Home Decisions

Decision 069/2005

Decision 069/2005 Mr D and the Scottish Executive

Request for information relating to the applicant – information withheld under section 38(1)(a) – failure to issue a refusal notice under section 16(1) of FOISA

Request for information held relating to the applicant.


Applicant: Mr D
Authority: Scottish Executive
Case No: 200501335
Decision Date: 15 December 2005


Kevin Dunion
Scottish Information Commissioner


Facts


Mr D requested information from the Scottish Executive (the Executive) relating to both himself and a letter in which he was discussed. The Executive applied section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 (FOISA) to the information, on the grounds that it constituted personal data of which he was the subject. The Executive failed, however, to make clear to Mr D that this exemption had been applied.


Mr D lodged an application with the Commissioner on the grounds that he was dissatisfied with the information that was subsequently released.


Decision


The Commissioner found that the Executive acted correctly in processing Mr D’s information request under the Data Protection Act 1998 (DPA), as opposed to FOISA.


However, the Commissioner also found that the Executive failed in its duties under section 16(1) of FOISA, by failing to issue a formal refusal notice in relation to the case.


Appeal


Should either the Executive or Mr D wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.


Background


1. Mr D submitted an information request to the Executive on 9 February 2005. The letter which contained this request was part of a series of ongoing correspondence between Mr D and the Executive, relating to his involuntary detention and treatment in 2004 under the Mental Health (Scotland) Act 1984.


2. Mr D’s request related to a letter sent by Depression Alliance Scotland (DAS) to the Executive in January 2004, which he believes contributed to the decision to detain him. The wording of the information request of 9 February 2005 was as follows:


I would be grateful for information as to with whom the Depression Alliance letter was discussed within the Executive.  Please also provide copies of letters, emails, minutes, notes and records of telephone or other verbal communications regarding both the letter and me.


3. On 16 February 2005, the Executive contacted Mr D seeking clarification in relation to his request. This clarification sought details of the date on which the DAS letter was sent, and confirmation regarding whether the information sought by Mr D extended beyond the DAS documentation. The Executive pointed out that, if so, this aspect of the request may fall under the DPA as opposed to FOISA.


4. Mr D wrote to the Executive independently, also on 16 February 2005, in response to a letter received on 4 February 2005. Mr D’s letter of 16 February 2005, however, provided further clarification in relation to his information request. In this correspondence, Mr D sought:

  • Names and positions of those with whom I was discussed in your office, and content of those discussions.
  • Names and content of communications with Grampian NHS Board
  • Full records and other information regarding communications concerning me between persons in your office and Depression Alliance Scotland between January 1st and March 31st 2004.


5. Mr D responded to the Executive’s request for clarification on 21 February 2005, confirming that he was seeking access to information beyond the DAS letter.


6. Mr D again contacted the Executive on 13 March 2005, raising concerns relating to the Executive’s role in the treatment he received. In this correspondence, Mr D also reiterated his requests for information.


7. A response to Mr D’s information request was provided on 15 March 2005. This response provided copies of information held by the Executive relating to both Mr D and the DAS letter, along with details of the names and positions of staff members within the Executive referred to in the papers.


8. On 19 March 2005, Mr D contacted the Executive to request that it review its handling of his information request. In this request for review, Mr D stated that parts of the information sent were ‘unintelligible to those unfamiliar with the internal working of the Executive’, and requested that the information be provided ‘in a manner both understandable and usable by laypersons’.


9. A formal response to Mr D’s request for review was issued on 18 April 2005. This response informed Mr D that no additional correspondence had been identified which related to the DAS letter, and that there was no evidence to uphold allegations made by Mr D that information was held which had not been provided. In response to Mr D’s concerns regarding the ‘usability’ of the information, the Executive also forwarded an explanatory document to accompany the information sent previously. This document set out what each item of information represented, along with details of how each item interrelates with other items supplied.


