Decision 035/2006 Mr P and Dumfries & Galloway Council

Request for personal data relating to the applicant – section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 (FOISA) – request for personal data relating to a third party – section 38(1)(b) of FOISA – information not held – section 17 of FOISA – refusal notice as required by section 16 of FOISA – failure to conduct a review under section 21 of FOSIA – content of certain notices.

Personal data relating to the applicant and other information

Applicant: Mr P
Authority: Dumfries & Galloway Council
Case No: 200502297
Decision Date: 08 March 2006

Kevin Dunion
Scottish Information Commissioner

Facts

Mr P made a series of related requests for information, and requests for review, in three emails dated 27 May 2005, 21 June 2005 and 1 July 2005. Most (but not all) of the information requested in these emails was personal data about himself. Mr P was not satisfied with the responses to these requests provided by the Council and applied to the Commissioner for a decision.

Outcome

The Commissioner found that the Council had supplied to Mr P all information to which he was entitled under the Freedom of Information (Scotland) Act 2002 (FOISA) in response to his requests.

However, the Commissioner found that the Council had failed to comply fully with FOISA in the way it had responded to his requests. In particular, the Council had failed to advise Mr P that personal data relating to himself was exempt from release under section 38(1)(a) of FOISA, because he was entitled to request this information under the Data Protection Act 1998.

The Commissioner does not require any remedial steps to be taken in response to this decision.

Appeal

Should either Dumfries & Galloway Council or Mr P wish to appeal against this decision, there is a right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.

Background

1. Mr P emailed the Council on 27 May 2005, under the subject heading “New request for information per Freedom of Information Act”.

2. This email sought

a) details of payments made by the applicant to a Sheriff Officer, showing credits to his water arrears, and evidence that payments had not been made to his Council Tax arrears
b) updates on outstanding appeals, and
c) email contacts for the Council’s freedom of information officer and another named official.

The Council’s response

3. The Council allocated the reference number 7767 to this request and responded in a letter dated 20 June 2005. This letter stated that the request had been dealt with under the terms of FOISA.

4. The Council’s letter set out some background information about the arrangements for Mr P’s payments to the Sheriff Officer, and explained that the Sheriff Officer could not allocate these just to water/sewerage charges. No breakdown of payments was provided, and no confirmation was provided of whether the information about Mr P’s payments was held by the Council.

5. In response to Mr P’s request for an update on outstanding appeals, the Council referred to an ongoing investigation by my Office (which has since concluded), and stated that it would be inappropriate to comment on this investigation at that point. The letter also referred to a Council tax benefits appeal, advised that the Council was in the process preparing a case for the Appeals Service and noted that it was expected that the Council’s submission would be sent to the Appeals Service shortly.

6. In response to the request for email addresses, the official responding noted that his email address had been supplied previously. This official is a Senior Information Officer in the Council, responsible for co-ordinating responses to requests under FOISA. His email address was also provided, along with his other contact details, on the letter.

7. The Council’s letter did not supply an email address for the other official named. Instead, it pointed out that this individual could be contacted via another individual, who is the agreed point of contact for Mr P within the Council.

8. This letter advised Mr P that if he was not satisfied with the manner in which the Council was handling this issue, and he wished to complain, he should write once again within 40 working days. I understand that this paragraph was intended to refer to the right to request a review under section 20 of FOISA.

9. Mr P then emailed the Council on 21 June 2005, with the subject line “Request 7767 reply 20/6/2005”. This email contained responses to a number of points raised in the Council’s letter, and also contained new requests for information. This email also contained other requests and comments (e.g. that corrected data be sent to the Sheriff Officer) that cannot be construed as requests for information.

Points for review in email of 21 June 2005

10. Given the wording of the Council’s invitation for Mr P to contact the Council with any complaint about its handling of his request (described in paragraph 8 above), I have construed the parts of this email that relate to the original request of 27 May 2005 to be a request for a review of the Council’s response. These are:

a) Mr P asked the Council to confirm the payments received from the Sheriff Officer and show how they had been offset against water [arrears].
b) He also stated that he needed to know precisely how each appeal was being progressed.

New requests in the email of 21 June

11. Following on from point b) in paragraph 10 above, Mr P also asked for more specific information than had previously been requested on outstanding appeals, to include a list of each year of appeal, the Council’s understanding of the merits of each appeal, date of hearing and explanation of delay in statutory processes.

12. Following on from the Council’s reference to the agreement that Mr P would direct his correspondence with the Council through a named official (paragraph 7 above), Mr P stated that he did not get answers by doing this. He asked for “copies of proof” that his complaints were passed on.

