Decision Notice 094/2024: Information about telephone use in prisons
Authority: Scottish Prison Service
Case Ref: 202200802
Summary
The Applicant asked the Authority for information about the use of communal and in-cell telephones in prisons. The Authority disclosed some information and provided advice that other information was not held. The Commissioner investigated and found that the Authority had partially complied with FOISA in responding to the Applicant. In particular, the Commissioner found that the Authority failed to advise the Applicant that some of the information he had requested was otherwise accessible to him.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 16(1) (Refusal of request); 17(1) (Notice that information is not held); 25(1) (Information otherwise accessible); 47(1) and (2) (Application for decision by Commissioner)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 14 April 2022, the Applicant made a request for information to the Authority. He asked for the following information:
(i) Disciplinary Hearing guidance to staff on how to manage a breach of discipline contrary to paragraph 27D of Schedule 1 to the Prisons and Young Offenders Institutions (Scotland) Rules 2011 “fails without reasonable excuse to return an authorised personal communication device to an officer as ordered in accordance with rule 62A(10) (fails to return authorised mobile when ordered to do so)”.
(ii) What security measures are in place to prevent third parties from hacking communal and in-cell telephones and accessing personal data.
(iii) What security measures are in place to prevent third parties from using communal and in-cell telephones.
(iv) A breakdown per establishment of how many incidents of an in-cell telephone being hacked by a third party (e.g. by prisoner(s)) are recorded
(v) List of punishments imposed per establishment for a breach of rule 62A(9)(a) of the Prison Rules 2011 since coming into force.
(vi) List of punishments imposed per establishment for a breach of rule 62A(10) of the Prison Rules 2011 since coming into force.
(vii) A copy of the Scottish Minister’s (sic) direction allowing the Governor to restrict or withdraw the entitlement to use and in-cell telephone from a prisoner.
2. On 25 April 2022, the Authority provided information in response to parts (ii), (v), (vi) and (vii) of the request. For part (iii) of the request, the Authority stated that this was a “Repeat question” and for parts (i) and (iv) of the request, the Authority gave the Applicant notice that no information was held.
3. On 10 May 2022, the Applicant wrote to the Authority requesting a review of its response. He was dissatisfied that the Authority’s response did not address the questions he had asked and he did not believe that the information he had requested had been provided by the Authority.
4. The Authority notified the Applicant of the outcome of its review on 6 June 2022. It advised the Applicant that it had carried out further searches and did not hold any information falling within the scope of requests (i), (ii), (iii) and (iv). The Authority provided information in relation to requests (v), (vi) and (vii).
5. On 18 July 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because it had not provided him with the information he had requested.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 21 September 2022, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments.
8. The case was subsequently allocated to an investigating officer. The investigating officer contacted the Authority and asked it to explain its response to the Applicant’s requirement for review and the dissatisfaction stated in the Applicant’s application to the Commissioner.
Commissioner’s analysis and findings
9. The Commissioner has considered all the submissions made to him by the Applicant and the Authority.
Identity of the requester
10. During the investigation, the Authority submitted that it considered these requests were instigated, not by the Applicant, but by a known third party who was sending the requests to the Applicant, and asking him to submit them in his own name. The Authority questioned the validity of this method, whereby the Applicant was essentially being used as a post-box, in order that the known third party can obtain information he normally would not have access to.
11. The Commissioner acknowledges the concerns of the Authority but in this case, the request, requirement for review and application were all made in the name of the Applicant. Furthermore, it is possible that the Applicant has asked this third party to help him frame his requests and assist him with the FOI process. The Commissioner has not been provided with any evidence that proves that the Applicant is not the true requester. In the circumstances, the Commissioner is satisfied that the application is valid and that the person who made the request is the true applicant.
Section 1(1) – General entitlement
12. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications in section 1(6) are not applicable in this case.
13. The information to be given is that held by the authority at the time the request is received, as defined by section 1(4). This is not necessarily to be equated with the information that an applicant believes an authority should hold. If no relevant information is held by the authority, section 17(1) of FOISA requires the authority to give the applicant notice to that effect.
14. It is important to bear in mind that this obligation relates to information actually held by an authority when it receives the request, as opposed to information an applicant believes the authority should hold.
15. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner’s role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
Requests (i), (ii), (iii) and (iv)
16. For each of these requests, the Authority notified the Applicant that it did not hold the information he had requested and it maintains that no information is held.
Request (i)
17. In request (i) the Applicant asked for Disciplinary Hearing guidance to staff on how to manage a breach of discipline contrary to paragraph 27(D) of Schedule 1 to the Prisons and Young Offenders Institutions (Scotland) Rules 2011 (‘the 2011 Rules’) i.e. “fails without reasonable excuse to return an authorised personal communication device to an officer as ordered in accordance with rule 62A(10)(fails to return authorised mobile when ordered to do so)”. The Authority provided the Applicant with a copy of the Disciplinary Hearing Guidance and explained that there was no specific guidance for every disciplinary charge.
