Decision 085/2022: Interim Vulnerable Person’s Database: DPIAs
Public authority: Scottish Ministers
Case Ref: 202100010
The Ministers were asked for DPIAs relating to the interim Vulnerable Person’s Database. The Ministers told the Applicant they did not hold the information. The Commissioner investigated and was satisfied that the information was not held.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 17(1) (Notice that information is not held)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
1. On 2 November 2020, the Applicant made a request for information to the Scottish Ministers. (the Ministers). He asked for:
All versions of the Data Protection Impact Assessment (DPIA) for the [interim Vulnerable Person’s Database] that the Scottish Government received from Police Scotland, information that was also sent to the Information Commissioner’s Office (ICO).
2. The Ministers notified the Applicant on 24 November 2020, in terms of section 17(1) of FOISA, that they did not hold the information. They suggested the Applicant ask Police Scotland for the information.
3. On 29 November 2020, the Applicant wrote to the Ministers requesting a review of their decision. He did not accept that the Ministers did not hold the information.
4. On 29 December 2020, the Ministers issued their review decision to the Applicant. They confirmed that they did not hold the information.
5. On 31 December 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. He remained of the view that the Ministers held the information.
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its responses to those requests before applying to him for a decision.
7. On 24 February 2021, the Ministers were notified in writing that the Applicant had made a valid application. The case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Ministers were invited to comment on this application and to answer specific questions. These related to searches undertaken and the reasons for concluding that the Ministers did not hold the information requested by the Applicant.
Commissioner’s analysis and findings
9. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and Ministers. He is satisfied that no matter of relevance has been overlooked.
Whether information was held
10. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable in this case.
11. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with the information an applicant believes an authority should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to this effect.
12. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reasons offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations as to what information the authority should hold, ultimately the Commissioner’s role is to determine what information is actually held by the public authority (or was, at the time the request was received).
Submissions from the Applicant
13. The Applicant set out in detail why he believed that the Ministers must have a copy of the DPIA. For example, he noted that:
(i) the Vulnerable Person’s Database (VPD) was a central part of the Scottish Government’s Named Persons Scheme. Therefore, Police Scotland must have passed the DPIA on to the Ministers.
(ii) given that the Open Rights Group had raised serious concerns about the DPIA with the Justice Committee, the Cabinet Secretary for Justice must have required Police Scotland to provide a copy of the DPIA
(iii) the Applicant had made a complaint to the ICO – given that the Justice Committee of the Scottish Parliament had been in communication with the ICO, the Scottish Government must be aware of the privacy issues raised.
Submissions from the Ministers
14. The comments from the Applicant were shared in full with the Ministers.
15. The Ministers confirmed they had undertaken searches of their electronic management system. They specified the search terms they had used. They note that the returns received were limited to correspondence relating to this and other FOI requests received on this topic.
16. The Ministers noted that Police Scotland act independently of Scottish Ministers, particularly when it comes to operational matters. Consequently, there would be no business reason for the Ministers to be sighted on a DPIA of the nature requested.
17. The Ministers would only receive DPIAs from Police Scotland if it was for a project in which they would be joint controllers. This is not the case here.
18. While the Ministers may have taken part in discussions to ensure that Police Scotland and other bodies were able to share operational information in a legal and proportionate manner, they have not seen the DPIA and do not hold details of any discussions which could have taken place.
19. The Ministers also noted that the Scottish Police Authority (SPA) have an oversight role in scrutinising policing in Scotland and holding the Chief Constable to account; and its supportive role in maintaining and improving the police service in Scotland. In this instance, the Ministers would expect the SPA to check that Police Scotland was at all times acting lawfully in relation to any data processing, and for the SPA to bring any issues to the Ministers’ attention. Even if an issue was raised in relation to processing of personal data, there would be no requirement for the Ministers to be sighted on the DPIA in these circumstances.
The Commissioners’ findings
20. As stated above, the standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner will consider the scope, quality, thoroughness and results of the searches carried out by the authority. He will also consider, where appropriate, any reason offered by the public authority to explain why the information is not held.
21. The Applicant clearly believes that the Ministers must and should hold the information.
22. The Ministers have specified the searches they have carried out to locate any information falling within the scope of the request. The Commissioner is satisfied that the searches were reasonable and would have been sufficient to locate and identify any information, if held.
23. The Commissioner also accepts the arguments from the Ministers as to why they would not expect to hold this information.
24. In the circumstances, the Commissioner is satisfied, on the balance of probabilities, that the Ministers did not (and do not) hold the information falling within the scope of the Applicant’s request.
The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.
Should either the Applicant or the Scottish Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Scottish Information Commissioner
25 July 2022
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
17 Notice that information is not held
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.