Home Decisions

Decision 201/2006

Decision 201/2006 - Mr F and the Scottish Prison Service


Request for information relating to the Scottish Prison Service’s Higher Education Access Scheme


Applicant: Mr F
Authority: The Scottish Prison Service
Case No: 200503344
Decision Date: 9 November 2006


Kevin Dunion
Scottish Information Commissioner


Relevant Statutory Provisions and Other Sources


The Freedom of Information (Scotland) Act 2002 sections 21(1) (Review by Scottish public authority); 38(1)(a) and 38(1)(b) (Personal information).
The Data Protection Act 1998 Schedule 1 (The data protection principles); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data).


The relevant text from each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.


Facts


Mr F submitted three separate information requests to the Scottish Prison Service (SPS) seeking information in relation to the operation of the SPS’s Higher Education Access Scheme with regard to Peterhead Prison.


In relation to the first request, the SPS provided information, albeit under the Data Protection Act 1998 (the DPA) as opposed to the Freedom of Information (Scotland) Act 2002 (FOISA). In relation to the second it provided a partial response, withholding some of the information on the grounds of section 38(1)(b) of FOISA. With regard to the third, the SPS provided a full response.


In his application to the Commissioner, Mr F disputed the SPS’s handling of his first two requests. In doing so, he stated that information provided in response to the first did not accurately respond to his request. Mr F also disputed the decision to apply section 38(1)(b) in relation to his second request.


The Commissioner found that the SPS’s response to Mr F's first request was reasonable and appropriate in the circumstances of this case. With regard to the second request, the Commissioner found that the SPS had applied the exemption contained in section 38(1)(b) incorrectly to some of the withheld information, and required that that information be released to Mr F in an aggregated and transcribed format.



Background


1. Mr F wrote to the Scottish Prison Service (SPS) on 12 October 2005. In this correspondence, Mr F submitted the following requests under the Freedom of Information (Scotland) Act 2002 (FOISA):


A. “Please provide copies of the communications between SPS Headquarters (HEAS), Motherwell College, and Peterhead Prison (Learning/’LSE’ Centre) founded upon in the decision letter of the HEAS to the writer dated 6 October 2005 in terms of the required course facilities (London University External LLB) not being available locally at Peterhead, these communications having apparently been determinative of the issue.”


B. “Please provide copies of the successful applications to the HEAS by Peterhead prisoners (new and continuing applications) in 2006 insofar only as they disclose the following information: (a) course title/ reference; (b) course provider; (c) cost of course (if any); (d) required resources.”


C. “Please provide a comprehensive list of facilities to HEAS/’Open Learning’ students within the Learning/’LSE’ Centre at Peterhead prison as of 21 October 2005.”

The reference to the “HEAS” within Mr F's request refers to the SPS’s Higher Education Access Scheme, a scheme which facilitates access to higher education opportunities amongst offenders. The reference to “London University External LLB” refers to a Bachelor of Laws qualification.


2. A response was issued to Mr F on 3 November 2005. In this response, the SPS provided copies of communications between SPS Headquarters, Motherwell College and Peterhead Prison in response to Request A. The SPS informed Mr F that this information was being provided under the Data Protection Act 1998 (the DPA), as opposed to FOISA, for the reason that the information constituted Mr F own personal data. The SPS also indicated that it had waived the fee normally required for processing a request under the DPA in relation to that request.


3. In response to Request B, the SPS did not provide Mr F with copies of the relevant applications, stating that this information was exempt under section 38(1)(b) of FOISA (personal information). The SPS did, however, provide confirmation of the number of students within the prison currently engaged in higher education, the course provider, an overview of the resources required across all courses and a combined total cost for those courses.


4. In relation to Request C, the SPS stated that it had passed this request to Peterhead Prison for its attention. A response to this request was subsequently received by Mr F.


5. Mr F requested that the SPS review its handling of its responses to Requests A and B on 17 November 2005.


6. When no response was received to this correspondence within 20 working days, Mr F submitted an initial application to my Office on 19 December 2005.


