Decision 181/2024: Police match reports for Scottish Premiership games
Authority: Police Service of Scotland
Case Ref: 202200394
Summary
The Applicant asked the Authority for three police match reports from specified Scottish Premiership football matches. The Authority informed the Applicant that it did not hold one of the reports and disclosed redacted versions of the other two, withholding information it considered was personal data and/or would otherwise prejudice the prevention or detection of crime. The Commissioner investigated and found that the Authority correctly withheld most of the information, but the remainder was wrongly withheld. The Commissioner required the Authority to disclose this information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) and 2(e)(ii) (Effect of exemptions); 35(1)(a) and (b) (Law enforcement); 38(1)(b), (2A)(a), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner) United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data” (Definitions); Article 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing); 10 (Processing of personal data relating to criminal convictions and offences)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d) and (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data); 10(4) and (5) (Special categories of personal data and criminal convictions data etc data); 11(2) (Special categories of personal data etc: supplementary); Schedule 1, Part 3(32) (Additional conditions relating to criminal convictions etc.)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 10 December 2021, the Applicant made a request for information to the Authority. They asked for police reports from three Scottish Premiership games:
(i) Aberdeen v Motherwell (6 November 2021)
(ii) Dundee United v Aberdeen (20 November 2021)
(iii) Aberdeen v St Mirren (4 December 2021).
2. The Applicant subsequently clarified their request as seeking the report written by the matchday commander reflecting on the policing operation before, during and after the game.
3. The Authority responded on 18 January 2022. The Authority issued a notice, under section 17 of FOISA, that it did not hold a report for Aberdeen v St Mirren as there had been no police presence at that match. The Authority disclosed redacted copies of the two remaining match reports (each comprising four sections), withholding information under, variously, sections 30(c) 31(1) (35(1)(a) and (b), 38(1)(b) and 39(1).
4. On 7 February 2022, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that they were dissatisfied with the decision because:
- they disagreed that anyone planning future crime could again an advantage from disclosure of match report information withheld under sections 35(1)(a) and (b) of FOISA, particularly where this related to policing and stewarding numbers
- matchday commanders across the UK routinely shared narrative information from match reports to increase public awareness of policing efforts around football (including in documentaries and social media videos)
- the Authority had withheld “entire sections” of the match report under 38(1)(b)
- the Authority had withheld the number of stewards deployed, individual crime reference numbers and types of drugs detected under section 38(1)(b), when they did not consider this information would identify living individuals
- they disagreed, where the Authority had withheld information in a “types of chanting” field under section 31(1), that information relating to a song could relate to, or impact on, the safeguarding of national security
- they considered, where the Authority had withheld information relating to policing numbers under section 39(1), that disclosure would not endanger the physical or mental health or safety of an individual.
5. The Authority notified the Applicant of the outcome of its review on 16 March 2022. The Authority upheld most of the exemptions it originally applied, but disclosed crime reference numbers previously withheld from the Applicant. The Authority also, in one instance, substituted its reliance on sections 38(1)(b) with 35(1)(a) and (b) of FOISA in relation to stewarding numbers.
6. On 4 April 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated they were dissatisfied with the outcome of the Authority’s review because they considered the Authority had incorrectly applied the exemptions at sections 31(1), 35(1)(a) and (b), 38(1)(b) and 39(1) of FOISA, and, that, where applicable, the public interest favoured disclosure of the information requested.
Investigation
7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
8. On 9 May 2022, the Authority was notified in writing that the Applicant had made a valid application and the case was subsequently allocated to an investigating officer.
9. The Authority was also asked to send the Commissioner the information withheld from the Applicant.
10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These focused on the Authority’s justification for applying the exemptions it had and its considerations regarding the public interest test.
11. The Applicant was also provided with an opportunity to submit any further comments as to why they considered it was in the public interest for the requested information to be disclosed and their legitimate interest in the personal information withheld.
12. During the course of the investigation, the Authority disclosed revised copies of the redacted match reports, where it provided further information within Section 2.