10. Mr D initially contacted my Office in relation to this case with a view to making an application on 31 March 2005. This correspondence sought my intervention in relation to a number of information requests submitted by Mr D to various public authorities, of which the Scottish Executive was one. However, this initial submission was received prior to the expiry of the 20 working day period provided by FOISA for the Executive to respond to Mr D’s request for review. Mr D subsequently submitted additional information in support of his various cases. One of these submissions, received on 6 May 2005, contained information which fulfilled the criteria required by section 47(2) of FOISA for a valid application in relation to his case against the Executive.


The Investigation


11. Mr D’s appeal was validated by establishing that he had made a valid request under FOISA, and had submitted an appeal only after asking the public authority to review its response to his request.


12. In his application, Mr D indicated that he was dissatisfied with the Executive’s response for a number of reasons. In summary, Mr D’s dissatisfaction stemmed from the following:

  • The information supplied in response to his request was not made available in a readily intelligible and usable form;
  • The information supplied was restricted only to communications concerning the DAS letter, while his original request sought broader information.

Mr D also indicated he would be unhappy if his information request (in relation to this and other cases) were processed under the Data Protection Act 1998 (the DPA) as opposed to FOISA. This was for the following reasons:

  • Mr D believed the process of accessing information under the DPA to be awkward and prohibitively expensive;
  • He argued that the information requested was essentially about others, as opposed to being about himself, and suggested that he would feature in the information merely as a named person harmed by their actions.
  • Mr D also argued that any information relating to him would be rumour, as opposed to fact, and suggested that rumour could not be considered to be personal data.


13. My Office contacted the Executive for their submissions in relation to the case on 10 June 2005. Information sought from the Executive included:

  • Confirmation of the legislation under which the request was processed;
  • Details of the information provided in response to Mr D’s request;
  • Confirmation of whether the Executive had provided all the information held which fell within the scope of the request;
  • Details of any information withheld;
  • An overview of the Executive’s response to Mr D’s request for review.


The Executive’s submissions


14. The Executive responded to this request for information on 30 June 2005. In this response, the Executive provided copies of original information sent to Mr D on 15 March 2005, along with a copy of the explanatory document described in paragraph 9 above.


15. The Executive stated that it believed the information provided to Mr D represented all the information held which fell within the scope of Mr D’s request, including all information sought in his clarification letters of 16 and 21 February 2005 (summarised under paragraphs 4 and 5 above).


16. The Executive also informed my Office that, given that Mr D’s request specifically referred to information concerning himself, a decision was taken that the information should be exempted under section 38 of FOISA. Section 38 of FOISA relates to personal information, with section 38(1)(a) containing an absolute exemption covering personal data of which the applicant is the data subject. The Executive stated that the request was therefore dealt with under the terms of the DPA, and that Mr D was informed of this in the letter of 16 February 2005, summarised under paragraph 3 above.


17. Information was also provided concerning the Executive’s review of Mr D’s request. The Executive stated that this review confirmed that no other relevant correspondence was held on file, and that there was no evidence to suggest that additional information was available which had not been provided.


18. The Executive also indicated that it believed that the assistance provided to Mr D in relation to the case was exceptional, particularly the explanatory documentation provided in response to his request for review. The Executive stated that this exceeded the requirements of section 15 of FOISA, which requires public authorities to provide advice and assistance to those making information requests.


Mr D’s submissions


19. During the course of this investigation, Mr D has also made several submissions to my Office, by both telephone and mail. These submissions have included those relating specifically to this particular case, as well as more general submissions addressing common issues across the various applications Mr D has made. These submissions have included:

  • Background information on the case, including a description of the treatment received by Mr D, submitted on 1 May 2005.
  • Copies of documentation provided by the Executive in response to his initial request, submitted on 6 July 2005.
  • Sample copies of additional requests for information made to the Executive, dated 8 August 2005, which were sent to those Executive staff members named in the response to Mr D’s request of 9 February 2005. In response to this submission, my Office confirmed to Mr D that the information sought through these communications would fall within the scope of Mr D’s original request (which requested copies of all information held by the Executive relating to the case).