7. A response to the request for review (upholding the SPS’s original decision) was subsequently received by Mr F on 21 December 2005. Following receipt of this response, Mr F submitted a revised application to me on 22 December 2005.


8. The case was allocated to an investigating officer and validated by establishing that Mr F's request had been made to a Scottish public authority and that he had appealed to me only after asking the authority to review its response.


The Investigation


9. Mr F's application stated that there were a number of reasons for his dissatisfaction with the SPS’s handling of his information request.


10. Firstly, Mr F disputed the SPS’s decision to process Request A under the DPA, as opposed to FOISA. Mr F stated in his submission to this Office that his intention, in making the request, was not to ask for personal information regarding his own needs, but rather was to seek general information about the learning facilities within the prison. Mr F suggested that the decision to process the information under the DPA may have resulted in information being withheld from release where it did not constitute his own personal data.


11. Secondly, Mr F disputed the decision to withhold information in response to Request B on the grounds that it could be used to identify individuals. Mr F stated in his application that, in his view, information about course names, references, providers and costs alone could not be used to identify individuals. Mr F argued that, while he was aware in any event of those other prisoners taking part in some form of open learning, unless the individuals taking part in the courses about which he had enquired were to identify themselves to him independently, he would not be in a position to identify them as participating in any particular course from the information sought from the SPS.


12. Thirdly, Mr F expressed his dissatisfaction with the SPS’s failure to respond to his request for review within 20 working days. Mr F noted that the SPS’s response of 21 December 2005 stated that his request for review was received on 23 November 2005. Mr F disputed this, however, and supplied my Office with a copy of a ‘Recorded Delivery’ note which indicated that the request for review was received by the SPS on 18 November 2005.


13. The SPS was contacted for its submissions in relation to this case, in accordance with section 49(3)(a) of FOISA.


14. In response, the SPS stated that Request A was understood by it as being a request for all communications between SPS Headquarters, the HEAS, Motherwell College and the HMP Peterhead Learning Centre which led to a decision given to Mr F in a letter of 6 October 2005. The SPS stated that on review of such papers, it was considered that they directly related to Mr F as a student, and should be considered as personal data under the DPA. The SPS therefore stated that the requested information was considered to be exempt under section 38(1)(a), but was separately released to Mr F under the DPA.


15. The SPS also stated, in relation to Request A, that Mr F did not appear to challenge the interpretation of what the question covered at the review stage, and that in any event Mr F's dissatisfaction with its response as communicated by my Office did not appear to bear a strong relation to his original question.

16. In relation to Request B, the SPS stated that it considered it appropriate to exempt information relating to course titles, as the information might be used to tie a particular prisoner to a particular course. The SPS stated that, given the small number of students within Peterhead receiving support from the HEAS, and the reality of living in a closed community, it would be easy for individuals to identify what other prisoners were studying. The SPS stated that prisoners would have no expectation of such information being made publicly available, and that it might result in some prisoners being subjected to verbal abuse if they were studying a course of unusual character. In addition, the SPS also argued that, if the cost of each course were publicly known, prisoners on more expensive study programmes might be subjected to envious recrimination.


17. The SPS asserted that it did not wish to suggest that Mr F would misuse the information, but rather suggested that it being made publicly available might lead to such misuse.


18. On the basis of this assertion, my Investigating Officer sought clarification from the SPS with regard to whether in considered the information to also be exempt under section 39(1) of FOISA (Health, safety and the environment). In response, however, the SPS stated that it had considered this exemption, but indicated that it had not been claimed for the reason that it considered that it would be difficult to provide documentary evidence in support of this assertion.


19. During the course of the investigation, and following communications with my Office, the SPS later stated that it felt it had been “overly cautious” with regard to the release of information relating to the individual cost of courses. This information was subsequently released to Mr F.


The Commissioner’s Analysis and Findings


20. Mr F's application to me was made in relation to two separate requests under FOISA. I will address the SPS’s handling of each of these requests in turn.


