Decision 010/2022: Emails from named company
Public authority: Lothian Health Board
Case Ref: 202001443
Summary
NHS Lothian was asked for emails sent from or received by the Western General Hospital, referring to a specified company name and falling within a stipulated timeframe. No information was identified until the Commissioner investigated and required more extensive searches.
The Commissioner was satisfied with those searches by the end of the investigation, but required information to be disclosed to the Applicant.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 17(1) (Notice that information is not held)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 8 July 2020, the Applicant made a request for information to Lothian Health Board (NHS Lothian). The information requested was all emails, or copies of emails, sent from or received by NHS Lothian's Western General Hospital and referring to a named company. The Applicant stipulated the information should cover the period from 1 January 2019 to the date of the request.
2. NHS Lothian responded on 4 August 2020, providing notification in terms of section 17(1) of FOISA that it did not hold the requested information.
3. On 10 August 2020, the Applicant emailed NHS Lothian, requesting a review of its decision as he believed the authority's searches and response were deficient.
4. NHS Lothian was late in notifying the Applicant of the outcome of its review on 6 November 2020, in which it upheld its original response. NHS Lothian explained that staff were asked to check for relevant information - no staff were aware of receiving any.
5. On 6 January 2021 the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of NHS Lothian's review because he had supporting evidence of relevant emails. He explained why he believed the searches conducted by NHS Lothian were deficient.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 8 January 2021, NHS Lothian was notified in writing that the Applicant had made a valid application.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Lothian was invited to comment on this application and to answer specific questions. These focused on the searches carried out by NHS Lothian which led it to conclude that it held no information falling within the scope of the request.
Commissioner's analysis and findings
9. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and NHS Lothian. He is satisfied that no matter of relevance has been overlooked.
10. The Applicant has queried whether NHS Lothian has fully addressed what was actually specified in his request and has detailed an example of an email which he believes ought to have been located and disclosed to him.
Whether information held
11. In its responses to the Applicant, and at the beginning of the Commissioner's investigation, NHS Lothian maintained that it held no information falling within the scope of the request, having asked a number of staff whether they could locate relevant information in their mailboxes and any systems they considered relevant.
12. The standard proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information . While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
13. On 22 February 2021, NHS Lothian informed the Commissioner that, at the time of the Applicant's request, staff within the relevant Department at the Western General Hospital were asked to check their emails by the Service Manager and Site Director. This was done, but no information was found at that time.
14. NHS Lothian was asked further questions about its searches (23 February 2021) and, on 1 April 2021, gave further clarification on how individual mailboxes were searched for relevant information. It confirmed that any searches were carried out by the individuals whose mailboxes were being searched, rather than by its central IT function.
15. The investigating officer shared details of an email dated 5 August 2019, provided by the Applicant as supporting evidence. NHS Lothian was asked to perform further, more focused searches, and did so. NHS Lothian was also invited to comment on whether this email should have been located during searches (and why it was not identified).
NHS Lothian's further submissions
16. With regard to any central electronic search, NHS Lothian submitted that these would need the permission of the individuals concerned and general searches were not normally performed for GDPR, time and complexity reasons. On this occasion, relevant permissions were given during the investigation and an electronic search of certain mailboxes was conducted during this investigation.
17. NHS Lothian (4 June 2021) explained how details were not picked up within email trails and why the information in question was only found by searching for specific wording within the subject heading of emails.
18. On 7 July 2021, NHS Lothian provided supporting evidence of further searches, completed by IT Security and covering the period January 2018 to January 2021. In particular, NHS Lothian noted the effectiveness (in terms of outcomes) of adding new search terms.
19. On 9 September 2021, NHS Lothian outlined additional checks staff had undertaken on their own mailboxes during this investigation, identifying the staff involved. NHS Lothian identified information (provided to the investigating officer on 23 September 2021) received by the Western General which fell within the scope of the request (email dated 27 September 2019 08:49 within "Combined emails" document). This information does not appear to have been provided to the Applicant, once it was discovered.
The Commissioner's findings
20. Having considered all of the relevant submissions and the terms of the Applicant's request, the Commissioner accepts that (by the close of the investigation) NHS Lothian had conducted adequate searches and located any information it held and which fell within the scope of the request. However, he also finds that it failed to do so fully in dealing with the Applicant's request or requirement for review, and thereby failed to comply with section 1(1) of FOISA.
21. The Commissioner requires NHS Lothian to disclose the information in the single email dated 27 September 2019 (other than any third-party personal data), by 14 March 2022.
Decision
The Commissioner finds that Lothian Health Board (NHS Lothian) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA)
The Commissioner finds that, by incorrectly informing the Applicant that it did not hold information failing within the scope of the request, NHS Lothian failed to comply with section 1(1) of FOISA.
The Commissioner requires NHS Lothian to disclose the information in the email of 27 September 2019 (subject to redaction of third-party data), by 7 March 2022.
Appeal
Should either the Applicant or NHS Lothian wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If NHS Lothian fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that NHS Lothian has failed to comply. The Court has the right to inquire into the matter and may deal with NHS Lothian as if it had committed a contempt of court.
Margaret Keyse
Head of Enforcement
19 January 2022
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish NHS Lothian which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
…
