Decision 163/2006 – Mr John Hardey and the Chief Constable of Strathclyde Police
Request for disclosure of a Police incident report relating to the applicant -Information withheld – section 38 – Personal Information – Commissioner upheld decision to withhold
Request for access to a police incident report relating to the applicant
Applicant: Mr John Hardey
Authority: The Chief Constable of Strathclyde Police
Case No: 200502888
Decision Date: 28 August 2006
Kevin Dunion
Scottish Information Commissioner
Facts
Mr Hardey asked the Chief Constable of Strathclyde Police (the Police) for a copy of a Police incident report concerning a complaint made against him. The Police responded by asking Mr Hardey to make a subject access request for the report under the Data Protection Act 1998 (the DPA). This decision was upheld by the Police on review.
Outcome
The Commissioner found that the Police complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in withholding the information requested from Mr Hardey.
Appeal
Should either the Police or Mr Hardey wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.
Background
1. On 16 June 2005, Mr Hardey asked the Police to provide him with an incident report detailing a complaint which had been made against him.
2. The Police acknowledged Mr Hardey’s letter on 28 June 2005 and indicated that Mr Hardey’s request would be considered under FOISA.
3. However, the Police subsequently wrote to Mr Hardey on 12 July 2005 to tell him that, after further consideration, they had established that his request would have to be dealt with by means of a subject access request under the DPA. The Police provided Mr Hardey with a subject access request form and explained some of the procedures involved in dealing with a subject access request.
4. Mr Hardey challenged the Police’s decision in respect of having to make a subject access request under the DPA in a letter dated 20 July 2005. This letter was a valid request for review under section 20 of FOISA.
5. The Police responded to Mr Hardey’s letter on 3 August 2005 and indicated that they would carry out a review of their decision and would respond to Mr Hardey within 20 working days.
6. The Police responded to Mr Hardey’s request for review on 18 August 2005. In this letter, the Police indicated that they had reviewed and modified their initial decision. The Police confirmed that they were relying on the exemption under section 38(1)(a) of FOISA to withhold the information from Mr Hardey on the basis that the information was personal information of which he is the subject. The Police also confirmed that they were relying on the exemption under section 25(1) of FOISA to withhold the information from Mr Hardey on the basis that he may be able to recover the information by other means.
7. On 19 October 2005, Mr Hardey applied to me for a decision as to whether the Police had breached Part 1 of FOISA in withholding the Police incident report. The case was subsequently allocated to an investigating officer.
The Investigation
8. Mr Hardey’s appeal was validated by establishing that he had made a valid information request to a Scottish public authority under FOISA and had appealed to me only after asking the Police to review their response to his request.
9. The investigating officer contacted the Police on 31 October 2005, in terms of section 49(3)(a) of FOISA, to advise the Police that an application had been made to the Commissioner and to invite its comments on the application. In addition, the Police were asked to provide an analysis of the exemption(s) under FOISA they had relied on in not releasing the information to Mr Hardey. The Police were also asked to provide the investigating officer with a copy of the information which had been withheld from Mr Hardey.
10. No response was received from the Police, and so an information notice was subsequently sent to the Police in terms of section 50 of FOISA on 24 November 2005 requiring them to provide me with the information requested. A full response was received from the Police shortly thereafter.
Submissions from Strathclyde Police
11. In their submissions to my Office, the Police added a number of additional exemptions which they wished to rely on to withhold the information from Mr Hardey. In all, the Police wished to rely on the exemptions contained in section 25(1), section 38(1)(a), section 38(1)(b), section 34(1)(a)(i) and sections 35(1)(a) and (b).
12. The exemptions contained in section 25(1), section 38(1)(a) and section 38(1)(b) (read in conjunction with section 38(2)(a)(i)) are absolute. The others are subject to the public interest test contained in section 2(1)(b) of FOISA. This means that even if the information falls within any of these exemptions, the information should still be released if, in all the circumstances of the case, the public interest in the disclosure of the information outweighs the public interest in maintaining the exemption. If the two are evenly balanced, the presumption should always be in favour of release.
Submissions from Mr Hardey
13. In his submissions to both the Police and to my Office, Mr Hardey has made it clear that he believes that he should have a right to access this information under FOISA and that he should not have to pay a fee to access this information (as the Police would ask him to do if he made a subject access request under the DPA).