Request A


21. In this request, Mr F sought copies of communications held by the SPS “founded upon in” a decision letter which informed Mr F that the course facilities he had requested were not available at Peterhead.

22. The SPS interpreted this request as being a request for correspondence held which related to, and resulted in, the decision issued to Mr F. As a result, the SPS provided Mr F with correspondence between the parties named by Mr F which related to the consideration of his study application. The SPS stated that this information was being released under the DPA, as opposed to FOISA, and advised Mr F that the charge normally associated with DPA requests was being waived in this case.


23. The DPA provides individuals with a right of access to personal data of which they are the subject. If an authority receives a request for such information, it will be obliged to process that request under the DPA as opposed to FOISA. Indeed, it should be noted that FOISA contains, under section 38(1)(a), an absolute exemption in relation to such information, for the reason that separate access rights are provided under the DPA.


24. The SPS has informed this Office that, following receipt of Mr F request, it reviewed the information which it considered fell within the scope of the request and concluded that the information was substantially comprised of Mr F's own personal data. As a result, the information was released to Mr F under the DPA, as opposed to FOISA.


25. Mr F disputed this interpretation in his application to this Office. Mr F's application stated that, in making his request, he was not, in fact, seeking access to personal information, but was rather seeking information of a more general nature about the Learning Centre facilities available within HMP Peterhead, beyond those relating to his particular application.


26. Mr F added that, where there was any doubt with regard to the intent of Request A, the SPS should have sought further clarification from him with regard to the specific nature of that request.


27. Having considered the wording of the request made under Request A of Mr F's letter of 12 October (and reprinted under paragraph 1 above) it is clear to me that the request itself can be considered to be somewhat ambiguous, and may be open to interpretation.


28. While I note Mr F's assertion that the SPS should have sought clarification from him with regard to the meaning of the request, I also note that the SPS has indicated in its submissions that it did not see the need for such clarification, stating its view that the fact that the request sought “communications…founded upon in the decision letter of HEAS to the writer” limited the scope of Request A to that information centred on the decision concerning Mr F. As such, the SPS was of the view that it had interpreted and responded to the request appropriately.


29. The SPS argued that, had Mr F been unhappy with the initial interpretation of his request, it would have been appropriate for him to make this clear when submitting his request for review. The SPS has stated in its submissions, however, that Mr F's request for review of 17 November did not challenge the SPS’s interpretation of his initial request.


30. Mr F's request for review was worded as follows:


“Whilst it appears that Ms Sweeney has provided a response which is compliant with the provisions of the 2002 Act in relation to this matter I do not accept the import of her observations relative to the Data Protection Act 1998 etc, and I confirm my intention to pursue any defaults in terms of the 2002 Act by means of the machinery established for that purpose by Parliament. If the SPS prefers to evade the consequence of its own publication policy relative to FOISA requests and responses then that is a matter for the SPS.”


31. While Mr F's request for review does therefore indicate that he is dissatisfied with the response provided, it does not set out the precise basis for that dissatisfaction, nor explicitly request that the SPS review the aspect of its handling of Request A which Mr F later informed this Office he was dissatisfied with.


32. Having reviewed the SPS’s response to Mr F's request for review, it is clear from this that the SPS interpreted Mr F's request for review as expressing dissatisfaction with the decision to release the identified information under the DPA (as opposed to FOISA), rather than a broader dissatisfaction with the SPS’s interpretation of the scope of his request.


33. The central issue which must be considered with regard to Request A, therefore, relates to whether the SPS interpreted and responded to Mr F's request (and subsequent request for review) appropriately.


34. There will inevitably be circumstances under FOISA where an applicant and an authority are in dispute over the interpretation of specific information requests and, where such issues cannot be resolved at review stage, an applicant will be entitled to make an application to me on the basis of that interpretation.


