Decision 059/2006 Mr Edward Milne and the Scottish Executive

Request for information relating to the applicant – whether information exempt under section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 – personal information

Applicant: Mr Edward Milne
Authority: The Scottish Executive
Case No: 200502531
Decision Date: 11 April 2006

Kevin Dunion
Scottish Information Commissioner

Facts

Mr Milne wrote to the Scottish Executive (the Executive) requesting all of the information that related to him, including minutes of meetings, internal memos, correspondence and e-mails. Mr Milne’s letter was entitled “Request for Information – Freedom of Information (Scotland) Act”. He was informed by the Executive that his request constituted a request for personal information about himself and should therefore be dealt with under the Data Protection Act 1998 (DPA).

Mr Milne was asked by the Executive to provide proof of his identity and was provided with a remittance advice note in order to allow his request to be processed under the DPA. Mr Milne requested a review under the terms of the Freedom of Information (Scotland) Act 2002 (FOISA). The Executive carried out a review and upheld its original decision to treat the request under the DPA, citing an exemption relating to personal information under section 38(1)(a) of FOISA. Mr Milne was dissatisfied with the response to his request for review and applied to the Scottish Information Commissioner for a decision.

Outcome

The Commissioner found that the Scottish Executive had acted in accordance with Part 1 of FOISA in responding to Mr Milne’s request. The Commissioner held that the Executive was correct to consider Mr Milne’s request for information as being a request for personal information of which he was the data subject and that such information was exempt from disclosure by virtue of section 38(1)(a) of FOISA.

Appeal

Should Mr Milne or the Executive wish to appeal against this decision, there is a right of appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.

Background

1. On 25 August 2005, Mr Milne wrote to the Freedom of Information Unit at the Executive, requesting “all information that relates to me, Edward Milne, and which includes minutes of meetings, internal memos, correspondence and e-mails”.

2. The Executive responded to Mr Milne’s request on 29 August 2005, advising him that it was unable to provide him with personal information about himself under FOISA but that he had a right to access this information under the DPA. The Executive informed Mr Milne that the information he had requested was exempt from release under FOISA in terms of section 38(1)(a) which relates to personal data of which the applicant is the data subject.

3. The Executive asked Mr Milne to clarify his request in order to assist with the process of locating the information he sought. He was asked to provide details of any topic that was of particular concern to him or with which he had been associated. He was also asked if he could provide the name of someone in the Executive that he had previously been in correspondence or had dealings with. It was explained to him that this would assist the Executive in identifying any areas where personal information that related to Mr Milne could be found.

4. Mr Milne was informed by the Executive that he would have to provide proof of his identity (such as a photocopy of his passport, driving licence or other identity document) along with the payment of a fee of £10 which was chargeable under the DPA. This would allow the Executive to process his request under the DPA. A remittance advice note was enclosed with the Executive’s letter and Mr Milne was advised that the 40 day period allowed for response to his subject access request under the DPA would commence upon receipt of that information.

5. Mr Milne was not satisfied with the response he received from the Executive. He sent a fax to the Executive on 31 August 2005, in which he requested a review of its decision not to provide him with the information he had requested under FOISA.

6. The Executive wrote to Mr Milne on 1 September 2005, informing him that a review of his request had been carried out. The Executive’s letter stated that the papers relating to Mr Milne’s request had been examined and the Executive had decided to uphold the decision that the information sought should be dealt with under the terms of the DPA. The Executive’s reviewing officer stated that Mr Milne’s request, as set out, specifically asked for information “that relates to me Edward Milne” and therefore clearly related to his personal data.

7. The letter stated that the rights of access by data subjects to their personal data are set out in section 7 of the DPA and section 38(1)(a) of FOISA exempts information from the right of access afforded by section 1 of FOISA if the information requested constitutes personal data of which the applicant is the data subject. The reviewing officer added that since the exemption is an absolute exemption the public interest test was not applicable in this instance.

8. The letter also stated that although Mr Milne’s request would not be dealt with under FOISA, the Executive was required to comply with his rights of access to his own personal data under the DPA. Mr Milne was asked to provide proof of his identity together with the required £10 fee. He was also asked to provide more details of the information he required to enable the Executive to locate any personal data that it may hold which related to Mr Milne.

9. Mr Milne was dissatisfied with the Executive’s response and applied to me for a decision on 5 September 2005. In his letter, Mr Milne stated that he refused to have his request dealt with under the DPA.

