This decision was appealed to the Court of Session by the Housing Associations. The Court issued its Opinion on 19 May 2010. It can be read here: http://www.scotcourts.gov.uk/opinions/2010CSIH43.html

Decision 014/2009 Dunbritton Housing Association, Craigdale Housing Association and Blochairn Housing Co-operative and the Chief Constable of Strathclyde Police

Numbers of Registered Sex Offenders in specified postcode sectors

Reference No: 200701167; 200701168; 200701532
Decision Date: 16 February 2009

Summary

Craigdale Housing Association, Dunbritton Housing Association and Blochairn Housing Co-operative (the Housing Associations) each made separate requests to the Chief Constable of Strathclyde Police (Strathclyde Police) for statistical information about Registered Sex Offenders (RSOs) living in certain postcode sector areas.Strathclyde Police withheld the information under a number of exemptions contained in the Freedom of Information (Scotland) Act 2002 (FOISA).The Housing Associations each sought a review of the response to their request.After receiving the review response, each of the Housing Associations remained dissatisfied and applied to the Commissioner for a decision.

Because the requests and responses were so similar, the cases were considered together in a single investigation by the Commissioner.

Following investigation, the Commissioner found that Strathclyde Police had dealt with the Housing Associations' request for information in accordance with Part 1 of FOISA, by withholding the information under section 38(1)(b) of FOISA.He found that the disclosure of the information could identify RSOs and that such disclosure would breach the first data protection principle.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) section 1(1) and (6); section 38(1)(b), (2)(a)(i) and (b) (Personal information)

Data Protection Act 1998 (DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data) and 2 (Sensitive personal data) and Schedule 1 (The data protection principles: the first principle)

Data Protection (Processing of Sensitive Personal Data) Order 2000, paragraphs 1 and 10 of the Schedule (Circumstances in which sensitive personal data may be processed)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data recital 26

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Common Services Agency v Scottish Information Commissioner [2007] 1 WLR 1550

Background

1.During the period July to September 2007, three Glasgow-based housing associations made separate information requests to Strathclyde Police for statistical information about Registered Sex Offenders (RSOs) in certain postcode sectors.In this Decision Notice, these are referred to as requests 1, 2 and 3.

Request 1: Craigdale Housing Association

2.On 27 April 2007, Craigdale Housing Association asked Strathclyde Police for the number of RSOs in postcode sectors G45-9 and G44-5, in each of four risk categories, i.e. low, medium, high and very high.(The request made it clear that the request was for information to the fourth postcode digit.)It explained that discussions about guidance recently circulated on re-housing sex offenders had led to concerns that areas such as Castlemilk may be carrying a greater burden of offenders than more affluent areas.The information it requested would allow it to quantify this problem.Craigdale Housing Association acknowledged that the Police had concerns about the potential for public disorder, but did not believe that any individual offender could be identified from the statistical data it had asked for, given the number of residents in both postcode sectors.

3.On 1 June 2007, Strathclyde Police wrote to inform Craigdale Housing Association that the information requested was exempt from disclosure under FOISA.Strathclyde Police cited the exemptions in sections 35(1)(a), 39(1) and 36(2) of FOISA.In summary, the Police argued that registration of sex offenders enables the police and other relevant authorities to supervise and monitor those individuals, with the aim of protecting the wider community from any risk they pose and preventing them from committing similar offences.In the experience of police services throughout the UK, even speculation about the number of RSOs within a relatively large geographic area leads to attempts to identify the individual offenders.This would have two consequences:

- the RSO fearing identification and reprisal attack would be likely to flee from the area, breaching the terms of their registration.Without appropriate supervision and assessment, there would be a greater risk of these individuals re-offending.

- it was likely that a minority of individuals may attempt to physically harm the RSO, or individuals wrongly suspected of being the RSO, or hound them from the area.

4.Strathclyde Police commented that Craigdale Housing Association is classed as a "relevant partner agency" under the Multi Agency Public Protection Arrangements (MAPPA) which had come into force on 2 April 2007.They advised that if they held information about RSOs residing in Craigdale Housing Association accommodation who might pose a risk to the area or to Craigdale Housing Association staff, then MAPPA was in place to ensure that the relevant information could be shared with Craigdale Housing Association.Strathclyde Police considered that MAPPA was a more appropriate means for disclosure of information about offenders, rather than FOISA (unlike information disclosed under FOISA, a disclosure via MAPPA would not have the effect of putting the information into the public domain).