13. The Applicant subsequently confirmed that they were content for the Commissioner’s decision to be restricted to the information still withheld within Section 3 of the redacted match reports under the exemptions in sections 35(1)(a) and (b) and 38(1)(b) of FOISA (though they were content to exclude “specific personal data”, like names and addresses).
Commissioner’s analysis and findings
14. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
The information disclosed during the investigation
15. The Authority originally withheld information in Section 2 of both match reports under, variously, the exemptions in sections 31(1), 35(1)(a) and (b) and 38(1)(b) of FOISA.
16. During the investigation, the Authority withdrew its reliance on sections 31(1) and 38(1)(b) in relation to this information and to a small amount of this information withheld under section 35(1)(a) and (b) of FOISA and disclosed updated copies of both match reports to the Applicant.
17. As the Authority disclosed further information to the Applicant during the investigation, the Commissioner must find that the Authority failed to comply with section 1(1) of FOISA.
Section 38(1)(b) – Personal information
18. Section 38(1)(b), read in conjunction with section 38(2A)(a), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018, and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.
19. In this case the Authority applied the exemption in section 38(1)(b) as read with section 38(2A)(a) to information within Section 3 of the match reports that it considered to be personal data.
Is the information personal data?
20. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.
21. Section 3(3) of the DPA 2018 defines “identifiable living individual” as “a living individual who can be identified, directly or indirectly, in particular with reference to –
- an identifier such as a name, an identification number, location data or an online identifier, or
- one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”
22. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
23. In the case of Breyer v Bundesrepublik Deutschland the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified. When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain – if the risk of identification is insignificant, the information will not be personal data.
24. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner considers that the same rules will apply. In accordance with Recital 26 of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, taking into consideration the available technology at the time of processing and technological developments.
25. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals. In its review response the Authority argued that any information that could cause an individual to be identified was protected by section 38(1)(b) of FOISA.
26. The Authority explained that it had withheld information within the match reports detailing specific incidents and dealings with individuals. The Authority argued that disclosure of locations and times, with a description of the incidents themselves, would render the individuals concerned identifiable given the relatively small number of offences committed during each match.
27. The Applicant considered that it was unreasonable for the Authority to redact “large swathes” of Section 3 because disclosure could cause an individual to be identified. The Applicant accepted that the crime reference numbers could identify individuals when cross-referenced with other information, but argued the very fact the Authority had disclosed crime reference numbers proved that the information still withheld as personal information could not, and must not, identify a living individual.
28. The Commissioner considers that there is information relating to three categories of individual in the withheld information:
(i) individuals involved in criminal, or potentially criminal, offences given a crime reference number by the Authority
(ii) individuals involved in criminal, or potentially criminal, offences not given a crime reference number by the Authority
(iii) police and stewarding staff involved in the above incidents
29. As rehearsed at paragraph 13, the Applicant was content to exclude specific personal data from the Commissioner’s decision. There are no other direct identifiers within the withheld information.
30. In seeking, then, to determine whether it is possible for individuals to be identified indirectly from the withheld information, the Commissioner has taken into account the description of the specific incidents, the number of fans who attended, media coverage and whether individual incidents correspond to the crime reference numbers disclosed to the Applicant.
31. The Commissioner has also given regard to the guidance published by the UK Information Commissioner’s Office on indirect identifiability . Specifically (at paragraph 30):
“You should consider what means are reasonably likely to be used to identify the individual … You should assume that you are not looking just at the means reasonably likely to be used by an ordinary person, but also by a determined person with a particular reason to want to identify individuals. For example, investigative journalists…”
Category (i)
32. Having examined the withheld information, the Commissioner considers that, even in the absence of a direct identifier, information relating to three incidents (taken in each case with its crime reference number and, in two instances, media reporting at the time) could, were it to be disclosed, lead to a realistic causal chain of identification of living individuals.
33. The Commissioner is therefore satisfied that the withheld information which relates to individuals described as having committed criminal offences in relation to three specific incidents solely (with an allocated crime reference number), could permit identification of those specific living individuals. The Commissioner is also satisfied that this information is biographical in nature (in that it relates to individuals in the context of specific incidents) and is personal data.
