Decision 165/2007 Mr S and the City of Edinburgh Council
Access to deceased person's social work records
Applicant: Mr S
Authority: City of Edinburgh Council
Case No: 200601495
Decision Date: 20 September 2007
Kevin Dunion
Scottish Information Commissioner
Request to access social work file of deceased mother ? information withheld under sections 26(a) and 36(2) of FOISA ? Commissioner upheld decision to withhold
Relevant Statutory Provisions and Other Sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections: 1(1) (General entitlement); 2(1) and (2)(b) and (c) (Effect of exemptions); 26(a) (Prohibitions on disclosure); 36(2) (Confidentiality) and 38(1)(a), (b) and (d), (2) and (5) (definition of "health record")
Data Protection Act 1998 (DPA): sections 1(1) (Basic interpretative provisions) (definition of "personal data") and 69(1) (Meaning of health professional)
Access to Health Records Act 1990 (AHRA) sections: 1(1) and (2) ("Health record" and related expressions); 2 (Health professionals) and 3(1)(f) (Rights of access to health records)
Human Rights Act 1998 (HRA) section 6(1) (Acts of public authorities)
European Convention on Human Rights (ECHR) Article 8
The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Facts
Mr S requested a copy of his late mother's social work file from the City of Edinburgh Council (the Council). The Council refused to supply Mr S with the file. Following an investigation, the Commissioner found that information contained in the file was exempt from disclosure in terms of section 26(a) of the Freedom of Information (Scotland) Act 2002 (FOISA) in that release of the information in the file would breach Article 8 of the European Convention on Human Rights (ECHR).The Commissioner also found that the release of much of the information in the file was exempt under section 36(2) of FOISA in that disclosure would constitute an actionable breach of confidence.
Background
1.On 15 May 2006, Mr S wrote to the Council requesting the social work file of his late mother.
2.The Council refused to let Mr S access to this file on the basis that his mother could not consent to the disclosure.In a follow-up letter, the Council clarified that it considered that the information was exempt under section 36 (Confidentiality) of FOISA.
3.On 14 July 2006, Mr S wrote to the Council requesting it to review its decision not to disclose the file. Mr S highlighted to the Council that he had received elements of his late mother's social work records in response to a request he had made under the Access to Health Records Act 1990 (AHRA).
4.The Council carried out a review and upheld its decision to refuse Mr S's request.The Council confirmed that it was relying on section 36(2) to withhold the information (the previous reference had been to "section 36").In addition, the Council relied on the exemption in section 26(a) of FOISA. I will address these exemptions below.
5.The Council also explained to Mr S that it did not consider social work records to fall within the definition of health records.As such, they were not accessible under the AHRA.
6.On 15 September 2006, Mr S wrote to my Office, stating that he was dissatisfied with the outcome of the Council's review and applying to me for a decision in terms of section 47(1) of FOISA.
7.The application was validated by establishing that Mr S had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to that request.
8.On 10 January 2007, following an unsuccessful attempt by my Office to resolve this case informally, the Council was asked to provide my Office with specified information required for the purposes of the investigation.On receipt, the case was allocated to an investigating officer.
The Investigation
9.The investigating officer subsequently contacted the Council, asking it to provide comments on the application and to respond to specific questions on the application.
10.Within its submissions to my Office, dated 6 February 2007 (and, later, on 14 June 2007), the Council submitted that it considered that the exemptions in sections 30(b)(i) and (ii) and (c) (Prejudice to effective conduct of public affairs) also applied to the social work file.
The Commissioner's Analysis and Findings
11.At the outset of this investigation, Mr S was advised by my Office that FOISA is designed to be "applicant blind".On that basis, the fact that it was his own mother's file which Mr S wanted to access could not be taken into account in coming to a decision on the application.Mr S was also advised that the effect of releasing the file under FOISA would be to release the contents of the file into the public domain.However, Mr S chose to continue with his application as he wished to resolve the anomaly between the (albeit limited) right to access health records of the deceased under the AHRA and the apparent lack of a right to access social work records of the deceased.