5.On 24 July 2007, Craigdale Housing Association wrote to Strathclyde Police requesting a review of their decision and challenging some of the reasons they had given for withholding the information.Craigdale Housing Association commented that although it understood the strategy described by the Police, it could not accept some of the points made in their response.

6.Firstly, Craigdale Housing Association addressed the point made by the Police that previous experience had shown that even speculation about the number of RSOs within an area had led to attempts to identify the individuals concerned.It noted that the police had made public statements to the effect that there are sex offenders living in every community; that the police are more concerned about those not on the Register because they are not being monitored; and that the police cannot monitor sex offenders on a 24 hour basis.Craigdale Housing Association pointed out that there is regular media coverage of sex offenders. It did not accept that the public statements by the police and other professionals, and the widespread media coverage about sex offenders, had resulted in widespread vigilante action.It referred to the murder of the schoolboy Mark Cummings in Royston, and stated that in that area there had been no vigilante action although it was common knowledge that sex offenders were living locally.

7.Secondly, Craigdale Housing Association turned to the statement that the RSO fearing identification and reprisal would be likely to flee.It argued that such action would be a criminal offence and dealt with as such by the police.It argued that there had been a major shift in thinking on this issue, as evidenced by the introduction of measures such as the Child Exploitation and Online Protection (CEOP) website, which provides details of sex offenders who abscond.(The CEOP website is commented on below.) Craigdale Housing Association also pointed to a high-profile case where a sex offender missing from the register for a year had been located within 48 hours after his picture was posted in connection with a murder investigation.

8.Craigdale Housing Association commented that it had no reason to believe that MAPPA and the National Accommodation Strategy for Sex Offenders (NASSO) addressed its concerns about poorer communities carrying an unacceptable and disproportionate burden in terms of housing provision for RSOs.It argued that the Cosgrove Report (a report published in 2001 by the Expert Panel on Sex Offending) stated that it is dangerous to locate high numbers of sex offenders in any one area, and that it was a matter of serious concern that neither the police nor any other authority was monitoring this.It believed it was clearly in the public interest to establish whether high numbers of sex offenders are living in any one location.

9.On 22 August 2007, Strathclyde Police notified Craigdale Housing Association of the outcome of its review.Strathclyde Police upheld the decision to withhold the information for the reasons they had previously given in relation to sections 35(1)(a) and 39(1) of FOISA; however, Strathclyde Police withdrew their reliance on section 36(2).Strathclyde Police did not comment on any of the points raised by Craigdale Housing Association in its request for review.

10.On 28 August 2007, Craigdale Housing Association wrote to the Commissioner, stating that it was dissatisfied with the way in which Strathclyde Police had dealt with its information request of 27 April 2007.It believed that Strathclyde Police had incorrectly applied the exemptions cited, for the reasons set out in its request for review of 24 July 2007.It applied to the Commissioner for a decision in terms of section 47(1) of FOISA.

11.The application was validated by establishing that Craigdale Housing Association had made a valid request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Request 2: Dunbritton Housing Association

12.On 10 May 2007, Dunbritton Housing Association wrote to Strathclyde Police to ask for the number of RSOs in areas where the Housing Association had properties.Strathclyde Police were asked to provide the number of RSOs (in categories of low, medium, high and very high risk) in the following postcode sectors (as with the request by Craigdale, the request was to the fourth postcode digit):

a) G82-1; G82-2; G82-3; G82-4; G82-5 (Dumbarton)
b) G83-0; G83-7; G83-8; G83-9 (Alexandria)
c) G84-0; G84-7; G84-8; G84-9 (Helensburgh/Lomond)

13.On 12 June 2007 Strathclyde Police provided their response, which was identical to the response sent to Craigdale Housing Association in terms of the exemptions cited and the consideration of the public interest test.Again, Strathclyde Police advised that the information sharing arrangements under MAPPA were a more appropriate route for the disclosure of information about sex offenders to the Housing Association, than disclosure under FOISA.

