Decision 075/2005 - Mr Edward Milne and Angus Council

Request for information relating to the applicant – information exempt under section 38(1)(a) of the Freedom of Information (Scotland) Act 2002 – personal information – information not held – section 17

Request for information relating to the applicant

Applicant: Mr Edward Milne
Authorities: Angus Council
Case No: 200502247
Decision Date: 13 December 2005

Kevin Dunion
Scottish Information Commissioner

Facts

Mr Milne wrote to Angus Council requesting all of the information that related to him, including minutes of meetings, internal memos, correspondence and e-mails. Mr Milne was informed on a number of occasions that his request constituted a request for personal information about himself and should be dealt with under the Data Protection Act 1998 (DPA). He was asked to provide proof of identity to allow his request to be processed under the DPA. This was provided by Mr Milne, but he complained to Angus Council, stating that he wanted his request to be dealt with under the Freedom of Information (Scotland) Act 2002 (FOISA). He then requested a review in which Angus Council upheld its original decision to treat the request under the DPA. Mr Milne was provided with information by Angus Council under the DPA, but he was dissatisfied with the response he had received in relation to his request for a review under FOISA and applied to the Scottish Information Commissioner for a decision.

Outcome

The Commissioner found that Angus Council had complied with section 1(1) of FOISA in deciding to withhold personal information under section 38(1)(a) on the basis that Mr Milne’s request for all information relating to him constituted a request for personal information of which he was the data subject and as such should be dealt with under the terms of the DPA.

The Commissioner was satisfied that information concerning Mr Milne and Trading Standards was not held by Angus Council under section 17 of FOISA, and that Angus Council had complied fully with the provisions of FOISA.

Appeal

Should Mr Milne or Angus Council wish to appeal against this decision, there is a right of appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.

Background

1. On 27 May 2005, Mr Milne requested all information relating to him held by Angus Council. The Council responded to his request on 3 June 2005, advising him that it was unable to provide him with personal information about himself under the Freedom of Information (Scotland) Act 2002 (FOISA) but that he had a right to access this information under the Data Protection Act 1998 (DPA).

2. Angus Council asked Mr Milne to clarify his request in order to assist with the process of locating the information he sought. He was asked to supply details of the services he received, when he received these services, which department he received the services from and, if relevant, which member of staff who had provided the services whom he had been in regular contact with. Mr Milne was also asked to provide evidence of his identity to enable his request to be processed under the DPA.

3. Mr Milne responded by fax on 6 June 2005, stating that the information he required dated from December 1988 to the present and involved himself and personnel in Trading Standards, first of all with Tayside Region and then with Angus Council. He also enclosed proof of his identity which enabled Angus Council to process his request under the DPA. However, in his fax, Mr Milne emphasised that he wished his request to be dealt with under FOISA.

4. Angus Council contacted Mr Milne by phone to explain why his request had to be dealt with under the DPA and its position was restated in a letter, dated 7 June 2005, where the Council stated that FOISA “deals with everything else which is not information relating to yourself”. The letter stated: “As discussed, you are looking for information relating to yourself. I therefore need to deal with your request under the Data Protection Act 1998.” Leaflets were enclosed with the letter which provided information about the DPA and FOISA and set out the timescale within which Angus Council was to provide Mr Milne with information under the DPA. Mr Milne responded to that letter by fax on 9 June 2005, repeating that he wished his request to be treated under FOISA.

5. Angus Council provided information to Mr Milne under the terms of the DPA, on 24 June 2005. This included information held by the Chief Executive’s Department (including Personnel Services), the Law and Administration Department and the Environmental and Consumer Protection Department (including Trading Standards).

6. Mr Milne was informed that any information held by Angus Council which related to him in connection with a specific incident involving Trading Standards had been destroyed. The documents had been destroyed in line with advice that had been issued to the Council in a letter from the Scottish Criminal Cases Review Commission on 3 December 2004. A copy of that letter was enclosed for Mr Milne’s attention.

7. It was again emphasised that because Mr Milne was looking for personal information about himself, Angus Council was legally required to deal with his request under the terms of the DPA, not FOISA. Some elements of the information supplied under the DPA, such as the name of an individual mentioned in a memorandum, had to be blanked out to enable Angus Council to provide as much of the information as possible without disclosing the identity of the other individual concerned, while other information was withheld in line with exemptions under the DPA.

8. It was pointed out to Mr Milne that if his request could have been dealt with under FOISA, the same information would also have been withheld in accordance with section 38 of FOISA. This was because Angus Council would not be able to release personal information about another individual under FOISA where this would breach the provisions of the DPA. Angus Council confirmed to the investigating officer that disclosure of the third party personal data in question would have breached both the first and second data protection principles and that the information would therefore have been exempt from disclosure in terms of section 38(1)(b) of FOISA.