18. The Applicant argued that the information requested had not been provided because the Authority “issue[s] written guidance on all disciplinary charges regarding the evidence that is required before an adjudicator can be satisfied of guilt beyond any reasonable doubt, i.e. the facts that must be established. Because adjudicators are not legally qualified such guidance is necessary to prevent legal challenges”.
19. In its submissions, the Authority explained that a disciplinary hearing would consider any charge brought against a prisoner for a breach of the 2011 Rules. The Disciplinary Hearing guidance provided advice to Authority staff on what evidence was required for each charge in schedule 1 to the 2011 Rules. The Authority stated that “there is no guidance to the additional charges brought in under The Prisons and Young Offenders Institutions (Coronavirus)(Scotland) Amendment Rules 2020”, and it maintained that its original response to request (i) was correct as guidance was not available on all charges under schedule 1 to the Prison Rules.
20. The Authority supplied the Commissioner with a full copy of its Guidance on Disciplinary Hearings and confirmed that this was the up to date version, published in June 2018, and that a copy had been provided to the Applicant.
21. The Applicant’s question was specific: it asked for Disciplinary Hearing guidance to staff on how to manage a breach of discipline contrary to paragraph 27D. In its review, the Authority confirmed that this information was not held and that no amended guidance with added charges existed. Having considered all of the evidence and submissions provided here, including the copy of the Disciplinary Guidance, the Commissioner is satisfied that the Authority’s response to request (i) complied with Part 1 of FOISA.
Request (ii)
22. Request (ii) asked for details of any security measures in place to prevent third parties from hacking communal and in-cell telephones and accessing personal data. The Authority initially responded with an explanation about PIN Phone access and the Pre-allowed Numbers (PAN) List. At review, the Authority stated that “hacked” meant that a “cell phone has been infiltrated by someone” and confirmed there was no information held “on hacking in cell phones”. The Applicant was dissatisfied that the information had not been provided.
23. The Authority submitted that only certain establishments (which they specified) had in-cell telephony, and that as these establishments “are operated by contractors” the Authority did not hold the requested information. The Authority commented that during the Covid-19 pandemic it introduced Authorised Personal Communication Devices (APCDs) to prisoners to facilitate family contact and wellbeing.
24. The Authority explained that it had provided the Applicant with a definition of “hacking” in its initial response, as the definition of hacking was necessary to understand what "security measure" should be taken to prevent its occurrence. Its response had explained that hacking was an attempt by an external party to illegally gain remote access to phone calls and messages. The Authority noted that “hacking” differs from tampering. The Authority submitted that it was the responsibility of the telephony providers to ensure that adequate anti-hacking security measures were in place. The Authority confirmed that it was relying on section 17(1) of FOISA in relation to request (ii) and that no information was held.
25. The Commissioner is satisfied that the Authority took a reasonable interpretation of the Applicant’s request, and that no recorded information was held by the Authority at the time of the request. The Commissioner also notes that the Authority provided the Applicant with an explanation of why the information asked for in request (ii) was not held. Given this, the Commissioner is satisfied that the Authority’s response to request (ii) complied with Part 1 of FOISA.
Request (iii)
26. In request (iii), the Applicant asked what security measures were in place to prevent third parties from using communal and in-cell telephones. The Authority initially responded that this was a repeat request, but at review, it stated that no further information was held.
27. The Authority explained that the security measures for using communal phones are those which the Applicant described in his own application to the Commissioner: each prisoner has a unique PIN, which when entered only allows access to an approved personal phone list associated to that PIN. The Authority submitted that the Applicant’s status meant that he was already aware of these measures and the information was already otherwise accessible to him.
28. During the investigation the Authority altered its position. It initially notified the Commissioner that it was relying on section 25 of FOISA for request (iii), but it later confirmed that it was not applying any exemption to this request.
29. The Commissioner acknowledges the Authority’s comments about the Applicant’s status which means he will be personally aware of the security measures around the use of communal and in-cell phones. He also notes that in its review outcome, in response to request (ii), the Authority provided the Applicant with information that appears to fulfil request (iii), in that it explained about unique PINs and Pre-Allowed Numbers (PAN). He considers that the Authority provided the Applicant with information that fulfilled this request in its review outcome, albeit under the wrong request number.
30. The Commissioner also notes that in his application, the Applicant explains that he is looking for the measures that are in place to prevent a third party from getting hold of another prisoner’s PIN and accessing their PAN list. The Commissioner considers this question to be a separate follow-up request as it is not simply seeking the security measure in place, it is seeking information on what additional security measures have been put in place to prevent individuals from circumventing the existing security measures.