12.I will consider two separate aspects of Mr S's application in this decision, i.e.:
whether the information held by the Council is accessible under the AHRA.I wish to be clear that while I do not have any responsibility for the AHRA, I consider that it is important for me to look at the exemption for the AHRA contained in section 38(1)(d) of FOISA, given the subject matter of the decision and
whether the information contained in the file is otherwise exempt from release under FOISA.
FOISA, DPA and AHRA
13.Section 38 of FOISA provides certain exemptions in relation to personal information.None of these exemptions were actually relied on by the Council, for reasons which will become clear.However, given Mr S's comments about having accessed some of his mother's social work records under the AHRA, I think it is useful to give some background to the relationship between the FOISA, the Data Protection Act (DPA) and the AHRA.
14.Under section 38(1)(b) of FOISA, personal data is exempt from release in certain circumstances (most notably if the release of the personal data would breach any of the data protection principles contained in the DPA).Having looked at the information contained in the social work file, it is clear that this information would, while Mrs S was alive, have been her personal data.Although I am not required to make a judgement on this matter, I also consider that the information would most likely have been exempt from release under section 38(1)(b) of FOISA if Mrs S were still alive.
15.However, section 38(1)(b) only applies in relation to personal data and data can only be personal data if it relates to a living individual (section 1(1) of the DPA).As a consequence, once a person has died, information relating to him/her is no longer considered to be personal data and the exemption set out in section 38(1)(b) of FOISA can no longer apply.
16.It is important to note that Mrs S had the right to access her own social work file under the DPA while she was still alive and could, if she had chosen to, consented to Mr S having access to the file.This explains why the Council told Mr S in its original response to his information request that it could not disclose the file to him because her mother could not now consent to the disclosure.(I should make it clear that I have no reason to believe that access to the file was ever an issue while Mrs S was alive.)However, in both of these cases, the release of the information would have taken place under the DPA.As a result, there would have been no question of the information being released into the public domain, unlike with FOISA.
17.Section 38(1)(d) of FOISA specifically exempts information if it constitutes a deceased person's health record.This is designed with the aim of stopping health records of the deceased being put into the public domain (the exemption lasts for 100 years).The AHRA, however, provides a separate, limited access regime for this type of information.
18.In particular, section 3(1)(f) of the AHRA gives the personal representative of a patient who has died a right to apply to access the patient's health record.The same right is given to any person who may have a claim arising out of the patient's death.
19.A health record is defined by section 1 of the AHRA as a record which:
(a)consists of information relating to the physical or mental health of an individual who can be identified from that information, or from that and other information in the possession of the holder of the record; and
(b)has been made by or on behalf of a health professional in connection with the care of that individual
20.Section 2 of the AHRA establishes that the definition of "health professional" in section 1 of the AHRA is to be given the same definition as in section 69 of the DPA.From this definition, it is clear that social work records as a generic group are not considered to be health records as they are not created by or on behalf of a health professional.
21.As noted above, Mr S has commented that, as a result of making an application under the AHRA, he received some information which he considers to be social work records.While I cannot comment on the information supplied to Mr S as a result of this request (I have not seen the information and in any event have no jurisdiction in this matter), it is clear that some of the information contained in his mother's social work file originates from his mother's medical practice or local NHS Trust and clearly contains very sensitive information as to his mother's health.However, given that a request under the ARHA can only be made to a person defined as a "holder" of the information in terms of section 1(2) of the ARHA, and given that this does not include a social worker, I do not consider that any of the information which may fall within the definition of a health record but which is held by the Council as social work agency is accessible under the ARHA.
22.In conclusion, I am satisfied that the social work records, in so far as the personal information contained in the records relates to Mr S's mother, are not subject to the AHRA and so the exemption in section 38(1)(d) of FOISA does not come into play.Again, I would point out that the Council did not argue that the social work file was exempt under section 38(1)(d).I mention this exemption purely for completeness sake.