9. Since Mr Milne had made his original request under FOISA, he was informed of his right to review and Mr Milne made a request for review to Angus Council by fax, dated 27 June 2005. At that stage, Mr Milne provided a more detailed account of the information he was seeking.

10. Following a meeting of Angus Council’s Review Panel, which consisted of the Chief Executive of Angus Council and the Director of Law and Administration, a letter was issued to Mr Milne on 30 June 2005. This confirmed the authority’s decision that the information Mr Milne had previously requested had been provided to him in accordance with the DPA, and stated that none of the information concerning the Trading Standards documents that he had requested in his fax of 27 June 2005 was held by Angus Council. The notice informing Mr Milne that the information was not held by Angus Council complied fully with sections 17 and 19 of FOISA.

11. As regards the detailed description of the information Mr Milne had requested in his fax of 27 June 2005, Angus Council acknowledged that some of the information requested related to other individuals which could be covered by FOISA. However, it was confirmed by the Review Panel that none of that information was actually held by Angus Council as it had been destroyed in late 2004 in line with Angus Council’s records management procedures and the advice of the Scottish Criminal Cases Review Commission.

12. Mr Milne was advised that he might wish to contact the Scottish Criminal Cases Review Commission for the information he was seeking since the Commission had stated that it had retained copies of the information and documents provided to them by Angus Council in relation to a review concerning Mr Milne.

13. In its letter of 30 June 2005, Angus Council advised Mr Milne of his right to complain to the Scottish Information Commissioner if he was unhappy with the Review Panel’s decision on this matter in terms of FOISA. He was also advised of his right to complain to the Information Commissioner in England, who is responsible for the enforcement of the DPA, in relation to his request for information about himself. Mr Milne was unhappy with that response and applied to my Office for a decision on 16 July 2005. The case was then assigned to an investigating officer.

The Investigation

14. Mr Milne’s application for a decision was validated by establishing that he had made a written request for information to a Scottish public authority, and had applied to me only after requesting a review from the authority concerned.

15. Angus Council was contacted by my Office on 2 August 2005. The Council was asked to provide information that would allow the investigation to proceed and to comment on the issues raised by Mr Milne’s request in terms of section 49(3) of FOISA.

16. Angus Council responded on 16 August 2005, providing the requested information and comments on the case.

The Commissioner’s Analysis and Findings

17. To date, Mr Milne has made a number of applications to my Office for a decision. In each case, Mr Milne’s requests to public authorities were formulated in the following way:

“I require all information that relates to me, Edward Milne, and which includes minutes of meetings, internal memos, correspondence and e-mails.”

18. It is my view that this constitutes a request for all of the information that is held by the authority which is about Mr Milne. In other words, it is a request for personal information and should be dealt with under the terms of the DPA. Indeed, the long title of the DPA states that it is an Act to make provision for “the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.”

Sections 38(1)(a) and (b) of FOISA – personal information

19. Section 38(1)(a) of FOISA states that information is exempt information if it constitutes personal data of which the applicant is the data subject. This exemption is absolute – there is no requirement to consider the public interest.

20. The term “personal data” is defined in section 1(1) of the DPA as:

“data which relate to a living individual who can be identified: a) from those data, or b) from those data and from other information which is in the possession of or is likely to come into the possession of the data controller...”

21. The definition is subject to the interpretation contained in Durant v Financial Services Authority [2003] EWCA Civ 1746. In this decision, the Court of Appeal held that if information is to be viewed as personal data, the information has to be biographical in a significant sense, i.e. go beyond the recording of the individual’s involvement in a matter or event that has no personal connotations. The individual also has to be the focus of the information, rather than some other person with whom that individual may have been involved. The Court of Appeal summarised these two aspects as information affecting a person’s privacy whether in his personal or family life, business or professional capacity.

22. In my view, Mr Milne’s initial request clearly constituted a request for personal information and Angus Council was correct to consider such a request as being exempt from FOISA by virtue of section 38(1)(a) on the basis that it constituted a request for personal data of which the applicant was the data subject.

23. Mr Milne was advised by my office on a number of occasions that a request for information that relates to him is a request for personal information and that public authorities were correct to treat such requests under the DPA rather than FOISA. He was also advised to submit a subject access request under the DPA to the relevant public authorities who had invited him to do so in order to obtain the information he required.

24. In the case of Mr Milne’s request to Angus Council, he stated in his letter to the Council, dated 9 June 2005:

“While I know that the information is available under [the] Data Protection Act, I repeat my request and ask [you] to review my letter of 6/6/2005 under the Freedom of Information (Scotland) Act 2002.”

25. It should be noted that FOISA and the DPA are mutually exclusive, i.e. information that is available under one piece of legislation is not available under the other: the two pieces of legislation serve two entirely different purposes.

26. Where a request is made to a public authority for personal information relating to the individual making the request, that request must be dealt with under the DPA. This is to protect the privacy of individuals – the information is made available to that person only.