The Commissioner’s Analysis and Findings


20. The key issue to be addressed in relation to this case is the nature of the information sought by Mr D in his request of 9 February. In its submissions to this Office, the Executive stated that Mr D’s request was dealt with under the DPA as opposed to FOISA, as the request was for his own personal data. Mr D has, however, questioned this view in his submissions to this Office (see paragraph 12).


Is the requested information personal data?
21. Mr D’s request of 9 February, and his follow up correspondence providing clarification, can be broadly summarised within two distinct information requests. These are as follows:


a) Details of staff members within the Executive involved in the discussion of his case.
b) Copies of all recorded information held in connection with this case.


22. Mr D’s request of 9 February 2005 contained an explicit reference to FOISA, and requested the information under that legislation. However, the fact that an information request refers to a specific piece of legislation will not necessarily mean that that request should be processed in accordance with that legislation. On receipt of information requests, public authorities should first consider the nature of the information requested, and subsequently process the request in accordance with the appropriate legislation. If the information sought by an applicant falls under the definition of ‘personal information’ contained within the DPA, then that information request should be processed in accordance with that Act, regardless of whether the requestor has made reference to it or not.


23. Requests for an individual’s own personal data are exempt under FOISA. Section 38(1)(a) of FOISA contains an absolute exemption covering information of this type. As an absolute exemption, section 38(1)(a) is not subject to the public interest test.


24. ‘Personal data’ is defined in section 1(1) of the DPA as:


‘data which relates to a living individual who can be identified:
a) from those data, or
b) from those data and from other information which is in the possession of or is likely to come into the possession of the data controller…’


25. The (UK) Court of Appeal ruling in Durant v Financial Services Authority [2003] EWCA Civ 1746 (the Durant ruling) provides further guidance when considering the definition of personal data. In this decision, the Court held that, if information is to be viewed as personal data, that information must be ‘biographical in a significant sense’. It therefore has to go beyond simply recording an individual’s involvement in a matter or event that has no personal connotations, and should feature the individual as the focus of the information. The Court of Appeal summarised personal data as information which ‘affects [a person’s] privacy, whether in his personal or family life, business or professional capacity’.


26. Having reviewed both the information supplied by the Executive in response to Mr D’s information request, and having considered the content of the DAS letter, it is clear to me that the material sought by Mr D falls within the definition of personal data provided by the DPA and the Durant ruling.


27. The DAS letter which prompted the Executive to initiate the correspondence and communications sought by Mr D features Mr D as the explicit and only subject, and subsequent documentation relates specifically to his personal circumstances and the Executive’s handling of his particular case. As such, this information can clearly be considered to be personal data. In addition, Mr D’s request for details of those individuals who have discussed his case represents a request for information to be extracted from his own personal case file, and should therefore also be considered to be a request for his own personal data.


28. In his submissions to this Office, Mr D has stated that he was unhappy with the Executive’s processing of his request under the DPA for a number of reasons. These are summarised at paragraph 13 above. During the course of this investigation, however, my staff have discussed these issues with Mr D, and have communicated to him the fact that requests for personal data should be processed under the DPA. In doing this, it was also made clear that an authority may choose to charge an appropriate fee under that legislation (although it would appear that the Executive has chosen not to do so in relation to this case).


29. It was also communicated to Mr D that any information held relating to his personal life will likely fall within the scope of the DPA, regardless of whether that information contains inaccuracies, and that the DPA provides a route by which he can access this data and pursue the correction of any such inaccuracies. It should be noted that, following these communications, Mr D initiated communications with the Information Commissioner’s Office (ICO), which has responsibility for enforcing the DPA throughout the UK.


30. I therefore conclude that the Executive acted correctly in processing Mr D’s requests under the DPA, as opposed to FOISA.


31. Mr D also stated in his submissions to my Office that he was dissatisfied with the information provided because he believed that the information supplied was not ‘readily intelligible’, and that his request was for broader information than that provided. However, given the conclusions drawn above that the information sought falls outwith the scope of FOISA, I was not empowered to consider this aspect of Mr D’s dissatisfaction during the course of this investigation. I would therefore advise Mr D that any outstanding concerns should be pursued under the DPA, and would suggest that further contact is made with the ICO in order to investigate his options in relation to this case.