35. In dealing with such cases, an authority will normally be considered to have acted in accordance with FOISA where it can be demonstrated that its interpretation of the request was reasonable and appropriate in the circumstances of that particular case. In such cases, it will normally be demonstrated that the authority has acted in good faith, and has not adopted a wilfully distorted or unreasonably restrictive interpretation in its consideration of the request.

36. Where there is uncertainty within an authority with regard to the nature or scope of a particular request, it will be appropriate, as pointed out by Mr F in his application, for that authority to seek further clarification from the applicant before proceeding with the request. If, however, an authority considers that it has appropriately interpreted the requests received there will normally be no such requirement to seek clarification.


37. In the case of the request made by Mr F under Request A, I am of the opinion that, while the request can indeed be considered to be ambiguously worded, the SPS’s interpretation of that request was made in good faith. Indeed, the SPS subsequently attempted to provide Mr F with relevant information falling within the scope of that interpretation. Had Mr F been unhappy with the interpretation, it would have been appropriate to make this clear at the review stage, specifying, as required by section 20(3)(c) of FOISA, the matter which gave rise to his dissatisfaction. As noted above, however, Mr F's request for review failed to clearly set this out.


38. As a result, I find that the SPS acted appropriately in terms of Part I of FOISA in its handling of Mr F information request, in that I consider that its responses to Mr F's initial request and his request for review were based on a reasonable and appropriate interpretation of those requests.


39. Should Mr F wish to pursue access to any more general information in which he has indicated he is interested, I would suggest that he consider submitting a new request to the SPS for that information. I would recommend that any such request is carefully drafted to ensure that it sets out succinctly and clearly the specific additional information in which he is interested.


Request B


40. In relation to Request B, the SPS’s response did not provide copies of the successful applications to the HEAS, as sought in Mr F's request. Instead, the SPS provided Mr F with some information extracted from those applications which fell within the scope of his request. This included details of the number of students currently undertaking study through the HEAS, the course provider, a combined total cost of all courses, and an overview of some of the resource requirements across those courses.


41. As noted above at paragraph 19, during the course of the investigation, the SPS went on to release information relating to the individual cost of each course to Mr F. However, the SPS indicated that the remainder of the information – the copies of the applications themselves, details of the course titles and reference numbers and full details of the resource requirement for each course – was considered to be exempt under section 38(1)(b) (read in conjunction with 38(2)(a)(i)) of FOISA.


42. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i), exempts information if that information constitutes personal data and its release would breach any of the data protection principles. The SPS asserted that the withheld information constituted the personal data of the individuals undertaking each course of study, and that release of that data would represent a breach of the first principle on fair and lawful processing, in that individual prisoners would have no expectation that the information contained on the forms would be made publicly available.


43. In his submission to my Office, however, Mr F suggested that his request was worded in such a way as to minimise the likelihood of the identification of individuals. Indeed, Mr F argued that the requested information could only be used to identify individuals in circumstances where the individual subsequently identified themselves to Mr F during the course of their contact with him, and without such circumstances it would not be possible for Mr F to identify individuals from the information provided.


Does the requested information constitute personal data?


44. Section 1(1) of the DPA defines “personal data” as:


"data which relate to a living individual who can be identified –


a) from those data, or
b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.”


45. The interpretation of the decision in Durant v the Financial Services Authority (2003) (EWCA CIV 1746) case is important in determining what constitutes personal data. In this decision, the Court of Appeal held that if information is to be viewed as personal data, the information has to be “biographical in a significant sense”. That is, it must go beyond the recording of an individual’s involvement in a matter or event that has no personal connotations. The individual also has to be the focus of the information, rather than some other person with whom the individual has been involved. In short, the information must affect the individual’s privacy.


46. With regard to the information withheld from Mr F, while I acknowledge that Mr F's request was deliberately worded to reduce the likelihood of the identification of specific inmates through the omission of information which directly named or referenced individuals, I am nevertheless of the opinion that the withheld information should be considered to constitute the personal data of those individuals. The information was submitted as part of the individuals’ own applications for funding and approval to undertake courses of study and, as such, contains information relating to those individuals’ learning activities. This information will, therefore, clearly relate to those individuals.