34. For the remaining incidents, despite their possessing a crime reference number, the Commissioner is not satisfied - given the commonplace nature of the offences described (particularly in the context of football matches attended by thousands of individuals) - that disclosure of the information could lead to a realistic causal chain of identification of living individuals (in the absence of a direct identifier).
Category (ii)
35. Having examined the withheld information, the Commissioner does not consider that there is a realistic causal chain of identification in relation to these individuals.
36. There are no direct identifiers, no crime reference numbers and, in the context of football matches and the number of fans in attendance, the incidents described are so unremarkable and general as to render identification of specific living individuals unlikely.
Category (iii)
37. Having examined the withheld information and conducted his own searches, the Commissioner does not accept that descriptions of the incidents in which policing and stewarding staff were involved would be likely, given the unremarkable nature of the incidents, to identify a living individual or individuals.
38. Consequently, the Commissioner does not consider this information to be personal data.
The Commissioner’s view
39. In summary, the Commissioner accepts that the following withheld information is personal data as defined in section 3(2) of the DPA 2018:
(i) three incidents with an allocated crime reference number (category i)
40. However, in the absence of persuasive arguments from the Authority, the Commissioner does not accept that the remainder of the withheld information in relation to individuals in categories (i), (ii) and (iii) is personal data, as defined in section 3(2) of the DPA 2018, on the basis that the risk of identification is insignificant.
41. The Commissioner must therefore find that the Authority was not entitled to withhold this information under section 38(1)(b) of FOISA.
42. Where the Authority has also relied on the exemption in sections 35(1)(a) and (b) of FOISA to withhold this information, the Commissioner considers this further below.
Criminal offence data
43. For the information he is satisfied is personal data, the Commissioner is also satisfied that it constitutes criminal offence data.
44. Information relating to criminal convictions and offences (including suspicion or allegations of criminal activity) is given special status in the UK GDPR: Article 10 makes it clear that the processing of this type of personal data can be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of the data subjects.
45. Section 11(2) of the DPA 2018 makes it clear that personal data relating to criminal offences include personal data relating to the alleged commission of offences. Having reviewed the withheld information, the Commissioner is satisfied that the personal data requested falls within this definition (particularly since it is held in the context of official reports relating to policing).
46. Criminal offence data can only be processed if one of the stringent conditions in Parts 1 to 3 of Schedule 1 to the DPA 2018 can be met (section 10(5) of the DPA 2018).
47. “Processing” of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
48. The Commissioner has considered each of the conditions in Parts 1 to 3 of Schedule 1 of the DPA 2018 and whether any of them could be relied on to disclose the criminal offence data in this case. Having done so, and having taken into account the restrictive nature of the conditions, he considers that they could not.
49. The Commissioner is aware that some of the criminal offence data withheld had been reported in the media at the time the Authority issued its review response. However, in all of the circumstances, he does not consider that information, while in the public domain, was manifestly made public by the data subject(s) themselves with the specific intent of making it public, which (as set out in Schedule 1, Part 3, paragraph 32 of the DPA 2018) is the key test when considering this condition for
processing.
50. The Authority argued that disclosure would breach the data protection principle (Article 5(1)(a) of the GDPR) which requires that personal data shall be processed lawfully and fairly.
51. The Commissioner is also satisfied that none of the conditions required for processing personal data of this nature are satisfied; consequently, there can be no legal basis for its disclosure and this information is exempt from disclosure under section 38(1)(b) of FOISA.
52. The Commissioner therefore finds that the Authority complied with Part 1 of FOISA by withholding this information.
53. Having reached this conclusion, the Commissioner does not need to go on to consider whether section 35(1)(a) and (b) of FOISA also applies to this information. However, the Commissioner will consider whether section 35(1)(a) and (b) applied to the information to which he concluded section 38(1)(b) does not apply.
Section 35(1)(a) and (b) – Law enforcement
54. Section 35(1)(a) exempts information if its disclosure would, or would be likely to, prejudice substantially the prevention or detection of crime. As the Commissioner’s guidance on this exemption highlights, the term “prevention or detection of crime” is wide ranging encompassing any action taken to anticipate and prevent crime, or to establish the identity and secure prosecution of persons suspected of being responsible for crime. This could mean activities in relation to specific (anticipated) crime or wider strategies for crime reduction and detection.
