Decision 041/2022: Emails referring to a named person
Public authority: Lothian Health Board
Case Ref: 202100625
Summary
NHS Lothian was asked for emails held which refer to a named person, covering a specified timeframe. NHS Lothian disclosed some information, but the Applicant believed more information was held.
The Commissioner investigated and asked NHS Lothian to carry out additional searches. By the end of the investigation, he was satisfied there was no further information held.
He also found NHS Lothian had breached statutory timescales when responding.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 10(1) (Time for compliance); 17(1) (Notice that information is not held); 21(1) (Review by Scottish public authority)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 29 January 2021, the Applicant made a request for information to Lothian Health Board (NHS Lothian). The information requested was “all emails, or copies of emails, held by NHS Lothian which refer to [named person]” covering the period 1 January 2018 to present.
2. On 8 March 2021, the Applicant wrote to NHS Lothian requesting a review, stating that the statutory timescale permitted under FOISA had elapsed without response.
3. No review was forthcoming from NHS Lothian and the Applicant submitted an appeal on procedural grounds to the Commissioner who contacted NHS Lothian on 20 April 2021 inviting comment.
4. In response to that appeal, NHS Lothian conducted a review and issued a review decision to the Applicant on 13 May 2021. In that review, NHS Lothian informed the Applicant that the request and the requirement for review had not been received. NHS Lothian disclosed information in relevant emails (but not the details of less senior staff).
5. On 8 May 2021, the Applicant wrote to the Commissioner, applying for a decision (on substantive grounds) in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of NHS Lothian’s review, believing that more information ought to have been located during searches and then provided (with explanations as to why this would be the case). The Applicant did not accept NHS Lothian’s comments that, in effect, it had not received the request or the requirement for review.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 18 May 2021, NHS Lothian was notified in writing that the Applicant had made a valid application and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Lothian was invited to comment on this application and to answer specific questions. These related to searches undertaken and the time taken to respond to both the request and the requirement for review.
Commissioner’s analysis and findings
9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and NHS Lothian. He is satisfied that no matter of relevance has been overlooked.
10. The Applicant has queried whether NHS Lothian has fully addressed what was actually specified in his request and has detailed an example of an email which he believes ought to have been located and disclosed to him.
Whether information held
11. In its responses to the Applicant, and during this investigation, NHS Lothian maintained that it held no information falling within the scope of the request, having asked a number of staff whether they could locate relevant information in their mailboxes and any systems they considered relevant.
12. The standard proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information . While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner’s role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
13. NHS Lothian informed the Commissioner that the searches conducted were extended from those conducted for a related request. For context here, those searches are described in Decision 010/2022 – para 13 onwards. Decision 010/2022 resulted in the information in a single email being supplied to the Applicant. NHS Lothian explained who was involved in the searches, the resources searched and the timeframes applied. The authority’s central IT function was also involved in searches.
14. NHS Lothian supplied the Commissioner with detailed evidence of the searches carried out, including screen shots of the search terms involved to evidence how the searches have been conducted and demonstrate the outcomes. NHS Lothian also provided its policy documents for Information Governance, Records Management, Digital IT Security and Email Transmission.
The Commissioner’s findings
15. As explained above, the Commissioner is aware that the information located during this investigation was caught by a previous request by this Applicant, dated 8 July 2020, which was the subject of Decision 010/2022. The request under consideration here, although framed to cover the whole authority and covering a broader timescale than that previous request, is essentially for the same information.
16. Having considered all of the relevant submissions and the terms of the Applicant’s request, the Commissioner accepts that (by the close of the investigation) NHS Lothian had conducted adequate searches and located any information it held and which fell within the scope of the request. However, he also finds that it failed to do so in dealing with the Applicant’s request or requirement for review, and thereby failed to comply with section 1(1) of FOISA.
Timescales
17. The Applicant has expressed dissatisfaction with NHS Lothian’s alleged failure to respond within statutory timescales to both his request and his requirement for review.
18. NHS Lothian was invited to comment on these areas of dissatisfaction, and did so (19 July 2021) noting a technical issue with the individual mailbox itself (but not the email system). The Applicant’s request was correctly addressed to NHS Lothian and there is no evidence to suggest it did not arrive in NHS Lothian’s computer network, albeit that the particular mailbox in that email system may potentially have been malfunctioning at that point.
19. In the circumstances, the Commissioner is satisfied that the request was received by NHS Lothian, as was the Applicant’s requirement for review.
20. Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the request to comply with a request for information. This is subject to qualifications which are not relevant in this case.
21. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review. This is subject to qualifications which are not relevant in this case.
22. It is a matter of fact that NHS Lothian did not provide a response to the Applicant’s request for information, or the Applicant’s requirement for review, within 20 working days in each case, so the Commissioner finds that it failed to comply with sections 10(1) and 21(1) of FOISA.
Decision
The Commissioner finds that Lothian Health Board (NHS Lothian) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the Applicant’s request.
The Commissioner finds that, by failing to identify and locate all the relevant information it held in response to the Applicant’s request or requirement for review, NHS Lothian failed to comply with section 1(1) of FOISA.
By the conclusion of this investigation, he was satisfied no further information was held but decided that NHS Lothian failed to respond to the Applicant’s request for information and requirement for review within the timescales laid down by sections 10(1) and 21(1) of FOISA.
Given the information now disclosed to the Applicant in respect of Decision 010/2022, the Commissioner does not require any further steps to be taken by NHS Lothian in respect of this decision.
Appeal
Should either the Applicant or NHS Lothian wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
12 April 2022
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish NHS Lothian which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
10 Time for compliance
(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-
(a) in a case other than that mentioned in paragraph (b), the receipt by the authority of the request; or
(b) in a case where section 1(3) applies, the receipt by it of the further information.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
…
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
…