47. With regard to the question of whether the individual inmates can be identified from the data, I am of the opinion that the likelihood of this would be largely dependent on the circumstances surrounding the release of the information. Had Mr F's request sought information relating to all HEAS applications facilitated by the SPS across all Scottish prisons, the size of the group about whom information was requested and the additional anonymity provided by the inclusion of individuals from different prisons would ensure that the likelihood of the identification of specific individuals was minimal. However, Mr F's request sought information relating only to the successful applications to the HEAS within Peterhead Prison in 2006 and, as confirmed by the SPS in its correspondence with both Mr F and my Office, such applications were held in relation to only four inmates. Given the confined social interactions that will inevitably exist within a prison environment, and the limited number of prisoners participating in study programmes within the prison, it is my view that the release of much of the withheld information within the prison environment would enable the identification of individual prisoners.


48. In addition, it should be noted that the majority of the forms in question have been handwritten by the inmates themselves. I am also of the view that the handwriting of inmates in this case should also be considered to constitute their personal data, for the reason that the inmates in question may be identified from that handwriting (with consequent effects on their privacy in a confined environment).


49. I therefore consider that the information withheld from Mr F should be considered to constitute the personal data of the inmates in question.


Will release breach the data protection principles?


50. In its submissions to my Office, the SPS has argued that release of the information withheld from Mr F would breach the first data protection principle.


51. The first data protection principle states that personal data must be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (of the DPA) is met.


52. It should be noted that the first data protection principle also requires that, in the case of sensitive personal data, at least one of the conditions in Schedule 3 must be met. With regard to this case, however, and having considered the definition of sensitive personal data in section 2 of the DPA, I am satisfied that the information in question does not constitute sensitive personal data. Therefore, I am not required to consider whether any of the conditions in Schedule 3 can be met.


53. The SPS argues that the release of the personal data contained within the information would not be fair to the data subjects, in that the prisoners concerned would have no expectation that the requested information would be made publicly available. The SPS states that, if this information were to be released, individuals within the prison would have only to notice the text books a prisoner was working with to be able to deduce the course of study that the prisoner was undertaking. The SPS also argued that prisoners may be subject to verbal abuse if they were known to be studying a course of an unusual character.


54. The Information Commissioner, who is responsible for enforcing the DPA, has issued guidance on the consideration of the data protection principles within the context of freedom of information legislation. In this guidance, the Information Commissioner provides examples of the types of questions which should be considered by authorities when assessing whether the release of personal data would amount to ‘fair’ processing. These include:

  • Would disclosure cause unnecessary or unjustified distress or damage to the data subject?
  • Would the data subject expect that his or her information might be disclosed to others?
  • Has the person been led to believe that his or her information would be kept secret?


55. Schedule 2 of the DPA sets out conditions at least one of which must be complied with if the processing of data is to be carried out in line with the first data protection principle. For example, processing may (subject to the other tests contained in the first data protection principle) be carried out if the data subject has given his consent to the processing, if the processing is necessary for the performance of a contract to which the subject is a party, or if it is necessary to protect the vital interests of the data subject.


56. Having reviewed the Schedule 2 conditions within the context of this case, the only Schedule 2 condition which I consider may apply is that contained in paragraph 6 of Schedule 2. Paragraph 6 sets out that processing of personal data will be appropriate in circumstances where that processing is “necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject”.


57. I consider that Mr F has legitimate interests with regard to his desire to verify the accountability and equity of the HEAS. Indeed, I can accept that there is a wider legitimate interest in this (at least within the prison community if not necessarily amongst the general public) in that it will serve to confirm that the resources available for this purpose are allocated in a considered and fair manner.


58. What must be considered, therefore, is whether this legitimate interest on the part of Mr F and others is outweighed by any countervailing right, freedom or legitimate interest on the part of the data subjects in favour of non-disclosure of the specific information withheld.