14.Dunbritton Housing Association asked for a review of this response on 27 July 2007.In relation to the exemption in section 35(1)(a) of FOISA, it stated that, in its view, the information requested was of a non-specific nature and disclosure would be unlikely to prejudice substantially the prevention or detection of crime.Dunbritton Housing Association also considered that Strathclyde Police had failed to properly consider and apply the public interest test, particularly in terms of keeping the public adequately informed of any danger to public health or safety and argued that disclosure of the information would assist in keeping the public adequately informed of any danger to public health or safety posed by registered sex offenders.

15.In relation to the exemption in section 39(1) of FOISA, Dunbritton Housing Association considered that there was only a remote likelihood that disclosure of the information would endanger the physical or mental health or the safety of RSOs.Although the Police had referred to two incidents where violent attacks had followed disclosure of information, the Association did not regard this as evidence of widespread reaction to disclosure.The Association cited the restraint shown by the Royston community following the murder of Mark Cummings in June 2004.The Association also found that Strathclyde Police had failed to apply the public interest test correctly, for similar reasons to those stated in relation to section 35(1)(a) of FOISA.

16.Dunbritton Housing Association did not consider the information sharing arrangements under MAPPA to be relevant to its information request under FOISA.

17.Dunbritton Housing Association provided several examples of how the information requested would be used when the Association was considering future requests to re-house RSOs.Finally, it commented that the introduction of the CEOP Website in November 2006 suggested a major shift in Strathclyde Police's stance on disclosing information.Given that such detailed information is now disclosed, it questioned why non-specific statistical information could not also be released.

18.On 22 August 2007, Strathclyde Police wrote to notify Dunbritton Housing Association of the outcome of its review.Strathclyde Police upheld the decision to withhold the information for the reasons previously stated in relation to sections 35(1)(a) and 39(1) of FOISA; however, Strathclyde Police withdrew their reliance on section 36(2).Strathclyde Police did not comment on any specific points raised on behalf of Dunbritton Housing Association.

19.On 27 August 2007, Dunbritton Housing Association wrote to the Commissioner.It stated that the Association was dissatisfied with the way in which Strathclyde Police had dealt with its information request of 10 May 2007, believing that Strathclyde Police had incorrectly applied the exemptions cited, for the reasons set out in the Association's request for review of 27 July 2007.It applied to the Commissioner for a decision in terms of section 47(1) of FOISA.

20.The application was validated by establishing that Dunbritton Housing Association had made a valid request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

21.Strathclyde Police were notified that the Commissioner had received applications from both Dunbritton and Craigdale Housing Associations, and were asked to supply him with copies of the information withheld.The information was provided on 14 September 2007.

Request 3: Blochairn Housing Co-operative

22.On 13 September 2007, Blochairn Housing Co-operative wrote to Strathclyde Police to ask for the numbers of RSOs in the postcode sectors G21-2 and G11-7, in four risk categories: low, medium, high and very high.(As with both Craigdale and Dunbritton, the request was for information to the fourth postcode digit.)

23.In its letter, Blochairn Housing Co-operative stressed that it did not want information that would lead to the identification of any individual, but wanted information that would allow the organisation to compare two postcode sectors containing several thousand people in each, in order to test the theory that poorer communities carry a disproportionate burden in terms of the management of offenders.It provided population figures for the postcode sectors in question, and pointed out that poorer communities have significantly higher numbers of children and single parent households: for example, G21-2 had 45.1% of residents under 16 years of age compared to 18.4% in the more affluent G11-7.Blochairn Housing Co-operative believed this to be relevant to the debate on the management of sex offenders in communities.

24.Strathclyde Police responded on 12 October 2007, in terms virtually identical to those employed in the responses to Craigdale and Dunbritton Housing Associations, referred to previously in this decision notice.The exemptions cited were sections 35(1)(a), 39(1), and 36(2) of FOISA.

25.On 19 October 2007 Blochairn Housing Co-operative asked for a review of the decision to withhold the information requested.Its request for review included arguments already put forward by Craigdale Housing Association, as outlined above.In relation to section 39(1) of FOISA, it argued that the suggestion that the community would try to identify sex offenders required further substantiation, given the size of the area and population in question, and given that public statements by the Police support what is common knowledge, that sex offenders live within every community.