13. Finally, Mr P referred to an email between Council officials that had been sent to him by my Office in response to a request for information. This email referred to photographs of another “Mr P” (who will be referred to as Mr Q in the rest of this decision to distinguish him from the applicant). Mr P’s request of 21 June asked the Council what the content of these photographs were, and asked for them back from his complaint file. Mr P also requested a copy of a further email that was referred to in the email about Mr Q’s photographs.

14. The email between Council officials referring to photographs of Mr Q had been supplied to me in relation to an investigation into another request by Mr P. However, the Council had later confirmed that this email had been sent in error, and did not actually relate to Mr P.

The Council’s response to the email of 21 June

15. The Council did not recognise any part of Mr P’s email of 21 June 2005 as a request for review under section 20 of FOISA. This email was allocated the new reference number 7776, and an email acknowledgement sent on 21 June 2005.

16. A full response was provided in a letter dated 27 June 2005. This erroneously contained the reference 7767 (the reference previously allocated to Mr P’s initial request), rather than 7776.

17. This letter provided a list of payments made to the Sheriff Officer, but again noted that the Sheriff Officer is not responsible for allocating payments between Council Tax and water charges. The Council confirmed the total amount credited to Mr P’s account.

18. In response to the further request for information on outstanding appeals, the Council referred back to the previous response (described in paragraph 5 above) and again indicated that it would be inappropriate to comment on outstanding appeals.

19. In response to Mr P’s request for information about his complaints being passed on within the Council, the Council asked for clarification of which complaints he had been referring to.

20. Finally, the Council responded to Mr P’s requests for information about the photographs of Mr Q and the related email by advising him that the email referring to these had been mistakenly provided to my Office, and confirming that no photographs of Mr P were held by the Council. Following on from this point, the Council advised that the email requested by Mr P did not relate to him, and that there was therefore no request under FOISA applicable on this point.

21. Once again, this letter invited Mr P to complain to the Council within 40 working days of the receipt of its response if he was not satisfied with the way in which it had handled his request. Again, I understand this invitation to relate to the right to request a review of the Council’s handling of the request under section 20 of FOISA.

Mr P’s further email

22. Mr P emailed the Council once again on 1 July 2005. This email (which was resent on 7 July 2005) again contained a number of responses to and complaints about the response to the requests for information provided in the Council’s letter of 27 June. It also contained requests and complaints that fall outside the scope of FOISA (and so outwith my investigation here), and new requests for information.

23. I have again interpreted this email as, at least in part, seeking a review of the Council’s response of 27 June 2005. It:

a) again expressed dissatisfaction with the information provided detailing payments to the Sheriff Officer.
b) expressed dissatisfaction with the Council’s failure to provide a detailed list of outstanding appeals.
c) reiterated the request for evidence that Mr P’s complaints were passed on within the Council
d) reiterated the request for a copy of the internal email referred to in the email concerning Mr Q’s photographs.

24. In this email, Mr P also made a new request for the address of Mr Q so that he could advise them of “breach of his confidentiality rights”. This request has not been formally considered in the decision below, as it has never been the subject, as I understand it, of any request for review.

25. I understand that no review was conducted in response to this email.

Investigation

26. As the above should confirm, the requests under consideration in this case, are overlapping and rather confusing. This situation was compounded by the Council’s confusion of its own reference numbers when responding to the second request, which it had designated 7776, under the reference 7767.

Validation

27. Mr P first made an application to my Office on 20 July 2005. He claimed that no response had been provided to his request 7776 (the second of his emails described above). However, by this point, a response had been provided by the Council, with the erroneous reference 7767. As such the application for a decision at this point was not valid.

28. An investigating officer was allocated to Mr P’s case, to establish whether a valid application had been made and whether an investigation could be conducted into these matters under FOISA.

29. Following a series of correspondence between Mr P and the investigating officer, and with the assistance of the Council, the sequence of events described in paragraphs 1 – 25 above was eventually established.

30. Given the nature of his requests to the Council, the investigating officer twice advised Mr P that any request for his own personal data would be more appropriately made under the terms of the Data Protection Act 1998 (DPA) rather than FOISA. However, I understand that Mr P did not make any request to the Council in pursuit of his subject access rights under section 7 of DPA in response to this advice.

31. A valid application for decision by me was later received on the 9 September 2005. In it, Mr P indicated that the responses he had received to his requests for information to be selective, with the omission of salient points.