31. On balance, the Commissioner is satisfied that the Authority has complied with request (iii) although he considers that in future, the Authority should endeavour to respond to the numbered requests put forward by the requester, in order to prevent confusion.
Request (iv)
32. Request (iv) sought “a breakdown per establishment of how many incidents of an in-cell telephone being hacked by a third party (e.g. by prisoner(s)) are recorded”. In its response, the Authority gave the Applicant notice, under section 17(1) of FOISA, that no information was held. The Applicant challenged this response, and commented that the Authority reported to ITV news on 21 September 2021 that (since August 2020) 728 in-cell telephones had been "hacked". The Applicant also argued that all such incidents would be subject to disciplinary proceedings, and recorded.
33. At review, as noted above, the Authority explained that ‘hacked’ meant that a cell phone had been infiltrated by someone and it gave the Applicant notice that there was no information of this nature available.
34. In its submissions to the Commissioner, the Authority reiterated that in-cell phones were only available in two prisons and it was “for their contractor to provide security assurance” and that the information was not held by the Authority. The Authority submitted that it was not responsible for the contents or presentation of newspaper articles. However, in reference to the article, the Authority commented that it presented information on APCDs that had been tampered with by prisoners as opposed to being hacked by an external party.
35. Given the explanations provided by the Authority, the Commissioner is satisfied that it holds no information that falls within the scope of request (iv). However, he considers that it would have been helpful if the Authority had provided the Applicant with the explanation it gave to his office, which suggested that the newspaper article was referring to APCDs that had been tampered with, rather than cell phones which had been “hacked”. Overall, the Commissioner is satisfied that the Authority’s response to request (iv) complied with Part 1 of FOISA.
Requests (v) and (vi)
36. The Authority argued that it provided the Applicant with information falling within the scope of requests (v) and (vi) and that it has complied with both of these requests.
Request (v)
37. Request (v) sought a list of punishments imposed per establishment for a breach of rule 62A(9)(a) of the Prison Rules 2011 since coming into force. (Rule 62A(9(a)) provides that “a prisoner must not tamper with any authorised personal communication device or cause someone else to tamper with the device”). In its response, the Authority provided the Applicant with a list of punishments, by establishment, for a breach of rule 62A(9)(a) of the Prison Rules 2011. The Authority later provided the Commissioner with a copy of this information to demonstrate its compliance with the request.
38. However, the Applicant remained dissatisfied and he referred to a media article on prisoner misuse of devices which resulted in the removal of mobile devices. He commented that “no punishment is listed from any prison within the Authority’s estate imposing the suspension of the entitlement to possess and use an ACPD. I wish the [Authority] to explain this.”
39. The Commissioner is satisfied that the list of punishments provided to the Applicant fulfils the terms of request (v), and that the Authority has complied with Part 1 of FOISA in its handling of this request.
40. The Commissioner recognises that the Applicant may have been seeking a list of the punishments that had been used, but he considers that the Authority’s interpretation of the request was reasonable.
41. In its comments to the Commissioner, the Authority explained that where any person intentionally damages prison property this would constitute a beach of discipline under Rule 110 of the Prison and Young Offenders Institutions (Scotland) Rules 2011. Under Rule 62(10) a prisoner must return any authorised personal communication device in the prisoner’s possession to an officer where the officer orders the prisoner to do so. Failure to do so may result in disciplinary proceedings or the matter being reported to the police. The Authority explained that Rule 62(10) already allows for the communication device to be removed in response to a breach, and the punishments previously provided to the Applicant are those which may follow any disciplinary proceedings arising from such breaches.
The Commissioner considers that it may have been helpful if the Authority had made this clear to the Applicant, but he does not require the Authority to take any further action in relation to request (v) and he is satisfied that its response complied with Part 1 of FOISA.
Request (vi)
42. In request (vi) the Applicant asked for a list of punishments imposed per establishment for a breach of rule 62A(10) of the Prison Rules 2011 since coming into force. Rule 62A(10) provides that a prisoner must return any authorised personal communication device in the prisoner's possession to an officer where the officer orders the prisoner to do so.
43. In its response, the Authority provided the Applicant with a list of punishments per establishment for breaching rule 62A(10). However, the Applicant remained dissatisfied and argued that the information had not been provided to him.
44. During the investigation, the Authority provided the Commissioner with a copy of the information it had disclosed to the Applicant. The Commissioner is satisfied that this information fell within the terms of this part of the Applicant’s request and that the Authority complied with Part 1 of FOISA when responding to request (vi).
Section 25(1) of FOISA
45. Under section 25(1) of FOISA, information which an applicant can reasonably obtain other than by requesting it under section 1(1) of FOISA is exempt information. The exemption in section 25(1) is absolute, in that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.