55. Section 35(1)(b) exempts information if its disclosure would, or would be likely to, prejudice substantially the apprehension or prosecution of offenders. As the Commissioner’s guidance also states, there is likely to be a considerable overlap between information relating to “the apprehension or prosecution of offenders” and that relating to “the prevention or detection of crime”.
56. The Commissioner considers that section 35(1)(b) relates to all aspects of the process of identifying, arresting or prosecuting those suspected of being responsible for criminal activity. Again, this term could refer to the apprehension or prosecution of specific offenders or to more general techniques (such as investigative processes and use of police intelligence).
57. There is no definition of “substantial prejudice” in FOISA, but the Commissioner considers the authority would have to identify harm of real and demonstrable significance, which would be likely, at least, to follow disclosure, and more than simply a remote possibility.
58. The exemptions in section 35(1) are subject to the public interest test in section 2(1)(b) of FOISA.
The Authority’s submissions
59. The Authority stated that locations, supporters and fan rivalries do not (in the main) change, and that learning from previous football matches directly impacts on planning for future matches. On this basis, the Authority argued that match reports between two clubs at a particular stadium constituted incredibly valuable intelligence to those seeking to disrupt future, similar events.
60. While the Authority accepted that it may release information to the media in relation to football policing matters, it strongly disputed the Applicant’s claim that this extended to details of tactics, deployment and responses. The Authority submitted that disclosure of the withheld information would reveal the resourcing and tactics used at matches (and similar events), including its response to a variety of incidents.
61. The Authority argued this would enable those intent on crime or disorder to calculate the risks of detection (with some accuracy) and take measures to avoid this. The Authority also considered that disclosure would enable criminals to plan how best to engage and occupy police, so as to maximise the chances of committing serious (as opposed to minor) crime.
62. The Authority accepted that it is well known that police officers are deployed inside and around stadia on match days before and after matches. However, the Authority argued that the number of officers, and when, where and how these are deployed was not public knowledge. The Authority submitted that this in itself had a preventative, deterrent effect which would be significantly prejudiced if potential offenders were armed with this information. The Authority stated that any tactical advantage provided to criminals would enable them to evade detection and therefore substantially prejudice its ability to carry out law enforcement effectively.
63. The Authority also argued that there was still ample evidence of the risk of criminal behaviour at football matches and emphasised this with reference to examples. The Authority also contended that the UK faced a serious and sustained threat from violent extremists greater in scale than at any point previously.
64. The Authority stated that, taking all these factors into account, disclosure of the information withheld would substantially prejudice the ability of its officers to prevent and detect crime and apprehend or prosecute offenders – adversely impacting its chief priority to maximise public safety and minimise disorder.
The Applicant’s submissions
65. The Applicant disputed that anyone planning future crime could gain advantage from publication of the withheld information, as UK police forces routinely released similar information from such reports. The Applicant further considered matchday commanders had openly discussed matchday policing operations, including planning matters, in documentaries and on social media.
66. The Applicant did not consider disclosing the withheld information would in any way prejudice the prevention or detection of crime and apprehension or prosecution of offenders and considered it unlikely that potential offenders would review matchday reports (so as to plan and commit future crime).
67. The Applicant also noted that anyone attending the matches in question would be able to gather the very information requested simply by observation.
The Commissioner’s view
68. The Commissioner is satisfied that the information withheld under 35(1)(a) and (b) is used by the Authority in relation both to the “prevention or detection of crime” and “the apprehension or prosecution of offenders.”
69. This is the first requirement for sections 35(1)(a) and (b) to apply. The next question for the Commissioner to consider is whether disclosure would, or would be likely to, prejudice substantially the prevention or detection of crime, or the apprehension or prosecution of offenders.
70. The Commissioner has considered carefully all of the Applicant’s and Authority’s submissions, as well as the information still withheld under these exemptions.
71. The Commissioner acknowledges that the matches had taken place at the time the Applicant submitted their request. The Applicant has not asked for a whole series of matches, and they have not asked for data involving future matches. The matches in question were both played in November 2021, weeks before the request was submitted. The Commissioner notes that the date of the request is within five weeks of both of the matches taking place, so the information being sought is by no means in the distant past and is virtually contemporaneous with the request.
