Decision 162/2024: Information relating to Police Investigations and Review Commissioner report
Authority: Police Service of Scotland
Case Ref: 202400604
Summary
The Applicant asked the Authority for information relating to a report completed by the Police Investigations and Review Commissioner regarding him. The Authority refused to confirm nor deny whether the information existed or was held. The Commissioner investigated and found that the Authority was entitled to refuse to confirm nor deny whether the information existed or was held.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(i) (Effect of exemptions); 18(1) (Further provisions as respects responses to request); 38(1)(a) and (5) (Definitions of “the data protection principles”, “data subject”, “personal data” and “the UK GDPR”); 47(1) and (2) (Application for decision by Commissioner
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (5) and (14) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 6 November 2023, the Applicant made a request for information to the Authority relating to a report completed by the Police Investigations and Review Commissioner (PIRC) regarding him. The Applicant asked for:
1) Name and contact details of the duty lawyer spoken to when I was in custody.
2) Record of an interview similar to that conducted with witnesses in pursuant of Article 6a, 6b, and 6d of the European Convention on Human Rights.
3) You mentioned and confirmed contact with [named doctor] in your report and I am seeking date of contact, time, transcript of the interview whether by electronic means or physical presence.
4) In your letter dated 22/12/22 you stated you were awaiting critical information from the Doctor I was treated by while in hospital, you were unable to comply by the tight timescales of the PIRC on that occasion and requested a slight delay, could you verify or confirm the date and time of contact with the [specified] hospital asking you to wait upon request of this information from them?
5) Could you also confirm point of contact and person you sought contact with who confirmed the delay to provide information in relation to your request?
2. The Authority failed to respond.
3. On 2 January 2024, the Applicant wrote to the Authority requesting a review in respect of its failure to respond to his request within the timescale set down by FOISA.
4. The Applicant did not receive a response to his requirement for review.
5. On 22 March 2024, the Applicant wrote to the Commissioner, stating that he was dissatisfied with the Authority’s failure to respond and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. This resulted in the Commissioner issuing Decision 091/2024, where he found the Authority had failed to respond to the Applicant’s request for information and requirement for review within the timescales laid down by sections 10(1) and 21(1) of FOISA.
6. The Authority notified the Applicant of the outcome of its review on 18 April 2024. The Authority apologised that it had failed to respond to the Applicant’s request within the timescales set down by FOISA. The Authority refused to confirm nor deny whether it held the requested information, relying on section 18(1) of FOISA in conjunction with section 38(1)(a) (Personal information) of FOISA.
7. On 25 April 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he considered that it had incorrectly applied section 18 of FOISA.
Investigation
8. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
9. On 17 May 2024, the Authority was notified in writing that the Applicant had made a valid application. The case was then allocated to an investigating officer.
10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions.
11. The Authority provided its comments and further submissions were also sought and obtained from the Applicant.
Commissioner’s analysis and findings
12. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Section 18(1) – “neither confirm nor deny”
13. The Authority refused to confirm nor deny whether it held any information falling within the scope of the Applicant’s request.
14. Section 18(1) of FOISA allows public authorities to refuse to confirm nor deny whether they
hold information in the following limited circumstances:
- a request has been made to the authority for information which may or may not be held by it; and
- if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and
- the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
15. In any case where section 18(1) of FOISA is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that he is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
16. In this case, the Authority submitted that, if it held any information falling within scope of the Applicant’s request, it would be exempt from disclosure under section 38(1)(a) of FOISA.
17. The Commissioner must first, therefore, consider whether the Authority could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and were held.
Section 38(1)(a) – Personal information of the data subject
18. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject. The fact that it is an absolute exemption means that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.
19. This exemption exists under FOSIA because individuals have a separate right to make a request for their own personal data under the United Kingdom General Data Protection Regulation (the UK GDPR). This route is more appropriate for individuals accessing their personal data, as it ensures it is disclosed only to the individual. Information disclosed under FOISA is considered to be disclosed into the public domain. Section 38(1)(a) does not deny individuals a right to access information about themselves, but ensures that the right is exercised under the correct legislation (the UK GDPR, and previously the GDPR) and not under FOISA.
20. Personal data are defined in section 3(2) of the DPA 2018 which, read with section 3(3), incorporates the definition of personal data in Article 4(1) of the UK GDPR (see Appendix 1):
“… any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”
21. The Authority explained that the information sought by the Applicant, if held, would comprise his own personal data as he was seeking information relating to his arrest and subsequent time spent in custody. The Authority submitted that to publicly confirm whether or not the information requested existed and was held would therefore breach the Applicant’s rights under the DPA 2018.
22. The Commissioner has considered the terms of the Applicant’s request for information. Having done so, he accepts that the information requested, if it existed and was held, would comprise the Applicant’s own personal data, as defined by section 3(2) of the DPA 2018.
23. Overall, in the circumstances, the Commissioner is therefore satisfied that the information requested, if it existed and was held, would be exempt from disclosure under section 38(1)(a) of FOISA.
24. Having accepted that the Authority could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(a) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether the Authority was entitled to conclude that it would be contrary to the public interest to reveal whether the information exists or is held.
The public interest - section 18(1)
25. The Applicant was invited to provide specific public interest arguments. The Applicant stated that he considered the Authority cannot rely on section 18 of FOISA to prevent the disclosure of the requested information as the information had already been publicly disclosed via the PIRC investigation.
26. The Authority explained that there are occasions where it is not in the public interest to confirm or deny that specific information exists or is held. In this case, the Authority did not accept that it was in the public interest to confirm or deny whether the information requested existed or was held given the overwhelming public interest in protecting individuals’ right to privacy and the expectation of confidence that the public have in the Authority appropriately processing their data.
27. The Authority noted that disclosure under FOISA is to the world at large, not solely to the person to whom the data relates. The Authority reiterated that it had advised the Applicant of his right of access to his personal data under the DPA 2018.
28. Having considered the arguments submitted by both parties, the Commissioner is satisfied, in all the circumstances of this case, that it would have been contrary to the public interest for the Authority to disclose whether the information requested by the Applicant existed or was held, given that it would constitute his own personal data and disclosure would breach his rights under the DPA 2018.
29. As a result, the Commissioner is satisfied that the Authority was entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether it held the information requested by the Applicant or whether such information existed.
Decision
The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the
Applicant.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Cal Richardson
Deputy Head of Enforcement
5 August 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
…
(e) in subsection (1) of section 38 –
(i) paragraphs (a), (c) and (d); and
…
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
…
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018; …
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c);
and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
…
…
(5) “Data subject” means the identified or identifiable living individual to whom personal data relates.
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