32. In his recent submissions to this Office, Mr D has also provided copies of correspondence from the Executive, dated 7 November 2005, which indicates that the information released on 15 March 2005 may not constitute all of the information held falling within the scope of his request. This correspondence suggests that a further review is underway in order to establish whether any additional information can be provided. However, I must again advise that further investigation in relation to this issue falls outwith my remit, and would again suggest that Mr D contact the ICO for further guidance.


The Executive’s handling of the information request


33. I would also like to take this opportunity to comment on the Executive’s handling of Mr D’s information request.


34. In its submission to me of 30 June 2005, the Executive stated that Mr D’s request was processed under the DPA, and that this was communicated to Mr D in the Executive’s letter requesting clarification, dated 16 February 2005. However, on examination of the letter of 16 February 2005, it appears that the message communicated to Mr D was that information relating to the DAS letter may fall within the scope of FOISA, while any information which “extends beyond the Depression Alliance Scotland papers…may fall for consideration under the Data Protection Act”.


35. In its submissions to my Office, the Executive has indicated that the request was (correctly) processed under the DPA, as a result of the requested information being exempt under section 38(1)(a) of FOISA. However, this does not appear to have been expressly communicated to Mr D at any point during the communications between the parties. As a result, Mr D was left in a position where he was unsure of the legislation under which his request was processed, and therefore unsure of the body to which he should bring an appeal.


36. As discussed above in paragraph 22, Mr D’s original request contained a direct reference to FOISA. As a result, it was explicitly clear that Mr D intended to exercise his rights under FOISA when submitting his request. Because of this, the Executive should have proceeded by conducting an initial assessment of the requested information in order to establish whether FOISA was in fact the appropriate legislation under which the request should be processed. On reaching the conclusion that the requested information constituted personal data about Mr D, the Executive should then have issued a formal refusal notice under section 16 of FOISA, stating that the information was exempt under section 38(1)(a), for the reason that it constituted personal data about the applicant. The Executive should then also have provided details of the process by which the information could be accessed under the DPA.


37. While Mr D would then have been entitled to request that the Executive review their handling of the request under FOISA, the scope of any such review would likely have been limited to a simple assessment of whether the Executive acted correctly in applying the exemption under section 38(1)(a). However, the Executive’s failure to issue a formal refusal notice under section 16 of FOISA appears to have led to a situation where, on receipt of Mr D’s subsequent request for review, it was unclear of how to proceed in terms of compliance with the legislation. While the Executive correctly issued a review notice under section 21(5) of FOISA, this notice did not address the fact that the request had actually been processed under the DPA, and therefore created the impression that any appeal in relation to the entire case should be made to me, as opposed to the ICO.


38. The Executive’s failure to issue a formal refusal notice under FOISA in relation to this case, and its subsequent failure to clarify the process following receipt of Mr D’s request for review, has led to a considerable degree of uncertainty on the part of the applicant regarding both his rights under the access to information legislation, and the processes he should follow in order to exercise those rights. It is my opinion that this has, subsequently, served only to frustrate the relationship between the parties and hinder the resolution of this matter.


39. In failing to issue Mr D with a formal refusal notice in relation to his information request, I therefore find that the Executive failed in its duties under section 16(1) of FOISA. Apart from this, the Executive has provided Mr D with a great deal of assistance in dealing with his application.


Decision


I find that the information requested by Mr D is exempt under section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 (FOISA) and that, accordingly, the Scottish Executive (the Executive) acted correctly in processing Mr D’s information request under the Data Protection Act 1998, as opposed to FOISA.


I find that the Executive failed in its duties under section 16(1) of FOISA, by failing to issue a formal refusal notice in relation to this case. I do not require the Executive to take any remedial action in relation to this case.


Kevin Dunion
Scottish Information Commissioner
15 December 2005

 

 

PDF IconLink to PDF file of decision 069/2005 (76.5 kb)