Submissions from the Council
23.The Council submitted to my Office that as neither the DPA nor AHRA allows access to the file requested by Mr S, it could not have been the intention of Parliament to permit any third party to access this type of information under FOISA.Accordingly, the Council considered it paramount that it preserve the integrity of the information until ordered to release it by a court or similarly empowered body.
24.I understand from both parties that Mr S wishes to access his mother's social work file in order to allow him to challenge his mother's will.The Council has commented that Mr S could raise a court action which would allow him to access such records.It is worth noting that, unlike disclosure under FOISA, should the information be released to Mr S in response to a court order, the information would not be released into the public domain in the same way as a disclosure under FOISA.
25.I will now consider the exemptions cited by the Council.
Section 26(a) ? Prohibitions on disclosure
26.Section 26(a) of FOISA exempts information from release under FOISA where disclosure by a public authority is prohibited by or under any enactment.This is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.
27.The Council argued that the disclosure of the information requested by Mr S isprohibited by another piece of legislation, in this case the Human Rights Act 1998 (HRA).
28.The Council highlighted that section 6(1) of HRA states that it is unlawful for a public authority to act in a way which is incompatible with the European Convention on Human Rights ("the Convention"). It is clear that the Council falls within the definition on "public authority" in the HRA.In this case, the Council considered that making an individual's social work records generally available to the public is not compatible with Article 8 of the Convention, which confers a right to respect for private and family life, home and correspondence.
29.In coming to a conclusion on whether a breach of Article 8 could constitute a prohibition on disclosure under section 26(1) of FOISA, I have noted guidance issued by my counterpart, the Information Commissioner (http://www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/access_to_information_about_deceased_220307_v1.1.pdf) as well as guidance issued by the Department for Constitutional Affairs as predecessor of the Ministry of Justice (http://www.foi.gov.uk/guidance/exguide/sec44/chap02.htm).
30.As noted above, section 6 of the HRA makes it unlawful for public authorities to act in a way which is incompatible with a Convention right.I am satisfied that should I come to the view that the disclosure of the social work file into the public domain would be incompatible with the rights contained in Article 8, that the disclosure would be prohibited by section 6 of the HRA and, accordingly, be exempt in terms of section 26(a) of FOISA.
31.Article 8 imposes both positive and negative duties on a public authority.This means that where there may be some cases where the release of information would breach the rights contained within Article 8, there may also be some cases where the refusal to release information constitutes a breach of Article 8.For example, in the case of Gaskin v the United Kingdom (1989) 12 EHRR 36, the European Court of Human Rights decided that the fact that a person who had been in care had no right to access the information contained in those records was a breach of Article 8.However, in the case of R (Addinell) v Sheffield City Council (QBD), the Court held that the Article 8 did not require the Council to disclose to a father the social services files of his deceased son.
32.Given these positive and negative duties, while Mr S may argue that failure to release the file could breach his Article 8 rights, other surviving relatives may argue that the disclosure would breach their own Article 8 rights.
33.I will first consider whether the disclosure of the information in Mrs S's social work file would constitute an unjustified interference with the right contained in Article 8(1).As noted in the guidance issued by the Information Commissioner and referred to above, a number of matters may be relevant: the more recent the death and the more sensitive the information, the more likely that disclosure would have an adverse effect on the rights of the surviving people closely connected to the deceased.
34.However, a public authority must consider all the other requirements of Article 8(2) including whether or not disclosure would be proportionate in relation to the harm that may be caused. Article 8(2) provides:
There shall be no interference by a public authority with the exercise of this right [the right to respect for private and family life, home and correspondence] except such as in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
35.Having reviewed the information contained in the social work file, I am satisfied that the disclosure of the information contained in the social work files would be an intrusion on the privacy of surviving relatives and would amount to a real and definite breach of their private or family life.I have also considered whether Article 8(2) would allow disclosure and whether or not the disclosure would be proportionate in relation to the harm that may be caused.I do not consider that the disclosure would be allowed by Article 8(2) or would be proportionate in the circumstances, particularly given that release of the information in response to Mr S's information request under section 1 of FOISA would result in the social work file being in the public domain.