59. The forms which contain the information sought by Mr F have been prepared by inmates for the purpose of applying to undertake particular Higher Education learning opportunities. On considering the circumstances surrounding the submission of such forms to the SPS, it is clear that information will have been provided by inmates on the understanding that it would be used principally to assess each inmate’s application under the HEAS. As such, I am of the view that inmates would generally have no expectation that any personal data contained within those forms would be released into the public domain.


60. That said, I also consider it likely that inmates will have a reasonable expectation, on the submission of such forms, that there will be circumstances where relevant data will be used for purposes other than the assessment of an individual application. For example, I consider that there will be an expectation that information may be used for the purpose of reviewing or monitoring the overall performance of the HEAS, for example through the release of statistical information or commentary in relation to the HEAS. In such circumstances, however, I consider that there would be an understanding that any personal data used would be anonymised, in order to ensure that individuals could not be identified.


61. Indeed, it should be noted that, in such circumstances where information is anonymised, the information will no longer be considered to constitute personal data if circumstances are such that individuals are not identifiable from the information provided. This will be the case, for example, with regard to the information previously supplied by the SPS to Mr F (i.e. details of the course providers and costs of courses.)


62. With regard to the majority of the information withheld from Mr F, however, it is my view that the limited nature of Mr F's information request and the environment into which information would be released would combine to facilitate the identification of individuals, even with explicit references (such as name, prisoner number or date of birth) removed. Indeed, it is not difficult to imagine circumstances where, were this information to be released, individuals using particular resources within the prison environment could be identified, and subsequently details of the name and cost of the course, along with other resources being used by that inmate, established.


63. As such, I am of the opinion that the information withheld, while not explicitly identifying individuals, could be utilised within the prison environment for this purpose. As stated earlier, I am therefore of the opinion that that information constitutes the personal data of those individuals.


64. I also consider, with regard to the majority of the information withheld, that the release of the information would prejudice the legitimate interests of the inmates concerned. As stated, it is my view that the inmates in question would have no general expectation that the personal data contained within the forms would be processed in such a way as to facilitate their identification by their peers. While Mr F, therefore, can be considered to hold a legitimate interest with regard to the release of the information, I consider that processing would be unwarranted due to the potential prejudice to the legitimate interests of the individual applicants in ensuring that such personal data remains private.


65. I therefore find that SPS acted in accordance with FOISA in withholding the following information in response to Mr F's information request:

  • Course title
  • Course reference


I also consider that the SPS acted in accordance with FOISA in withholding copies of the actual forms from Mr F.


66. With regard to the details of the resources required by inmates, I note that the SPS has previously provided an overview of some of the resources required in its response to Mr F initial request. Some information relating to the resources required was, however, withheld in this response.


67. I do not consider that the SPS acted in accordance with FOISA in applying section 38(1)(b) of FOISA to this resource information. Indeed, I consider that details of the resource information alone could only be used to identify individual inmates in circumstances where that inmate was openly using that resource in view of his peers. In such circumstances, the individual in question will hardly have a reasonable expectation of this information remaining private. As a result, I do not consider that the release of information relating to the resources alone used can be considered to be unfair to the potential data subjects.


68. It would be the case, however, that, were this information to be provided in such a way as to identify it with individual applicants or applications, the full range of resources used by one individual may be identifiable to his peers from the open use of any single resource, regardless of that individual’s willingness or otherwise to disclose that information. I therefore consider that release of the resource information in a format which ties it to individual applicants would be unfair to the data subjects.


69. As a result, I require the SPS to provide Mr F with aggregated details of the resources required across all applications. Given my comments in relation to applicants’ handwriting at paragraph 48 above, this information should also be provided in the form of a transcribed record of the information contained within the relevant section of the application forms, as opposed to copies of the forms themselves. I consider that information in this form would still address, to a substantial extent, the legitimate interests of Mr F (as set out at paragraph 57 above), without prejudicing the legitimate interests of the individual applicants to the HEAS (as set out at paragraphs 59-64).