27. As mentioned above, under section 38(1)(a) of FOISA information is exempt if it constitutes personal data of which the applicant is the data subject. In other words, it is not possible for a person to obtain his or her own personal information under FOISA. This is because disclosure of information under FOISA is effectively disclosure to the world at large and the release by a public authority of an individual’s personal information into the public domain without their consent would constitute a breach of their privacy rights.

28. Similarly, where third party personal information is held to be exempt from disclosure under the DPA because it would breach one or more of the data protection principles, that information will also be exempt from disclosure under FOISA in terms of section 38(1)(b). This exemption is absolute in cases where disclosure of the information would breach any of the data protection principles.

29. Angus Council was asked by the investigating officer to provide information concerning its reference to the section 38(1)(b) exemption under FOISA in its letter to Mr Milne of 24 June 2005. Angus Council had stated in its letter that a person’s name had been blanked out in a copy of a memorandum that had been provided to Mr Milne under the terms of the DPA. This was because disclosure of the identity of the other individual concerned would have resulted in a breach of the first and second data protection principles.

30. Angus Council informed Mr Milne, in its letter of 24 June 2005, that if it had been possible to consider his request under FOISA the name of the other individual referred to above would not have been disclosed under that legislation either on the grounds that the personal information of a third party is exempt from disclosure under section 38(1)(b) of FOISA where the release of such information would breach any of the data protection principles.

31. The first data protection principle requires that data shall be processed fairly and lawfully and shall not be processed unless at least one of the conditions in Schedule 2 of the DPA is met. Angus Council informed the investigating officer that in this case none of the conditions in Schedule 2 would be satisfied and that disclosure of this data would therefore contravene the first principle. Angus Council also asserted that disclosure would also have breached the second data protection principle since information that had been withheld under the DPA would have been provided to the District Court on the understanding that it would only be used for the purposes of court action.

32. On the basis of the explanation provided by Angus Council, I am satisfied that, had it been possible to consider Mr Milne’s request under FOISA, the same information would have been withheld under section 38(1)(b) on the grounds that disclosure of the third party personal information would have breached the first and second data protection principles.

Information not held

33. As regards the information that Mr Milne had identified in his letter of 27 June 2005, the information listed generally concerned documents relating to legal proceedings which were held at Forfar Sheriff Court in 1989. Mr Milne had requested documents relating to these proceedings which, inter alia, concerned Trading Standards, the Scottish Grand Committee and the Scottish Criminal Cases Review Commission.

34. The investigating officer was informed by Angus Council that any documentation held by Angus Council which concerned these proceedings had been destroyed in line with Angus Council’s records management procedures in 2004.

35. This followed correspondence between Angus Council’s Environmental and Consumer Protection Department and the Scottish Criminal Cases Review Commission. In his letter of 15 November 2004, the Principal Trading Standards Officer at Angus Council had enquired if the Commission would indicate if it still had an interest in the records held by Angus Council which related to the legal proceedings involving Mr Milne. The Officer asked if the Commission was agreeable to the disposal of the records held by Angus Council since considerable time had elapsed since these proceedings were held in 1989.

36. The Scottish Criminal Cases Review Commission responded on 3 December 2004, stating that, in reviewing Mr Milne’s case, the Commission believed that the Trading Standards department of Angus Council had provided the Commission with copies of all material in its possession in connection with Mr Milne’s case.

37. It also stated that the Commission had concluded its review of Mr Milne’s case and had retained copies of information and documents relevant to the review. This included all copy papers received from Trading Standards, should Mr Milne exercise his right to apply to the Commission in the future. This enabled Angus Council to destroy the documentation in line with its records management procedures. Copies of the correspondence between the Principal Trading Standards Officer and the Scottish Criminal Cases Review Commission were provided to Mr Milne by Angus Council.

38. Mr Milne was advised that he might wish to contact the Scottish Criminal Cases Review Commission for the information he was seeking. This was because the Scottish Criminal Cases Review Commission had stated in its letter of 3 December 2004 that it had retained copies of information and documents provided to them by Angus Council in relation to a review concerning Mr Milne. Following the advice of Angus Council, Mr Milne subsequently made a request to the Scottish Criminal Cases Review Commission for this information and this will be dealt with in a separate decision.

39. On the basis of the evidence provided by Angus Council, I am satisfied that Angus Council does not hold the information in question. I am also satisfied that it did not hold the information at the time the request was made by Mr Milne.

Decision

I find that Angus Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in deciding to withhold personal information under section 38(1)(a) on the basis that Mr Milne’s request for all information relating to him constituted a request for personal data of which he was the subject and as such should be dealt with under the terms of the Data Protection Act 1998.

I also find that Angus Council complied with Part 1 of FOISA in stating that certain information requested by Mr Milne which concerned Trading Standards is not held by Angus Council, and this complied with section 17 of FOISA.

Kevin Dunion

Scottish Information Commissioner

13 December 2005

 

Link to PDF file of decision 075/2005 (61.8 kb)