32. Given the interrelation between the two sets of requests designated with the references 7767 (contained in Mr P’s initial email of 27 May) and 7776 (contained in his subsequent email of 21 June), these two sets of requests and the Council’s responses to them were investigated together. Given that emails which contain requests for reviews were submitted in relation to each of these sets of requests, I have judged that Mr P was in a position to ask me to investigate the Council’s responses to both.

33. The investigating officer wrote to Mr P on 15 September 2005 confirming that a valid application had now been received, and that an investigation would be conducted.

The investigation

34. The investigating officer also wrote to the Council on 15 September 2005, to inform it that a valid application had been received and that a full investigation would now commence. The Council was invited to comment on the case in terms of section 49(3) of FOISA.

35. The investigating officer also asked the Council to provide background information on this case, and to confirm the types of information that it held in relation to each of Mr P’s requests.

36. The Council’s response to this letter was received on 6 October 2005. The investigating officer requested further information to clarify a number of points in February 2006, and this was also provided by the Council.

The Commissioner’s analysis and findings

37. The key question for me to address in this case is whether the Council has responded to Mr P’s requests for information in accordance with Part 1 of FOISA. However, before I address this point, I want to comment on the wider circumstances of this case and the difficulties these have caused for all parties.

38. The requests for information in this case form part of a long and convoluted series of correspondence between Mr P and the Council. Mr P emails the Council frequently and repetitively (often several times in the same day), in what might be described as a “scattergun” manner.

39. I am aware that the nature of Mr P’s correspondence and his relationship with the Council means that a significant amount of staff time and resources are spent on dealing with his communications. I also appreciate that Mr P’s style of communication does not facilitate easy understanding or a simple response.

40. Mr P has made many requests for information under FOISA, often overlapping, and often difficult to distinguish from wider complaints, requests for comments, requests for action and other correspondence. As the description of the chain of correspondence in paragraphs 1 – 25 shows, it can be difficult to establish whether an item of correspondence contains a request for review, new requests, or is concerned with other matters.

41. It is clear to me that the way in which Mr P communicates with the Council has the effect of limiting the Council’s ability to respond to him efficiently and effectively. While I sympathise with the Council’s position given the context for this case, and I am aware of the significant efforts that have been made to accommodate Mr P’s requests and concerns, this does not mean that the obligations created by FOISA and related legislation should be overlooked, or applied less rigorously than in response to other requestors.

42. One particular difficulty in this case has been caused by the fact that in the chain of correspondence following from his initial request of 27 May 2005, Mr P did not explicitly invoke his right to request a review under section 20 of FOISA. This section states that when requesting a review of a decision, a requestor should explain the reasons for the applicant’s dissatisfaction with the response provided.

43. The Council has rightly pointed out to me that Mr P’s correspondence neither overtly requested a review, nor stated what matters he would like to be reviewed. This is one of the reasons why the emails of 21 June 2005 and 1 July 2005 were not considered by the Council to be requests for review.

44. However, having regard to paragraph 64 of the Scottish Minister’s Code of Practice on the Discharge of Functions by Public Authorities under the Freedom of Information Scotland Act 2002 (the Section 60 Code), I have accepted that at least part of these emails should be considered to be requests for review nonetheless, given that they questioned the responses provided by the Council to the previous requests for information. This is because the Council’s letters did not explicitly advise Mr P of the right under section 20 of FOISA, or how it should be invoked. Instead, the Council advised Mr P that if he wished to complain, he should do so within a 40 working day period.

45. I would recommend to the Council that for the avoidance of future confusion, it modify its responses to requests under FOISA to advise requestors explicitly of the right to review, and how this should be invoked.

The Council’s responses to Mr P’s requests

46. I turn now to the substance of my decision. I will address first the parts of Mr P’s requests that relate broadly to himself. These include:

a) Details of payments by him to the Sheriff Officer, and their allocation to water arrears.
b) Information about appeals by him.
c) Information showing that his complaints to the council had been passed on.

Mr P is not satisfied with the responses provided by the Council under the terms of FOISA.

Personal information and FOISA

47. It should be noted from the outset that where an applicant makes a request for information held by a public authority that relates to the applicant, this will in most cases be a request for personal information which should be considered under the provisions of the DPA. Section 38(1)(a) of FOISA states that information is exempt information if it constitutes personal data of which the applicant is the data subject.