72. Having reviewed the withheld information, the Commissioner notes that it falls into two categories: it either relates to:
(a) descriptions of relatively minor and commonplace incidents at football matches; or
(b) police intelligence, resources, deployment and activity.
73. The Commissioner is not satisfied, on the basis of the Authority’s submissions, that disclosure of the limited descriptions of relatively minor and commonplace incidents (i.e. category a)) would substantially prejudice the prevention or detection of crime and/or the apprehension or prosecution of offenders.
74. Similarly, the Commissioner does not consider such prejudice would follow from disclosure of some of the withheld information in category b) which – in his view – would be reasonably expected to feature in any match report of this nature; consequently provides no reliable (or valuable) ‘insight’ into policing of future football matches and – barring some highly specific information he goes on to consider below - is therefore of no value to those planning crime. (I.e. it is information which describes general approaches to match day management; matters and intelligence considered in anticipation of the match, and incidents and responses to these, where both would be considered ‘standard’).
75. The Commissioner therefore finds that the Authority was not entitled to withhold this information under section 35(1)(a) or (b) of FOISA.
76. For the small amount of remaining information withheld under section 35(1)(a) and (b), the Commissioner’s view is that given its specificity it would, if disclosed, allow approaches to police intelligence gathering and processing, deployment, planned and “real-time” matchday management, incident detection approaches (and capabilities) and responses to those specific incidents to become public knowledge.
77. These would clearly be of relevance to the policing of the relevant grounds and the surrounding areas for future fixtures. While other factors will become relevant from time to time, it is not unreasonable to presume that there will be a norm for the challenges presented for policing a particular fixture in a particular place.
78. The withheld information also enables comparisons to be made between the two matches. Disclosure of that information under FOISA is to the public at large, which must (inevitably) include those intent on committing crime or otherwise causing harm at or in the vicinity of football matches. The Commissioner is satisfied from the Authority’s submissions and examples that the risk of harm from such individuals still exists.
79. From the submissions he has received, the Commissioner is satisfied that disclosure of the remaining withheld information would enable the public to establish patterns of matchday management and responses which would be of relevance to future similar fixtures, and thus identify where any potential weaknesses in the police deterrent may be. There is no means the Commissioner can see of providing this specific withheld information without divulging something of future value relating to the strategies and
operational considerations involved.
80. The Commissioner is satisfied in the circumstances that the likely effects of disclosure are correctly stated by the Authority here and that the disclosure of this withheld information would remove, or at least seriously compromise, any tactical advantage the Authority presently has in dealing with criminality at comparable events.
81. Consequently, the Commissioner accepts that the exemptions in section 35(1)(a) and (b) of FOISA apply to this withheld information.
The public interest test
82. As the Commissioner has found that the exemptions in section 35(1)(a) and (b) were correctly applied to some of the withheld information, he is required to consider the public interest test in section 2(1)(b) of FOISA. The Commissioner has therefore considered whether, in all the circumstances of the case, the public interest in disclosing the withheld information would be outweighed by that in maintaining the exemptions.
The Authority’s submissions
83. The Authority recognised a public interest in disclosing information which related to its efficient and effective use of public resources and that this would also have the effect of informing (and helping to ensure the accuracy of) public debate on policing.
84. The Authority accepted that disclosure would better inform the public about its approach to policing football matches in their communities; the factors taken into account in the planning process and resourcing levels, and particular arrangements resulting from this planning process. However, while recognising that resourcing was a matter of significant public interest, the Authority considered it could only release information where it did not cause a risk to do so.
85. The Authority submitted that disclosure of the withheld information would serve to undermine its ability to prevent and detect offences at matches and apprehend any offenders, that it has a duty to promote the safety of all individuals and that it would not disclose any information which would jeopardise this.
86. The Authority identified a significant public interest in ensuring it is as efficient and effective as possible, in pursuance of its duty to prevent and detect crime, which extended to ensuring every tactical advantage possible. While the public were aware that officers would be deployed to football matches, the Authority submitted that they were not aware of the specific details of those deployments and that the disclosure of information that would result in an adverse impact on its ability to carry out its
law enforcement role could not be in the public interest.