70. I note that Mr F has stated in his communications with my Office that he has previously received transcribed information from the SPS (in response to other requests) which he believes may have been rendered ‘misleading’ and ‘false’ as a result of the transcription process. While I note this concern, and would of course expect the SPS to carry out any transcription with the highest regard for accuracy, I cannot take it into account in determining whether the exemption in section 38(1)(b) applies to the information withheld.


The SPS’s handling of Mr F's information request


71. Finally, I wish to briefly comment on one aspect of the SPS’s handling of Mr F's information request.


72. As set out above, the SPS failed to respond to Mr F's initial request within the 20 working day timescale required by section 21(1) of FOISA. While the initial response from the SPS stated that Mr F's request was received on 23 November 2005, Mr F supplied my Office with a copy of a recorded delivery note which indicated that the request for review was received on 18 November 2006.


73. In its submissions to this Office, the SPS has acknowledged that the request for review was indeed received on 18 November 2006. The SPS stated that the request was, however, mistakenly stamped by its Chief Executive’s Office as being received on 23 November, and was not passed to an officer for a response until 25 November. This officer then responded in accordance with the stamped date of receipt as opposed to the actual date of receipt.


74. The SPS assured my Office that discussion had taken place within the Chief Executive’s Office in order to avoid a reoccurrence of this error.


75. I conclude therefore that the SPS failed to comply with section 21(1) of FOISA in its handling of Mr F's request for review. However, given the assurances from the SPS that steps have been undertaken to prevent a reoccurrence, I do not require the SPS to take any remedial action in relation to this failure.


Decision


I find that the Scottish Prison Service (SPS) acted in accordance with Part I the Freedom of Information (Scotland) Act 2002, (FOISA) in its handling of the request contained under Mr F's Request A, in that its response was based on a reasonable and appropriate interpretation of that request.


I also find that the SPS acted in accordance with Part I of FOISA in its response in relation to the majority of the information requested under Request B. However, I find that the SPS failed to act in accordance with section 1(1) of FOISA in applying the exemption under section 38(1)(b) of FOISA (Personal information) to some of the information falling within the scope of Mr F's request for details of required resources. I require the SPS to provide this information to Mr F in the form set out in paragraphs 71-72 above. I require the SPS to provide this information to Mr F within 45 days of receipt of this notice.


I also find that the SPS breached section 21(1) of FOISA with regard to its failure to respond to Mr F request within 20 working days of receipt. I do not require the SPS to take any remedial action in relation to this failure.


Appeal


Should either Mr F or the SPS wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.


Kevin Dunion

Scottish Information Commissioner

09 November 2006


APPENDIX


Relevant Statutory Provisions


The Freedom of Information (Scotland) Act 2002


Section 38(1)(a) and 38(1)(b) – Personal information


(1) Information is exempt if it constitutes -


(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the “first condition”) or that mentioned in subsection (3) (the “second condition”) is satisfied;


…(2) The first condition is –


(a) in a case where the information falls within any of the paragraphs (a) to (d) of the definition of “data” in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene -


(i) any of the data protection principles;


Section 21(1) – Review by Scottish public authority


(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must…comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.


The Data Protection Act 1998


Schedule 1 – The Data Protection Principles


Part 1 – The Principles


1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-


(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.


2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.


3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.


4. Personal data shall be accurate and, where necessary, kept up to date.


5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.


6. Personal data shall be processed in accordance with the rights of data subjects under this Act.


7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.


8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.


Schedule 2 – Conditions relevant for the purposes of the first principle: processing of any personal data


1. The data subject has given his consent to the processing.


2. The processing is necessary-


(a) for the performance of a contract to which the data subject is a party, or
(b) for the taking of steps at the request of the data subject with a view to entering into a contract.


3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.


4. The processing is necessary in order to protect the vital interests of the data subject.

5. The processing is necessary-


(a) for the administration of justice,
(b) for the exercise of any functions conferred on any person by or under any enactment,
(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or
(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.


6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.


(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

PDF IconLink to PDF file of decision 201/2006 (96.4 kb)