The Commissioner’s Analysis and Findings
14. In their response to my Office, the Police provided a copy of the document which they had withheld from Mr Hardey together with an explanation of the exemptions they were relying on in not disclosing the information to Mr Hardey. In the circumstances, I will concentrate on the exemption contained in section 38(1)(a) of FOISA.
The application of Section 38(1)(a) – personal information
15. Section 38(1)(a) of FOISA exempts information if it constitutes personal data of which the applicant (i.e. Mr Hardy) is the data subject. In order to determine whether the report contains personal data, I have referred to the definition of personal data contained in section 1(1) of the DPA. This defines “personal data” as:
“data which relate to a living individual who can be identified –
a) from those data, or
b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.”
16. The interpretation of the decision in Durant v the Financial Services Authority (2003) EWCA CIV 1746 case is important in determining what constitutes personal data. In this decision, the Court of Appeal held that if information is to be viewed as personal data, the information has to be biographical in a significant sense, i.e. go beyond the recording of an individual’s involvement in a matter or event that has no personal connotations. The individual also has to be the focus of the information, rather than some other person with whom the individual has been involved. The Court of Appeal summarised these two aspects as information affecting a person’s privacy, whether in his personal or family life, business or professional capacity.
17. In their submissions to my Office, the Police have advised me that they relied on the exemption in section 38(1)(a) on the basis that the report contains the personal data of both the person making the complaint and of Mr Hardey himself, with Mr Hardey being the main focus of the report. The Police also commented that they consider the incident report as a file structured with reference to Mr Hardey and so only retrievable by him by means of a subject access request under section 7 of the DPA.
18. In looking at the information which has been withheld from Mr Hardey, it is clear that the information comprises a report which has information concerning Mr Hardey at its focus. The report relates to actions allegedly undertaken by Mr Hardey in his personal life. The report clearly identifies Mr Hardey as the subject of the report and I am satisfied that the report constitutes personal data of which Mr Hardey is the data subject.
19. The report also contains personal data about another individual, i.e. the complainer. However, I am satisfied that much of the personal data of the complainer is also the personal information of Mr Hardey, given that the definition of personal data in section 1(1) of the DPA explicitly includes “any expression of opinion about the individual”.
20. In considering the application of the exemption under section 38(1)(a) and the submissions from the Police together with the information which has been withheld from Mr Hardey, I am satisfied that the information in the report does contain personal data of which Mr Hardey is the subject and that the report is therefore exempt from release under section 38(1)(a) of FOISA.
21. The exemption in section 38(1)(a) is absolute and I am therefore not required to go on to consider whether the public interest lies in the information being released or withheld.
22. Given that I am satisfied that the information is exempt under section 38(1)(a) and section 38(1)(b), I will not go on to consider any of the other exemptions cited by the Police.
The application of section 38(1)(b) – personal information
23. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) of FOISA, exempts information if it constitutes personal data and the disclosure of the information to a member of the public (in this case, to Mr Hardey) would contravene any of the data protection principles set down in the DPA. This is an absolute exemption. I will consider this exemption insofar as it relates to the information about the complainer.
24. In justifying their use of the exemption to some of the information contained within the report, the Police have submitted that the information in question constitutes personal data relating to a living individual in the form of their personal details, together with personal recollections and opinions in relation to the allegations which have been made. The Police have indicated that if the information were to be released to a third party then this would contravene the first and second data protection principles.
25. Having considered the definition of personal data contained in section 1(1) of the DPA and having taken account of the ruling in Durant (see above), I agree that the information about the third party contained in the report is their personal data.
26. The first data protection principle states that personal data should be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 of the DPA (and, in the case of sensitive persona data, at least one of the conditions in Schedule 3 of the DPA) are met. The Police have argued that it would be unfair to release personal data about third parties to Mr Hardey.
27. I take the view that the person who made the complaint about Mr Hardey would have had no expectation that the information recorded about them would be released to him and agree with the Police that it would be unfair of them to release this information to Mr Hardey. Given that I have found that the release of the information would be unfair, I am required to find that the release of the information would breach the first data protection principle. As such, I am satisfied that the release of the information about the complainer is exempt in terms of section 38(1)(b) of FOISA.
Decision
I find that the Chief Constable of Strathclyde Police (the Police) dealt with Mr Hardey’s request for information in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA). The exemptions in section 38(1)(a) and section 38(1)(b) were relied upon correctly by the Police, and as a result section 1(1) was applied correctly.
Kevin Dunion
Scottish Information Commissioner
28 August 2006
Link to PDF file of decision 163/2006 (49.2 kb)