36.In coming to this conclusion I have also taken into account the fact that Mr S has the option, as he is aware, to ask the court to order disclosure of the information to him.
37.I therefore agree with the Council that the disclosure of the information under FOISA would constitute a breach of Article 8 of the Convention and, accordingly, that the disclosure of the information is exempt in terms of section 26(a) of FOISA.
Section 36(2) ? Confidentiality
38.The Council also applied the exemption in section 36(2) of FOISA to the information sought by Mr S.
39.In terms of section 36(2) of FOISA, information is exempt information if it was obtained by a Scottish public authority from another person and its disclosure by the authority so obtaining it would constitute a breach of confidence actionable by that person or any other person.
40.The Council submits that the relationship between a social worker and their client gives rise to an obligation of confidentiality and that this obligation continues beyond death.
41.As with the section 26(a) exemption, the exemption in section 36(2) is absolute. This means that it is not subject to the public interest test required by section 2(1)(b) of FOISA.However, unlike the section 26(a) exemption, it is generally accepted in common law that an obligation of confidence will not be enforced to restrain the disclosure of information which is justified in the public interest.
42.In order to rely on section 36(2), an authority needs to demonstrate certain elements. Firstly, the information must have been obtained by the Council from another person.
43.I am satisfied that a large proportion of the information contained within the file in question was information provided to the Council by the late Mrs S, her family and other health professionals.As such, I am satisfied that this information was obtained from a third party.
44.However, where the information originates from within the Council (and does not, for example, report the comments of a third party), then the exemption contained in section 36(2) cannot be relied on.Section 36(2)(a) makes it clear that for information to be exempt under this exemption, the information must have been obtained by the Council from another person (i.e. some person or body other than the Council).I will therefore disregard information which has not been obtained by the Council in the remainder of my discussion on the section 36(2) exemption.
45.The second test is that the disclosure of the information by the public authority must constitute a breach of confidence actionable either by the person from whom the authority obtained the information or by any other person. I take the view that actionable means that the basic requirements for a successful action must appear to be fulfilled.
46.There are three main requirements, all of which must be met before a claim for breach of confidentiality can be established. These are:
i.the information must have the necessary quality of confidence about it. It must not be generally accessible to the public already.
ii.the information must have been communicated in circumstances importing an obligation of confidentiality. The obligation may be express (for example, in a contract or other agreement), or implied from the circumstances or the nature of the relationship between the parties; and
iii.there must have been unauthorised use or disclosure of the information to the detriment of the party communicating it. Detriment may be potential rather than actual and need not be financial.
47.To have the necessary quality of confidence, the information should not be generally accessible.That is clearly the case here.
48.The Council must also have received the information in circumstances which imposed an obligation on it to maintain confidentiality.The Council has submitted that the relationship between client and social worker is clearly one which would imply a duty of confidentiality.The Council has also submitted that this confidential relationship extends to the relatives of the client and other third parties such as medical practitioners, both of whom are mentioned in the file and, indeed, supplied information for the file.
49.I am satisfied that the social work file has the necessary quality of confidence required to sustain an action for breach of confidence and that when Mrs S, her family members and health professionals provided information to social workers, they did so with the expectation that the information would not generally be disclosed into the public domain.
50.The third part of the test requires that disclosure of the information must be unauthorised by, and cause damage to, the person who communicated it.
51.I am satisfied on the basis of the submissions that I have received from the Council that there is a potential for distress to be caused to surviving relatives by the release of the information contained in the file (a substantial proportion of which they have provided to the Council).The same may be said for information which has been provided in confidence by health professionals.