48. The term “personal data” is defined in section 1(1) of the DPA as:

“data which relate to a living individual who can be identified –
a) from those data, or
b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual”

49. The definition is subject to the interpretation contained in Durant v Financial Services Authority [2003] EWCA Civ 1746. In this decision, the (English) Court of Appeal held that if information is to be viewed as personal data, the information has to be biographical in a significant sense, i.e. go beyond the recording of the individual’s involvement in a matter or event that has no personal connotations. The individual also has to be the focus of the information, rather than some other person with whom that individual may have been involved. The Court of Appeal summarised these two aspects as information affecting a person’s privacy whether in his or her personal or family life, business or professional capacity.

50. FOISA and the DPA are mutually exclusive, i.e. information that is available under one piece of legislation is not available under the other: the two pieces of legislation serve two entirely different purposes. Where a request is made to a public authority for personal information relating to the individual making the request, that request must be dealt with in line with the provisions of the DPA. This is to protect the privacy of individuals – the information is made available to that person only.

51. In other words, it is not possible for a person to obtain his or her own personal information under FOISA. This is because disclosure of information under FOISA is effectively disclosure to the world at large and the release by a public authority of an individual’s personal information into the public domain without their consent would constitute a breach of their privacy rights under the DPA.

52. I am satisfied that any information held by the Council that would fall under the scope of a) – c) in paragraph 46 above is personal data about Mr P for the purposes of the DPA.

53. Therefore, the appropriate response under FOISA to these requests would have been to confirm that this information was exempt from release under section 38(1)(a) of FOISA and either

a) to advise Mr P of how to make an appropriate request under DPA, or
b) to provide the information requested while making clear that the information had been provided under DPA.

I find that the Council failed to act in accordance with Part 1 of FOISA by failing to respond in one of these ways. The Council failed to comply with the duty under section 16 of FOISA to issue a refusal notice advising Mr P that the information was exempt from release, and specifying the relevant exemption.

54. I appreciate that by responding to Mr P’s requests for his own personal data under FOISA, the Council was trying to be helpful to him. However, by suggesting to him that this information was made available under FOISA, this has caused difficulties by enabling him to continue to pursue his rights under the inappropriate appeal channel. Having identified the information concerned here as personal data about the applicant, and so not available under FOISA, it now falls outside my locus to investigate whether or not further information should have been provided in response to a subject access request under DPA.

55. It is important that where an applicant requests information that relates to them under FOISA and a public authority attempts to assist the applicant by providing them with their personal information without requiring them to submit a separate subject access request, that authority will need to make it clear to the applicant that the information has been provided under the terms of the DPA. This is important in order to enable applicants to exercise their rights under the relevant piece of legislation and also to secure the privacy of the individual concerned.

Requests for information that does not relate to Mr P

56. Alongside the requests for his own personal data, Mr P’s emails on 27 May 2005 and 21 June 2005 made 2 requests for other information. This included:

a) the email contacts for the Council’s freedom of information officer, and another named official.
b) information about the content of photographs of Mr Q referred to in an internal Council email, the return of these photographs, and a copy of a further email referred to.

I will address these two requests in turn below.

Email contacts for council officials

57. The Council’s response to the request for email contacts was to confirm the address for the Council’s designated freedom of information contact, but to request that Mr P contact the second official via another named official.

58. I understand that the Council has an agreement with Mr P that his contact with the Council will be coordinated via this second official.

59. In considering this request, I have noted the wording of Mr P’s email, which requested the email “contacts” for the two specified individuals rather than their addresses. The response did provide the means of contacting both by email, although in the second case this was not a direct point of contact.

60. I find that the Council responded appropriately to this particular request, given the context of its ongoing arrangements with Mr P.

Photographs and other information relating to Mr Q

61. These final requests were prompted by an email, provided to me in the context of another investigation relating to Mr P, which was later supplied to him in response to an information request. The email referred to photographs of a “Mr P” (referred to here as Mr Q) and an email concerning him.

62. This email had been supplied to me because the Council had initially believed that it referred to Mr P. However, the Council later confirmed that this did not relate to Mr P and asked that it be destroyed and disregarded in my investigation.

63. In response to Mr P’s request for these photos and related information, the Council explained that they did not concern him, and then appears to have presumed that this meant the request by Mr P was no longer valid.

64. However, Mr P’s request did not specify that he only wanted these photographs should they relate to himself, and he continued to seek access to them following the Council’s explanation. Therefore, a proper response should have been provided under FOISA.

65. Having sought further information from the Council on this matter, I am satisfied first of all that the photographs in question are no longer held by the Council, having being returned to Mr Q after they had been used for the purpose for which they were provided.

66. The Council has also explained the reasons for the photographs being held by the Council, and provided me with a copy of the email relating to these that Mr P has requested a copy of.