26.On 14 November 2007 Strathclyde Police notified Blochairn Housing Co-operative of the outcome of its review.Strathclyde Police upheld the decision to withhold the information for the reasons previously stated in relation to sections 35(1)(a) and 39(1) of FOISA; however, Strathclyde Police withdrew their reliance on section 36(2).Strathclyde Police did not comment on any specific points raised by Blochairn Housing Co-operative.

27.On 15 November 2007, Blochairn Housing Co-operative wrote to the Commissioner.It stated that the Co-operative was unhappy with the refusal to release the information requested, and applied to him for a decision in terms of section 47(1) of FOISA.

28.The application was validated by establishing that Blochairn Housing Co-operative had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

29.Strathclyde Police were notified that an application for a decision had been received, and were asked to supply the Commissioner with a copy of the information withheld.The information was provided on 10 December 2007.

30.As all three requests to Strathclyde Police were for the same type of information, and as the reasons for refusing the requests were virtually identical in each case, it was decided to conjoin the three applications and issue one Decision Notice.

Investigation

31.The investigating officer subsequently contacted Strathclyde Police, providing them with an opportunity to provide comments on the three applications (as required by section 49(3)(a) of FOISA).It was noted that Strathclyde Police had given the Housing Associations detailed reasons for withholding the information under the exemptions cited and in relation to the public interest for and against disclosure of the information.Strathclyde Police were given an opportunity to provide any further comments or submissions which they wished the Commissioner to consider in reaching his decision.

32.Strathclyde Police responded on 25 February 2008 with some further information and comments which they wished the Commissioner to consider.

33.The Housing Associations were invited to provide their views on the public interest in disclosure of the information, and did so.

34.Following the House of Lords' ruling in the case of the Common Services Agency v Scottish Information Commissioner, Strathclyde Police were asked whether, in their view, the information withheld should be considered as personal data (as defined in the Data Protection Act 1998) and, if so, whether disclosure would contravene any of the data protection principles.On 18 August 2008, Strathclyde Police provided a submission which confirmed that the statistical information withheld was considered to be personal data, and which set out their reasons for believing that disclosure would contravene the first data protection principle.Strathclyde Police advised that they wished to cite the exemption in section 38(1)(b) of FOISA, in conjunction with section 38(2)(a)(i).

Commissioner's analysis and findings

35.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by each of the Housing Associations and by Strathclyde Police and is satisfied that no matter of relevance has been overlooked.Although the three applications have been the subject of the same investigation, he has taken account of the differing circumstances in each of the cases.As noted above, Strathclyde Police have cited a number of different exemptions in relation to the information.However, given that the Commissioner considers that the question of identifiability is central to the question of not just this, but to other exemptions cited by the Police, he will begin by addressing the question as to whether disclosure of the statistics could identify individuals.

Section 38(1)(b) – Personal information

36.As noted above, Strathclyde Police have withheld the information requested by the Housing Associations under section 38(1)(b) of FOISA.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA and if disclosure of the information would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.In this case, Strathclyde Police have indicated that they are satisfied that the statistics amount to personal data and that disclosure would breach the first data protection principle.This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met, and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.

37.Usually, the Commissioner would not comment on whether information was sensitive personal data until he had made a finding as to whether information amounted to personal data.However, given some of the references to sensitive personal data in the following discussion on identifiability, the Commissioner wishes to make it clear at this stage that, if he is satisfied that living individuals can be identified by the disclosure of the statistics (and that the statistics otherwise relate to living individuals), then the statistics will amount to sensitive personal data.This is clear from section 2 of the DPA, and in particular sections 2(g) and (h), which define information about the commission of an offence, the sentence of any court in criminal proceedings, etc., as sensitive personal data.

Are the statistics personal data?

38.The Commissioner will now go on to consider whether the information withheld meets the definition of personal data in section 1(1) of the DPA; that is, data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in full in the Appendix).It should be noted that the DPA gives effect to Directive 95/46/EC of October 1995 on The Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data and so this has a bearing on how the DPA should be interpreted.This is also clear from the comments made by Lord Hope in the Common Services Agency case (the Collie case), when he said, at paragraph 7, "In my opinion there is no presumption in favour of the release of personal data under the general obligation that FOISA lays down.The references which [FOISA] makes to provisions of [the DPA] must be understood in the light of the legislative purpose of [the DPA], which was to implement Council Directive 95/46/EC.The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data: see recital 2 of the preamble to, and article 1(1) of, the Directive.Recital 34 and article 8(1) recognise that some categories of data require particularly careful treatment.Section 2 [of the DPA], which defines the expression "sensitive personal data", must be understood in the light of this background."

