provided examples of correspondence that Mr Mackenzie had expected to receive within the information provided by the Scottish Executive in response to his request. This complaint was passed on to the Scottish Executive for comment, on 3 November 2005.

34. A response was received by e-mail on 22 November 2005, in which the Scottish Executive noted that the information Mr Mackenzie claimed should have been provided to him referred to correspondence with the Scottish Executive which took place in May, June and July of 2005. Section 1(1) of FOISA states that a person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority (subject to exemptions) and section 1(4) of FOISA states that the information to be given by the authority is that held by it at the time the request is received. Mr Mackenzie’s original requests were made on 24 April 2005. Therefore any correspondence relating to May, June and July 2005 would not be within the scope of his requests since it was not held at the time Mr Mackenzie made his request on 24 April 2005.

35. Other correspondence that Mr Mackenzie alleged had not been provided to him concerned his request to join “The Working Group for research into the legal services markets in Scotland.” In an e-mail from the Scottish Executive, dated 22 November 2005, it was stated that the Access to Justice Division had been contacted in order to ascertain whether that information was held. The Access to Justice Division stated that it did not hold such information but it did hold correspondence from Mr Mackenzie, dated 17 February 2005 and 11 March 2005 and a reply from the Department, dated 23 March 2005, regarding the Working Group. This information had been released to Mr Mackenzie in response to a data subject access request made by him under the DPA prior to this request.

36. The Scottish Executive’s e-mail of 22 November 2005 also explained the searches carried out to locate the information requested by Mr Mackenzie.

The Commissioner’s Analysis and Findings

37. It should be noted from the outset that where an applicant makes a request for information held by a public authority that relates to the applicant, this will in most cases be a request for personal information which should be considered under the provisions of the DPA. Section 38(1)(a) of FOISA states that information is exempt information if it constitutes personal data of which the applicant is the data subject.

38. The term “personal data” is defined in section 1(1) of the DPA as:

“data which relate to a living individual who can be identified – a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual”

39. The definition is subject to the interpretation contained in Durant v Financial Services Authority [2003] EWCA Civ 1746. In this decision, the Court of Appeal held that if information is to be viewed as personal data, the information has to be biographical in a significant sense, i.e. go beyond the recording of the individual’s involvement in a matter or event that has no personal connotations. The individual also has to be the focus of the information, rather than some other person with whom that individual may have been involved. The Court of Appeal summarised these two aspects as information affecting a person’s privacy whether in his or her personal or family life, business or professional capacity.

40. FOISA and the DPA are mutually exclusive, i.e. information that is available under one piece of legislation is not available under the other: the two pieces of legislation serve two entirely different purposes. Where a request is made to a public authority for personal information relating to the individual making the request, that request must be dealt with in line with the provisions of the DPA. This is to protect the privacy of individuals – the information is made available to that person only.

41. As mentioned above, under section 38(1)(a) of FOISA information is exempt if it constitutes personal data of which the applicant is the data subject. In other words, it is not possible for a person to obtain his or her own personal information under FOISA. This is because disclosure of information under FOISA is effectively disclosure to the world at large and the release by a public authority of an individual’s personal information into the public domain without their consent would constitute a breach of their privacy rights.

42. In my view, Mr Mackenzie’s requests to the Minister for Justice and the Access to Justice Division constituted requests for personal information of which he is the data subject and the Scottish Executive was correct to consider these requests as being exempt by virtue of section 38(1)(a) of FOISA.

43. However, in this particular instance the Scottish Executive tried to provide as much assistance as it could to Mr Mackenzie following the commencement of my investigation, in order to provide him with all of the information he had requested, and it went out of its way to provide the information to Mr Mackenzie despite his repeated refusals to submit a subject access request.

44. In light of this, the Scottish Executive should be commended for the considerable efforts it made to provide Mr Mackenzie with information that could have been justifiably withheld under section 38(1)(a) of FOISA. Rather than requiring Mr Mackenzie to start at the beginning of the request process by submitting a subject access request under the DPA, the Scottish Executive agreed to provide information under both the DPA and FOISA in order to satisfy Mr Mackenzie’s request.

45. This in turn could have caused difficulties concerning the information provided. It is important to note that where an applicant requests information that relates to him or herself under FOISA and a public authority attempts to assist the applicant by providing them with their personal information without requiring them to submit a separate subject access request, that authority will need to make it clear to the applicant that the information has been provided under the terms of the DPA. This is important in order to enable applicants to exercise their rights under the relevant piece of legislation (e.g. in cases where some information is provided under FOISA and some under the DPA, the applicant must be made aware of his or her respective rights of appeal under both pieces of legislation, in relation to the specific information provided or withheld) - and also to secure the privacy of the individual concerned.

46. I am satisfied that the Scottish Executive undertook adequate searches, in both the Access to Justice Division and the Justice Minister’s Private Office, to establish what information was held in relation to Mr Mackenzie’s request.

47. Finally, I note the Scottish Executive’s failure to comply with sections 16 and 19 of FOISA when it issued refusal notices in response to Mr Mackenzie’s original requests. In both cases no information was provided to Mr Mackenzie concerning his rights of application to the Scottish Executive for a review or of the procedure provided by the Scottish Executive for dealing with complaints about its handling of requests for information, as required by section 19 of FOISA. It was also recognised by the Scottish Executive, in its letter of 26 May 2005, that the exemption relied upon under FOISA had not been adequately specified in either refusal notice.

48. However, I am satisfied that the Scottish Executive has recognised and acted upon this procedural error. I also note the considerable assistance the Scottish Executive provided to Mr Mackenzie in dealing with his application.

Decision

I find that the Scottish Executive was correct to consider Mr Mackenzie’s requests for information as being requests for personal information of which he was the data subject and that such information was exempt from disclosure by virtue of section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 (FOISA).

I find that the Scottish Executive failed in its duties under section 16(1) of FOISA, by failing to specify the exemption it had relied upon in relation to Mr Mackenzie’s requests.

I find that the Scottish Executive failed in its duties under section 19 of FOISA, by failing to provide information to Mr Mackenzie concerning his rights of application to the Scottish Executive for a review or of the procedure provided by the Scottish Executive for dealing with complaints about its handling of requests for information.

I do not require the Scottish Executive to take any remedial action in relation to this case.

Kevin Dunion

Scottish Information Commissioner

30 January 2006

Link to PDF file of decision 009/2006 (65.5 kb)