Request (vii)
46. In request (vii), the Applicant asked for a copy of the Scottish Ministers’ direction “allowing the Governor to restrict or withdraw the entitlement to use and in-cell telephone from a prisoner.” The Authority referred to an attached direction (from the Scottish Ministers) allowing the Governor to restrict or withdraw in cell telephone entitlement.
47. The Applicant was not satisfied with this response and he argued that the Authority had not provided him with the information he had requested. He argued that the Authority was unable to specify the Direction “because no Direction has been provided”. He further commented that “a rule is not a Scottish Minister's direction, and the latter is the information requested.”
48. In its review, the Authority provided the Applicant with a copy of GMA 031A/20 'The Prisons and Young Offenders Institutions (Coronavirus)(Scotland) Amendment Rules 2020: Rule 62: Communication by Communal & In-Cell Telephones, Rule 62A: Communication by Authorised Personal Communication Device and associated Direction.'
49. In its submission to the Commissioner, the Authority stated that “the Direction(s) requested is already accessible to [the Applicant], therefore the Authority wishes to apply section 25 to his request”. The Authority explained that the Direction(s) to the rules are available along with a copy of the Prison Rules, which is kept in each of the halls in all of the Authority’s establishments. It submitted that these documents are available for prisoners on request and a room can be made available for them to read and take notes if required, but they cannot be removed. The Authority also submitted that it provided the Applicant with a copy of GMA027-20, which concerns the Prisons and Young Offenders Institutions (Coronavirus)(Scotland) Amendment Rules 2020 in its review outcome, and it argued that this document contains information falling within the scope of his request.
50. The Authority added that “all Prisoners are aware that the prison library is the first place to go for prison related reference material.”. Additionally, it submitted that the Applicant “has been consistently reminded that much of the information requested is already access(ible) to him”.
51. Although the Authority would not provide the Applicant with a copy of the Direction itself, the information contained therein and further supplementary information considered to be within the scope of the request was provided within GMA 027A-20 and the appendix. The Authority submitted that it was relying on section 25(1) in response to request (vii).
52. The Authority provided the Commissioner with a copy of GMA027-20, and he notes that it does contain information falling within the scope of request (vii). Overall, the Commissioner is satisfied that information falling within the scope of request (vii) could be reasonably obtained by the Applicant, other than by requesting it under section 1(1) of FOISA, and he finds that section 25(1) of FOISA applies to this request. He accepts that the information is held in all prison establishments and was accessible to the Applicant without the need for him having to request it under FOISA. However, it is clear that the Authority did not inform the Applicant in writing (and in response to this part of his information request) that the information was otherwise accessible in terms of section 25 of FOISA.
53. Section 16(1) of FOISA requires an Authority to give the requester notice in writing (a “Refusal notice”) when it applies any exemption covered by Part 2 of FOISA. The Commissioner finds, by not providing the Applicant with a Refusal Notice, explaining that the information was held in each hall in the establishment and could be accessed by the Applicant without making a request under section 1(1) of FOISA, the Authority has not complied with section 16(1) of FOISA.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA).
The Commissioner finds that by giving the Applicant notice that it did not hold information falling within the scope of requests (i), (ii), (iii) and (iv) and by providing the Applicant with information that fulfilled requests (v) and (vi), the Authority complied with Part 1 of FOISA. However, by failing to provide a refusal notice, under section 16(1) of FOISA, that relied on section 25(1) of FOISA for request (vii), the Authority failed to comply with Part 1.
The Commissioner does not require the Authority to take any action in respect of this failure in response to the Applicant’s application.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
David Hamilton
Scottish Information Commissioner
21 May 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
(a) section 25;
…
…
16 Refusal of request
(1) Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-
(a) discloses that it holds the information;
(b) states that it so claims;
(c) specifies the exemption in question; and
(d) states (if not otherwise apparent) why the exemption applies.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
11
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
(2) Subsection (1) is subject to section 19.
(3) Subsection (1) does not apply if, by virtue of section 18, the authority instead gives the applicant a refusal notice.
…
25 Information otherwise accessible
(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.
(2) For the purposes of subsection (1), information-
(a) may be reasonably obtainable even if payment is required for access to it;
(b) is to be taken to be reasonably obtainable if-
(i) the Scottish public authority which holds it, or any other person, is obliged by or under any enactment to communicate it (otherwise than by making it available for inspection) to; or
(ii) the Keeper of the Records of Scotland holds it and makes it available for inspection and (in so far as practicable) copying by,
members of the public on request, whether free of charge or on payment.
(3) For the purposes of subsection (1), information which does not fall within paragraph (b) of subsection (2) is not, merely because it is available on request from the Scottish public authority which holds it, reasonably obtainable unless it is made available in accordance with the authority's publication scheme and any payment required is specified in, or determined in accordance with, the scheme.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
12
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