39.The Housing Associations have consistently stated that they do not wish to know the identities of the RSOs represented by the statistics, and seek only anonymous statistical information.

40.In the Collie case, the House of Lords considered a request for information relating to childhood leukaemia statistics in the Dumfries and Galloway postal area.In that case, the Lords concluded that the definition of "personal data" in the DPA must, in terms of Recital 26 of EU Directive 95/46/EC (recital 26 is set out in full in the Appendix) be taken to permit the disclosure of information which had been rendered fully anonymous in such a way that individuals were no longer identifiable from it, without having to apply the data protection principles.Therefore, if individuals cannot be identified from the actual information requested, then the information is not personal data and it cannot be exempt under section 38(1)(b) of FOISA.

41.The Commissioner considered whether the statistics requested by the Housing Associations was truly anonymous information or whether it might be possible to identify individuals represented within the statistics.

42.The information which would be provided by disclosure of the statistics consists of two elements: the postcode sector defining the geographical area covered by the request and the number of RSOs living within that area.If this information is viewed in isolation it appears to be truly anonymous, in that it does not permit identification of any individual RSO represented by the statistics.

43.However, it is not sufficient to look at the statistics on their own.The Commissioner must consider the likelihood of identification.This will include a consideration of the population and geographical size of the postcode areas in question (generally speaking, the smaller the population and geographical size, the higher the likelihood that identification will occur) as well as what other information is already in the public domain which, together with the disclosure of the statistics, could lead to identification of the RSOs involved.In this regard, the Commissioner must again have regard to recital 26 to EU Directive 95/46/EC, which states that in determining whether a person is identifiable, account should be taken of all the means likely reasonable to be used by any person to identify the person.

44.According to guidance entitled "Determining what is personal data" which has been issued by the (UK) Information Commissioner (who is responsible for enforcing the DPA throughout the UK), in considering whether a person can be identified, it should be assumed that it is not just the means reasonably likely to be used by the ordinary man in the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual.The Commissioner must therefore consider not only the Housing Associations' motives in finding out the information (already detailed in this decision notice), but how other people might use the information along with other information which is already in the public domain to identify the RSOs.

45.Although the Housing Associations have made it clear that they do not wish to know the identities of the individuals covered by their requests, Strathclyde Police have provided the Commissioner with examples of determined efforts being made by members of the public to identify RSOs living in some of the areas covered by the Housing Association requests.

46.The Police also provided examples relating to the wider Strathclyde Police area and through other parts of the UK.There are examples of identification leading to assault and, in one particularly unhappy case, of a murder of someone who was mistakenly identified as an RSO.

47.The Commissioner has considered the question of identifiability from several angles.He has looked at the guidance adopted by other organisations for the "safe" (i.e. truly anonymous) disclosure of statistics relating to sensitive personal data and has considered that guidance in the light of the case before him.He has also looked at the range of information potentially available to the public about the individuals represented by the statistics.He has also looked at the information Strathclyde Police have provided about local circumstances for some of the areas covered by the Housing Associations' requests, and considered whether any of this information was relevant in assessing whether disclosure of the RSO statistics would lead to identification of individuals.

48.The Office for National Statistics (ONS) has issued guidance on preserving confidentiality in relation to the dissemination of health statistics[1]; and the United Kingdom Association of Cancer Registries (UKACR) has issued guidance on the disclosure of potentially identifiable information[2].While he is not bound by such guidance, the Commissioner acknowledges the expertise acquired by both bodies in the dissemination of statistics drawn from sensitive personal data and has found this guidance useful in coming to a decision in the current case.

49.The Commissioner has drawn the following conclusions from reading the guidance:

- The geographical and population size of the postcode sectors involved here are considerably smaller than the size deemed "safe" by ONS or UKACR, in relation to cell counts of 1 or 2.

- The geographical or population size of the sample is not necessarily the only criteria to consider in establishing whether anonymity would be preserved following disclosure; other factors may come into play.