87. When balancing the arguments set out above, the Authority gave some weight to the need to ensure the public were well informed as to how police deployed in their communities. It argued that it is essential that any information which could encourage or facilitate offending behaviour (or reduce individuals’ chances of being detected and apprehended by influencing their behaviour) was not disclosed.
88. On balance, the Authority concluded that the public interest arguments favouring disclosure are outweighed by public safety considerations and the need to effectively prevent and detect crime and the apprehension of offenders.
The Applicant's submissions
89. The Applicant considered that there was strong enough public interest here to warrant disclosure of the information under FOISA as the Authority is funded by the public, who have a right to know how their funds are spent and to see the Authority’s work in their community.
90. The Applicant explained that the reports were prepared with the purpose of assessing how a particular game was policed and what changes could be made in the future, and that it was in the public’s interest to see this process in action, and only through disclosure of the information could they get a full picture of that process.
91. The Applicant also submitted that they had seen hundreds of such reports from police forces across the UK.
The Commissioner's view on the public interest
92. The Commissioner acknowledges the general public interest in transparency and accountability and he accepts that disclosure of the withheld information would allow further public scrutiny of police resources and the policing of football matches.
93. On the other hand, the Commissioner has already acknowledged that disclosure of the information would, or would be likely to, lead to substantial prejudice for the purposes of section 35(1)(a) and (b) of FOISA. This would clearly not be in the public interest: there is a strong public interest in maintaining the operational efficiency and effectiveness of the Authority.
94. Having balanced the public interest for and against disclosure, the Commissioner has concluded that the arguments against disclosure should prevail in this particular case. He is satisfied that, in all the circumstances of the case, the public interest in maintaining the exemptions in section 35(1)(a) and (b) outweighs that in disclosure of the information under consideration.
95. The Commissioner therefore finds that the Authority was entitled to withhold this information under the exemptions in section 35(1)(a) and (b) of FOISA.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that by withholding some information under sections 35(1)(a) and (b) and section 38(1)(b), the Authority complied with Part 1 of FOISA.
However, the Authority failed to comply with section 1(1) of FOISA by disclosing information during the investigation and by withholding some information it was not entitled to under sections 35(1)(a) and (b) and 38(1)(b).
The Commissioner therefore requires the Authority to provide the Applicant with the information it wrongly withheld under sections 35(1)(a) and (b) and 38(1)(b) of FOISA, by 14 October 2024.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.
David Hamilton
Scottish Information Commissioner
29 August 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
…
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
…
(e) in subsection (1) of section 38 –
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
…
35 Law enforcement
(1) Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially-
(a) the prevention or detection of crime;
(b) the apprehension or prosecution of offenders;
…
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"health record" has the meaning assigned to that term by section 1(1) of the Access to Health Records Act 1990 (c.23); and
"personal census information" means any census information-
(a) as defined in section 8(7) of the Census Act 1920 (c.41); or
(b) acquired or derived by virtue of sections 1 to 9 of the Census (Great Britain) Act 1910 (c.27),
which relates to an identifiable person or household;
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c);
and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
…
UK General Data Protection Regulation
Article 4 Definitions
1 ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or
more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
…
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Article 10 Special categories of personal data and criminal convictions etc data
1 Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.
2 In the 2018 Act-
(a) section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met;
(b) section 11(2) makes provision about the meaning of “personal data relating to criminal convictions and offences or related security measures”.
….
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) “Data subject” means the identified or identifiable living individual to whom personal data relates.
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
10 Special categories of personal data and criminal convictions etc data
…
(4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
(5) The processing meets the requirement in Article 10 of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
…
11 Special categories of personal data etc: supplementary
…
(2) In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to –
(a) the alleged commission of offences by the data subject, or
(b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.
Schedule 1 Special categories of personal data and criminal convictions etc data
…
Part 3 Additional conditions relating to criminal convictions etc
…
Personal data in the public domain
32. This condition is met if the processing relates to personal data which is manifestly made public by the data subject.
…
