Decision 087/2022: Date on which DPIA received from Police Scotland
Public authority: Scottish Ministers
Case Ref: 202100718
Summary
The Ministers were asked when they had received a specified DPIA from Police Scotland. The Ministers told the Applicant they had not received any DPIAs from Police Scotland, so did not hold the information. The Commissioner investigated and was satisfied that the Ministers did not hold the information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 17(1) (Notice that information is not held)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 3 May 2021, the Applicant made an information request to the Scottish Ministers (the Ministers). He asked for:
… the recorded date (or dates), since Monday 15 July 2019, when the Scottish Government received the Data Protection Impact Assessment (DPIA) from Police Scotland (including any draft DPIA documents) for the sharing of Special Category (SC) and Criminal Offence (CO) data on Data Subjects with 3rd Sector Partners and Advocacy services (i.e. “Criminal Justice Partners”) in the absence of the Consent of the Data Subject, with Public Task as being the lawful basis for the data sharing.
2. The Ministers responded on 6 May 2021. They notified the Applicant, in terms of section 17(1) of FOISA, that they did not hold the information. They advised the Applicant that they had not received any DPIAs from Police Scotland.
3. On 11 May 2021, the Applicant wrote to the Ministers requesting a review of their decision. He did not accept that the information was not held. He explained why.
4. The Ministers notified the Applicant of the outcome of their review on 2 June 2021. They confirmed that they did not hold the information. They noted that Police Scotland is a separate public authority body and is answerable to the (UK) Information Commissioner’s Office on compliance with data protection law.
5. The Ministers also advised the Applicant that the Scottish Police Authority maintains strategic oversight of Police Scotland (not the Ministers). They provided the Applicant with a link to an audit of both Police Scotland’s and the Scottish Police Authority’s compliance with data protection in 2020, which had been carried out by a third party.
6. On 9 June 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant did not agree that the information was not held and expressed surprise that the Ministers would not have demanded a copy of the DPIA from Police Scotland.
Investigation
7. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
8. On 17 June 2021, the Ministers were notified in writing that the Applicant had made a valid application. The case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Ministers were invited to comment on this application and to answer specific questions.
Commissioner’s analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and Ministers. He is satisfied that no matter of relevance has been overlooked.
Whether information was held
11. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable in this case.
12. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4) of FOISA. This is not necessarily to be equated with the information an applicant believes an authority should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to this effect.
13. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reasons offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations as to what information the authority should hold, ultimately the Commissioner’s role is to determine what information is actually held by the public authority (or was, at the time the request was received).
Submissions from the Applicant
14. As noted above, the Applicant did not agree that the Ministers did not hold information. He clearly expected that the Ministers would have demanded a copy of the DPIA from Police Scotland. His application set out in detail why.
Submissions from the Ministers
15. The application was shared with the Ministers to allow them to address the points raised by the Applicant.
16. The Ministers confirmed that they had undertaken a search across their records management system for the information the Applicant had requested. They advised the Commissioner of the search terms they had used and noted that the returns received were limited to correspondence relating to this and another information request received on this subject.
17. The Ministers advised that the case handler was aware, from knowledge of working in the Police Division of the Scottish Government, that the Ministers are not required to see or hold DPIAs for third parties, including for Police Scotland.
18. As the Ministers had advised the Applicant, it is the Scottish Police Authority which has an oversight role in scrutinising policing in Scotland and holding the Chief Constable to account. This would, the Ministers expected, include checking that Police Scotland was complying with data protection laws. The Ministers noted that, even if an issue arose, there was no requirement for the Ministers to be sighted on the DPIA: DPIAs would only be received from Police Scotland if it related to a project in which the Ministers would be joint controllers. That is not the case here.
The Commissioners’ findings
19. As stated above, the standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner will consider the scope, quality, thoroughness and results of the searches carried out by the authority. He will also consider, where appropriate, any reason offered by the public authority to explain why the information is not held.
20. The Applicant believes that the Ministers should hold the information.
21. The Ministers have specified the searches they have carried out to locate any information falling within the scope of the request. The Commissioner is satisfied that the searches were reasonable and would have been sufficient to locate and identify any information, if held.
22. The Commissioner also accepts the arguments from the Ministers as to why they would not expect to hold this information.
23. In the circumstances, the Commissioner is satisfied, on the balance of probabilities, that the Ministers did not (and do not) hold the information falling within the scope of the Applicant’s request.
Decision
The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or the Scottish Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Daren Fitzhenry
Scottish Information Commissioner
25 July 20202
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
...