- There may be a risk of identification through "matching" or linking with data from another source of publicly available information.

50.This strongly suggests to the Commissioner that sensitive personal data would not normally be released at the level involved here because of the likelihood that disclosure would lead to identification.It is also worth noting that while the actual population size may be considerably smaller than the size usually deemed "safe", given that the statistics relate to RSOs (a high percentage of whom will be male, and over a certain age), the actual number of people generally considered to fall within the category of possible RSOs will be further reduced.

51.The Commissioner also considered whether any additional information is generally available which might lead to identification of individuals represented by the statistics.He found that media reports of the trial or release of RSOs can indicate the individual offender's home area, although in such cases the location was usually described in broader terms than the area covered by the postcode sector.However, the Commissioner found one case where the destination address of a released RSO was indicated in some detail.

52.The Commissioner is also aware that information (and hearsay) may circulate within a community in more informal ways.As noted above, Strathclyde Police has provided the Commissioner with evidence that in some of the communities covered by the requests, residents have made active attempts to discover the identity of sex offenders living in their midst, or have taken the opportunity presented by a public meeting to voice strong opposition to sex offenders being housed in the local area.

53.It is not possible to ascertain all additional sources of information which might be used in combination with the RSO statistics by a person determined to identify the individual offender(s) in a given postcode sector.The Commissioner accepts that such additional information may serve only to strengthen suspicion rather than positively confirm the identities of those individuals.However, given the subject matter of the statistics, there is also an increased likelihood that individuals will attempt to identify some of the individuals involved, although the Housing Associations do not agree that this is the case.

54.Having considered the applications from the Housing Associations in some detail, together with the submissions from the Associations as well as from Strathclyde Police, the Commissioner has come to the conclusion that living individuals can be identified from the disclosure of the statistics.He also considers that the information clearly relates to the individuals, given that it is biographical in a significant sense and that it has the individuals as its focus.As such, the Commissioner has come to the conclusion that the statistics are personal data as defined by section 1(1) of the DPA.

55.The Commissioner considers that the position is different here from other cases where he has ordered statistics about RSOs to be disclosed.For example, in Decision 177/2007, Sam Coull and the Chief Constable of Grampian Police, the Commissioner ordered the numbers of RSOs in the Peterhead/Buchan area of Aberdeenshire to be disclosed.In that case, he took account of the geographical size of the area, the resident population of the area, the presence of any major population centres or conurbations and the number of RSOs per head of population.

56.Similarly, in Decision 222/2006 Murdo McLeod of the Scotland on Sunday and the Chief Constable of Northern Constabulary, the Commissioner ordered the number of sex offenders of no fixed abode to be disclosed.Given that Mr McLeod wanted to know the figure for the whole of the Northern Constabulary area, the Commissioner was satisfied that the size of the geographical area involved meant that the offenders would not be identified.

57.In coming to this conclusion on the question of identifiability, the Commissioner notes the comment made by the Housing Associations that the police have consistently warned the public that there are RSOs in every community.If that is the case, the Housing Associations have argued, why would the disclosure of the statistics mean that the individuals in question would be more identifiable than they are currently?

58.While the Commissioner understands the point made by the Housing Associations, he considers that there is a difference between this type of general statement made by the police and a community being advised that there is a specific number of RSOs living in the area.The Commissioner agrees with Strathclyde Police that the disclosure of actual numbers will fuel speculation and that the question of "how many" is likely soon to become "who?"As a result, he considers that - at least within the size of communities in question – the disclosure of the numbers is likely to increase the likelihood of a person trying to take steps to identify a person, or people, whom they consider to be an RSO.

59.During the investigation, the Housing Associations were asked whether aggregated statistics from more than one postcode sector might be acceptable in place of the statistics for single postcode sectors as the Commissioner considered that it might be possible to disclose statistics in an aggregated form without running the risk of identification.However, the Housing Associations gave no indication that they wished to pursue this option.Blochairn Housing Co-operative stressed the importance of being able to associate the statistics with identifiable communities, and explained that it made little sense, in terms of their request, to increase population sizes or postcode areas.Accordingly, the Commissioner did not give further consideration to the possibility of aggregated statistics being provided.