67. The Council has indicated that the context in which the photographs were provided was such that there would be a reasonable expectation of confidentiality by the subject. It indicated that the exemption in section 36(2) (which applies where release would entail an actionable breach of confidence) applied to these.

68. In a later email to the investigating officer, however, the Council confirmed that having reassessed the contents of the email relating to Mr Q, it had concluded that section 36(2) had been wrongly applied in the first instance. Instead, it suggested that the exemption in section 38 of FOISA should instead have been applied.

69. Although this email was not explicit about which part of section 38 was relevant in this instance, discussions with the Council confirmed that it was of the view that section 38(1)(b) (read in conjunction with section 38(2)(a)(i))applied in this instance. This exempts third party personal information if the release of the information would entail a breach of any of the data protection principles.

Conclusions on the information relating to Mr Q

70. Following my investigation, it is clear to me that the photographs referred to by the Council were held for a specific purpose, and were later returned to Mr Q. They were no longer held by the Council at the time of Mr P’s request.

71. Where requested information is not held by a public authority, section 17 of FOISA requires that the requestor be advised that this is the case. The Council did not advise Mr P that this was the case, and so failed to comply with this requirement under FOISA.

72. The Council does still hold a copy of an email that relates to Mr Q. I am satisfied that the contents of this email are personal data about Mr Q, and that he would reasonably expect that this information would not be released into the public domain.

73. Given the circumstances in which he had provided his photographs to the Council, and the Council had exchanged related emails, I have concluded that release of this email would breach of the first data protection principle, which requires that processing of an individual’s personal data be fair and lawful. I therefore conclude that the Council should have responded to Mr P’s request for a copy of this email by notifying him, as required by section 16 of FOISA, that it was exempt from release under section 38(1)(b) of FOISA.

Failure to conduct a review

74. Finally, I turn to the technical aspects of the Council’s responses to Mr P. As I indicated in the summary of the sequence of correspondence in paragraphs 1 – 25 above, I understand Mr P’s emails of 21 June 2005 and 1 July 2005 to contain requests for review by the Council of its responses to his information requests, provided in the letters of 20 June 2005 and 27 June 2005.

75. I acknowledge that these requests for review were not clearly marked as such, and they were expressed in conjunction with new information requests, and other requests for action by the Council. However, given the terms of paragraph 64 of the Section 60 Code, I find that the Council failed to comply with section 21 of FOISA, by failing to recognise these emails as containing requests for review, and by failing to conduct reviews of its responses to these requests.

Overall conclusion

76. I have found that the Council’s responses to Mr P’s requests for information under consideration in this decision have been wanting in a number of respects. My formal decision sets these various breaches of FOISA out below.

77. However, I do not find that the Council has failed to supply to Mr P any information to which he is entitled under FOISA. I do not require any further information to be provided to Mr P under the terms of FOISA in response to these requests.

78. This is because I have found that the information requested by Mr P that has not already been provided is either:

a) his own personal data, and so available to him through his rights of subject access under DPA, or
b) exempt from release under section 38(1)(b) of FOSIA because it is personal data relating to a third party, and release would breach the first data protection principle.

Decision

I find that Dumfries & Galloway Council has failed to act fully in accordance with the Freedom of Information (Scotland) Act 2002 (FOISA) in the way it responded to Mr P’s requests for information contained in his emails of 27 May 2005 and 21 June 2005.

I find that the Council has supplied all information to Mr P to which he is entitled under FOISA in response to these requests.

However, the Council failed to advise Mr P that his own personal data was exempt from release under section 38(1)(a) of FOISA, and that access to this was instead provided under DPA.

The Council also failed to notify Mr P that the internal email that he had requested, relating to Mr Q was exempt from release. I have found that the Council should have identified that this email was exempt from release under section 38(1)(b) of FOISA, because it contained personal data relating to a third party, and that release would breach the first Data Protection Principle.

By failing to provide proper refusal notices in response the requests for exempt information, the Council failed to comply with the requirements of section 16 of FOISA.

The Council also failed to notify Mr P, as required by section 17 of FOISA, that the photographs of Mr Q that he had requested were no longer held by the Council.
I also find that the Council did not comply with section 21 of FOSIA, by failing to conduct review of its handling of Mr P’s requests for information in response to his emails of 21 June 2005 and 1 July 2005.

I do not require any remedial steps to be taken in response to this decision

Kevin Dunion
Scottish Information Commissioner
8 March 2006

Link to PDF file of decision 035/2006 (77.7 kb)