Decision 127/2021: Data Controllers and Processors, MARAC meetings
Public authority: Chief Constable of the Police Service of Scotland
Case Ref: 202100097, 202100117, 202100118
Summary
Police Scotland received three requests in which they were asked for specified details of data controllers and processors at "MARAC" meetings. Some information was disclosed, but the Applicant believed more was held.
Following an investigation, the Commissioner was satisfied that Police Scotland did not hold more information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (4) (General entitlement); 17(1) (Notice that information is not held)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. It may be helpful to explain that a Multi-Agency Risk Assessment or "MARAC" is a local meeting where representatives from statutory and non-statutory agencies meet to discuss individuals at high risk of serious harm or murder as a result of domestic abuse.[1]
Request 1
2. On 4 November 2021, the Applicant wrote to the Chief Constable of the Police Service of Scotland (Police Scotland) and made the following request for information involving "MARAC" meetings. The Applicant asked for the following information:
When Police Scotland have acted as a Data Controller and passed (false) information onto a local authority social work system via the conduit of the iVPD, what is the formal process whereby a Data Subject identifies all of the Data Controllers [who Police Scotland may not have a formal Information Sharing Agreement (ISA) with] who were present at the MARAC when that (false) information was generated?
3. Police Scotland responded to request 1 on 3 December 2020, notifying the Applicant (in terms of section 17(1) of FOISA) that the information was not held.
4. On 2 January 2021, the Applicant wrote to Police Scotland requesting a review of their decision for request 1, challenging the claim that no information was held given the need to keep accurate records in such a context.
5. Police Scotland notified the Applicant of the outcome of their review on 20 January 2021, upholding their response to the effect that the information was not held.
Requests 2 and 3
6. On 29 November 2021, the Applicant wrote two letters to Police Scotland, each containing a further request for information on MARAC meetings at (i) Stirling, Clackmannanshire or Falkirk and (ii) Midlothian, Scottish Borders and West Lothian. The first of these requests concerned C Division (Forth Valley) and the second J Division (The Lothians and Scottish Borders). For each Division, the information requested was:
- The dates in November and December 2018 when a Division Police Scotland officer (or officers) participated in a MARAC.
- The Data Controllers (as defined by the Data Protection Act 2018) that Police Scotland recorded as being part of the MARAC (for each MARAC location).
- The Data Processors (as defined by the Data Protection Act 2018) that Police Scotland recorded as being part of the MARAC (for each MARAC location).
7. On 3 and 11 January 2021, the Applicant wrote to Police Scotland, requesting the information for requests 2 and 3 again, commenting that there was a public interest in disclosing the information.
8. On 21 January 2021, Police Scotland responded in a letter addressing both requests with an apology for the lateness of response. Police Scotland disclosed the dates requested, but notified the Applicant in terms of section 17(1) of FOISA that no information was held for the other elements of these requests.
9. On 20 (request 1) and 24 January 2021 (requests 2 and 3), the Applicant wrote to the Commissioner, applying for a decision for all three requests in terms of section 47(1) of FOISA. The Applicant stated they were dissatisfied with the outcome of Police Scotland's review because they remained of the view that information must be held by Police Scotland in order to comply with data protection legislation.
Investigation
10. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that those requests before applying to him for a decision.
11. Police Scotland were notified in writing that the Applicant had made three valid applications. The dates of these notifications were 23 and 24 February 2021 (requests 2 and 3) and 5 March 2021 (request 1). All three cases were then allocated to an investigating officer.
12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 1 July 2021, Police Scotland was invited to comment on all three applications and to answer specific questions, focusing on the steps taken to identify and locate any information, if held, which fell within the scope of the requests.
13. Police Scotland responded on 8 July 2021. They maintained that they did not hold any information, other than that already disclosed. As stated above, some information was identified and disclosed by Police Scotland at the time of asking. The Applicant does not appear to have complained about this disclosure: rather the complaint is that more information is held, so the disclosed information need not be considered further in this decision.
Commissioner's analysis and findings
14. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and Police Scotland. He is satisfied that no matter of relevance has been overlooked.
15. The Applicant's submissions include statements about data sharing arrangements for MARAC meetings, based on the Applicant's own understanding of various processes and pieces of legislation (outwith FOISA). It is clear from these submissions that the Applicant believes more information is recorded and ought to be provided. The Applicant also stated there was a public interest in making the information in question available.
16. It may be helpful to clarify that the public interest test in FOISA could only be relevant in these cases if information were recorded and if Police Scotland had cited an exemption (which was subject to the public interest test) to withhold that information. This is not the situation here. Police Scotland simply maintains they do not record the information and therefore it is not held. This is the issue the Commissioner must now consider.
Whether more information was held
17. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable in this case.
18. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the authority should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.
Searches
19. In their submissions, Police Scotland described how they had interpreted the three requests and what steps they took to identify any information covered by the requests.
20. For request 1, Police Scotland explained that there were no Police Scotland documents covering the very specific circumstances described by the Applicant but that "the general rules would apply". Police Scotland explained what it meant by general rules - it confirmed that neither its Data Protection nor its Subject Access Requests SOPs (Standard Operating Procedures) contained any of the information sought. These procedures, along with advice on the Police Scotland website, were the only recorded information regarding how the relevant processes worked.
21. For requests 2 and 3, Police Scotland indicated that the Applicant had made a substantial volume of requests (both FOIs and Subject Access Requests) at that point and that Police Scotland felt it best to take requests 2 and 3 here "literally" and "in accordance with the definitions of a data controller and data processor" which the Applicant himself referred to in these requests.
22. Police Scotland indicated that the Chief Constable and others (for example, Stirling Council) would be the Data Controllers at the MARAC meetings, but that information would not be recorded specifically on a meeting-by-meeting basis. Police Scotland explained that there was no requirement to record the Data Controller details for instances of information sharing.
23. Police Scotland stated that it had previously directed the Applicant to its privacy notices, which set out in general terms the categories of organisations with whom information may be shared. It had also provided him previously with the relevant Data Protection Impact Assessment, referred to in his application to the Commissioner.
The Commissioner's findings
24. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner must first of all consider the interpretation and scope of the request and thereafter the quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. Ultimately, however, the Commissioner's role is to determine what relevant information is actually held by the public authority (or was, at the time it received the request).
25. Having considered all relevant submissions, and the terms of the request under consideration, the Commissioner accepts that Police Scotland interpreted the Applicant's requests reasonably and took adequate, proportionate steps in the circumstances to establish what information they held.
26. Given the explanations and other submissions provided, the Commissioner is satisfied that Police Scotland do not (and did not, on receiving the requests) hold the information requested by the Applicant and were correct to give the Applicant notice, in terms of section 17(1) of FOISA, that they held no such information. Although the Applicant believed specified information would exist and be recorded in a particular way, the Commissioner is satisfied that this was not the case.
Decision
The Commissioner finds that the Chief Constable of the Police Service of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or Police Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
2 September 2021
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
…