60.The Housing Associations also asked the Commissioner to state what lower limit in terms of population size he would consider to be acceptable – i.e. at what point would he consider that living individuals would no longer be able to be identified from information.That is a question which the Commissioner simply cannot answer as so much necessarily depends on the circumstances of any particular case.

Will disclosure of the sensitive personal data breach the first data protection principle?

61.However, personal data is not exempt from disclosure under FOISA simply because it is personal data.When considering the exemption cited by Strathclyde Police (section 38(1)(b) as read with section 38(2)(a)(i)), the Commissioner must go on to consider whether disclosure of the information under FOISA will breach any of the data protection principles.If the disclosure does not breach any of the principles, then the personal data should be disclosed.

62.As noted above, Strathclyde Police argued that the disclosure of the information would breach the first data protection principle.This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.Given that the Commissioner is satisfied that the statistics amount to personal data, he must find that the statistics are sensitive personal data in terms of section 2(g) and/or (h) of the DPA.Given the additional restrictions surrounding the disclosure of sensitive personal data, it makes sense to look firstly at whether there are any conditions in schedule 3 which would permit the sensitive personal data to be disclosed.

63.There are 10 conditions listed in Schedule 3 to the DPA.One of these conditions, condition 10, also allows sensitive personal data to be processed in circumstances specified in an order made by the Secretary of State and, in addition to the conditions in Schedule 3, the Commissioner has also considered the additional conditions for processing sensitive personal data as contained in legislation such as the Data Protection (Processing of Sensitive Personal Data) Order 2000.

64.As guidance from the (UK) Information Commissioner[3] has noted, it is unlikely that public authorities dealing with a request for sensitive personal data will be able to satisfy any of the Schedule 3 conditions unless it has the explicit consent for the disclosure or the information has already been made public by the individual concerned.The guidance goes on to say that this is because the other conditions concern disclosure for a stated purpose, and that it is therefore very unlikely that sensitive personal data could be released in response to a freedom of information request without consent.Clearly, consent has not been granted here.

65.In interpreting the conditions which allow sensitive personal data to be processed, the Commissioner has again considered the wording of Directive 95/46/EC and, in particular, Article 8(13) which specifically restricts the processing of data relating to offences and criminal convictions and only allows such data to be processed under the control of official authority, or if suitable specific safeguards are provided under national law (subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards).

66.While the Housing Associations have not made any representations to the Commissioner as to which – if any – of the Schedule 3 conditions they consider to apply here (their arguments were, understandably, focussed on the question of identifiability), the Commissioner has taken account of their representations in relation to the CEOP website (addressed below) and to other matters raised by them regarding the rights and freedoms of the communities they represent and the individuals within those communities.The Housing Associations consider that the poorest, most vulnerable people in Scotland are being disproportionately burdened as a result of the number of RSOs being housed in the areas in question and they want to access the statistical information to prove that this is the case.

67.As noted above, the Housing Associations referred to information which is disclosed via the CEOP website.CEOP is part of the UK police and work to protect children from sexual abuse.CEOP builds intelligence around the risks, tracks and brings offenders to account and works with children and parents to deliver its unique educational programme.

68.The website has a "Most Wanted" section, which, at the time of writing, contains photographs of four offenders who have failed to comply with the notification requirements under the Sexual Offences Act 2003 and who are currently wanted by the CEOP Centre.The offenders are named and their profile includes details such the area in which they were last known to reside and their physical description.The Housing Associations have questioned why statistics relating to registered sex offenders are being withheld, while the likes of the CEOPS website contains photographs of known offenders who have failed to comply with their notification requirements.

69.It is clearly outwith the remit of the Commissioner to comment on the legal basis for such information being processed on the CEOP website, although he notes that, amongst other conditions, paragraphs 1 of the Schedule to the Data Protection (Processing of Sensitive Personal Data) Order 2000 permits the disclosure of sensitive personal data where that disclosure is in the substantial public interest and where disclosure is necessary for the purposes of the prevention and detection of any unlawful act and paragraph 10 permits sensitive personal data to be disclosed where the processing is necessary for the exercise of any functions conferred on a constable by any rule of law(these paragraphs are set out in full in the Appendix).