10. An investigating officer was then assigned to this case.

The Investigation

11. Mr Milne’s application for a decision was validated by establishing that he had made a written request for information to a Scottish public authority, and had applied to me only after requesting a review from the authority concerned.

12. The investigating officer contacted Mr Milne by phone, on 6 September 2005, in order to explain to Mr Milne the differences between his rights of access to information under FOISA and his rights of access to information under the DPA. Mr Milne phoned my Office on 7 and 8 September 2005, arguing that his request should be dealt with under FOISA.

13. The Executive was also contacted and invited to comment on Mr Milne’s application in terms of section 49(3) of FOISA. The Executive informed the investigating officer that Mr Milne had written again to the Executive on 20 December 2005, seeking all of the information that the Executive held which related to him. Mr Milne then wrote to the Justice Department of the Executive, on 13 January 2006, seeking all of the information that the Criminal Justice Division of that department held about him.

14. The Executive replied to both letters on17 January 2006, referring to the previous correspondence from Mr Milne. It was again emphasised to Mr Milne that the information he sought was exempt under FOISA but was accessible under the DPA. The Executive held two subsequent telephone conversations with Mr Milne, after which he appeared to accept the position and provided the required £10 fee to enable the Executive to process his requests under the DPA.

The Commissioner’s Analysis and Findings

15. To date, Mr Milne has made a number of applications to my Office for a decision. In each case, Mr Milne’s requests to public authorities were formulated in the following way:

“I require all information that relates to me, Edward Milne, and which includes minutes of meetings, internal memos, correspondence and e-mails.”

16. It is my view that this constitutes a request for all of the information that is held by the authority which is about Mr Milne. In other words, it is a request for personal information and should be dealt with under the terms of the DPA. Indeed, the long title of the DPA states that it is an Act to make provision for “the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.”

Section 38(1)(a) exemption – personal information

17. Section 38(1)(a) of FOISA states that information is exempt information if it constitutes personal data of which the applicant is the data subject. This exemption is absolute – there is no requirement to consider the public interest.

The term “personal data” is defined in section 1(1) of the DPA as:

“data which relate to a living individual who can be identified-

(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual”.

18. The definition is subject to the interpretation contained in Durant v Financial Services Authority [2003] EWCA Civ 1746. In this decision, the Court of Appeal held that if information is to be viewed as personal data, the information has to be biographical in a significant sense, i.e. go beyond the recording of the individual’s involvement in a matter or event that has no personal connotations. The individual also has to be the focus of the information, rather than some other person with whom that individual may have been involved. The Court of Appeal summarised these two aspects as information affecting a person’s privacy whether in his personal or family life, business or professional capacity.

19. In my view, Mr Milne’s initial request clearly constituted a request for personal information and the Executive was correct to consider such a request as being exempt from FOISA by virtue of section 38(1)(a) on the basis that it constituted a request for personal data of which the applicant was the data subject.

20. Mr Milne was advised by my Office on a number of occasions that a request for information that relates to him is a request for personal information and that public authorities were correct to treat such requests under the DPA rather than FOISA. He was also advised to submit a subject access request under the DPA to the relevant public authorities who had invited him to do so in order to obtain the information he required.

21. It should be noted that FOISA and the DPA are mutually exclusive, i.e. information that is available under one piece of legislation is not available under the other: the two pieces of legislation serve two entirely different purposes.

22. Where a request is made to a public authority for personal information relating to the individual making the request, that request must be dealt with under the DPA. This is to protect the privacy of individuals – the information is made available to that person only.

23. As mentioned above, under section 38(1)(a) of FOISA information is exempt if it constitutes personal data of which the applicant is the data subject. In other words, it is not possible for a person to obtain his or her own personal information under FOISA. This is because disclosure of information under FOISA is effectively disclosure to the world at large and the release by a public authority of an individual’s personal information into the public domain without their consent would constitute a breach of their privacy rights.

24. In my view, Mr Milne's request to the Executive constituted a request for personal information of which he is the data subject and the Executive was correct to consider the request as being exempt by virtue of section 38(1)(a) of FOISA.

Decision

I find that the Scottish Executive acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to Mr Milne’s request for information.

I hold that the Scottish Executive was correct to consider Mr Milne’s request for information as being a request for personal information of which he was the data subject and that such information was exempt from disclosure by virtue of section 38(1)(a) of the Freedom of Information (Scotland) Act 2002.

Kevin Dunion

Scottish Information Commissioner

11 April 2006

Link to PDF file of decision 059/2006 (46.5 kb)