70.Having considered carefully each of the conditions which allow sensitive personal data to be processed, the Commissioner has come to the conclusion that there are no conditions which would permit the statistics relating to the numbers of RSOs to be disclosed into the public domain.The tests are necessarily high, given the wording of Directive 95/46/EC.

71.As a result, the Commissioner has concluded that there are no conditions in Schedule 3 which would permit the information to be disclosed.He therefore finds that disclosure of the information would breach the first data protection principle and that the information is exempt from disclosure under section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i).

Other exemptions cited by the Police

72.As the Commissioner has found that the information requested is exempt from disclosure under section 38(1)(b) of FOISA, he does not consider it necessary to consider whether the other exemptions cited by Strathclyde Police also apply to the information, particularly given that the application of those exemptions will largely depend on whether individuals can be identified from the disclosure of the statistics in question.

Additional comments

73.During the investigation, the Housing Associations provided the Commissioner with a copy of a literature review which the Glasgow and West of Scotland Forum of Housing Associations commissioned ODS Consulting Ltd to carry out in August 2008, with the aim of building a clear picture of the research that has been undertaken in relation to housing sex offenders.The report itself was published in November 2008.One of the suggested steps recommended by ODS Consulting Ltd was that more information should be provided about the distribution of registered sex offenders in the community, perhaps down to the level of four unit post codes.

74.The Commissioner has read this report with some interest, but has noted that there appears to be little in the report which gave rise to this recommendation.If there had been, then this might have given more weight to the matters which the Commissioner had to consider in deciding whether there were any conditions in Schedule 3 which would have permitted the statistics to be disclosed.

75.The Commissioner is not at all unsympathetic to the reasons advanced by the housing associations for wishing to have the information disclosed and does not doubt that their purpose is to establish whether there is an issue as to where registered sexual offenders are housed rather than to identify individual offenders. However as this decision notice explains where disclosure would require the release of sensitive personal information, then it is very unlikely that this can be justified under FOISA. In the Commissioner's view the likelihood of identification of a registered sexual offender from the release of such statistics for such specific postcode areas is such that the exemption from disclosure provided for by FOISA must apply.

DECISION

The Commissioner finds that the Chief Constable of Strathclyde Police acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information requests made by Craigdale Housing Association, Dunbritton Housing Association and Blochairn Housing Co-operative.

Appeal

Should either Craigdale Housing Association, Dunbritton Housing Association or Blochairn Housing Co-operative (in relation to the application made by it) or the Chief Constable of Strathclyde Police wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
16 February 2009

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6)This section is subject to sections 2, 9, 12 and 14.

38 Personal information

(1) Information is exempt information if it constitutes-

(…)

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(…)

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles;

…

Data Protection Act 1998

1 Basic interpretative provisions

In this Act, unless the context otherwise requires –

…

"personal data" means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

(a)the racial or ethnic origin of the data subject,

(b)his political opinions,

(c)his religious beliefs or other beliefs of a similar nature,

(d)whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),

(e)his physical or mental health or condition,

(f)his sexual life,

(g)the commission or alleged commission by him of any offence, or

(h)any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

Schedule 1 – The data protection principles

Part I – The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

The Data Protection (Processing of Sensitive Personal Data) Order 2000

Schedule (Circumstances in which sensitive personal data may be processed)

1(1)The processing –

(a)is in the substantial public interest;

(b)is necessary for the purposes of the prevention and detection of any unlawful act; and

(c)must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice those purposes.

(2)In this paragraph, "act" includes a failure to act.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

Recital 26

Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable; whereas codes of conduct within the meaning of Article 27 may be a useful instrument for providing guidance as to the ways in which data may be rendered anonymous and retained in a form in which identification of the data subject is no longer possible;

The Data Protection (Processing of Sensitive Personal Data) Order 2000

Schedule: Circumstances in which sensitive personal data may be processed

1(1)The processing -

(a)is in the substantial public interest;

(b)is necessary for the purposes of the prevention or detection of any unlawful act; and

(c)must necessarily be carried out without the explicit consent of the data subject sought so as not to prejudice those purposes.

(2)In this paragraph, "act" includes a failure to act.

…

10The processing is necessary for the exercise of any functions conferred on a constable by anyrule of law.

 

 

Link to PDF file of decision 014/2009 (152 kb)

Back to Top