52.I also note decision FS50111780 from the Information Commissioner (County of Durham NHS Primary Care Trust), in which he reached a view that the personal representative of the deceased person could sue in the event of details of her medical condition being released to her parents under the UK Freedom of Information Act 2000.
53.As with the Information Commissioner, while I am not certain that there is a binding authority on this point, I consider that it may be possible for other surviving relatives of Mrs S (i.e. not the applicant, Mr S), to raise an action for breach of confidence in the event that information contained in the file is disclosed under FOISA.
54.I am therefore satisfied that disclosure of the file would be actionable.
55.As stated above, if the conditions of section 36(2) are fulfilled, an absolute exemption is created. However, it is generally accepted in common law that an obligation of confidence cannot apply to information the disclosure of which is necessary in the public interest. The law of confidence recognises that there is a strong public interest in ensuring that people respect confidences, and the burden of showing that a failure to maintain confidentiality would be in the public interest is therefore a heavy one. However, in certain circumstances the public interest in maintaining confidences may be outweighed by the public interest in disclosure of information.
56.In this instance I can see no overwhelming public interest which would justify the release of such information into the public domain.In coming to this conclusion I have taken account of the same type of considerations as I did in considering whether the release of the file would be justified under Article 8(2) of the Convention.
57.I am therefore satisfied that the Council acted in accordance with Part 1 of FOISA in withholding the information requested by Mr S under section 36(2) of FOISA.
58.As I have determined that the Council acted in accordance with Part 1 of FOISA in applying sections 26(a) to the social work file in its entirety and 36(2) in so far as it relates to information provided by a third party, I do not consider it necessary to examine the application of the exemptions in section 30(b)(i) and (ii) or (c).
Decision
I find that the City of Edinburgh Council acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in refusing to release his late mother's social work file to Mr S.
Appeal
Should either Mr S or the City of Edinburgh Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days of the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
20 September 2007
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
2Effect of exemptions
(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a)the provision does not confer absolute exemption; and
(b)in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2)For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
[?]
(b)section 26;
(c)section 36(2);
[?]
26Prohibition on disclosure
Information is exempt if its disclosure by a Scottish public authority (otherwise than under this Act) ?
(a)_is prohibited by or under an enactment
[?]
36Confidentiality
[?]
(2) Information is exempt information if-
(a) it was obtained by a Scottish public authority from another person (including another such authority); and
(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.
38Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
[?]
(d) a deceased person's health record.
[?]
(2)The first condition is-
(a)in a case where the information falls within any of the paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene ?
(i)any of the data protection principles; or
(ii)section 10 of that Act (right to prevent processing likely to cause damage or distress); and
(b)in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
(3)The second condition is that, by virtue of any provision of Part IV of that Act, the information is exempt from section 7(1)(c) (data subject's right of access to personal data).
[?]
(5)In this section -
[?]
"health record" has the meaning assigned to that term by section 1(1) of the Access to Health Records Act 1990 (c.23)
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
[?]
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual
69Meaning of "health professional"
(1)In this Act "health professional" means any of the following ?
(a)a registered medical practitioner,
(b)a registered dentist as defined by section 53(1) of the Dentists Act 1984,
(c)a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989,
(d)a registered pharmaceutical chemist as defined by section 24(1) of the Pharmacy Act 1954 or a registered person as defined by Article 2(2) of the Pharmacy (Northern Ireland) Order 1976,
(e)a registered nurse or midwife,
(f)a registered osteopath as defined by section 41 of the Osteopaths Act 1993,
(g)a registered chiropractor as defined by section 43 of the Chiropractors Act 1994
(h)any person who is registered as a member of a profession to which the Health Professions Order 2001 for the time being extends,
(i)a clinical psychologist or child psychotherapist, and
(j)a scientist employed by such a body as head of a department.
Access to Health Records Act 1990
1"Health record" and related expressions
(1)In this Act "health record" means a record which?
(a)consists of information relating to the physical or mental health of an individual who can be identified from that information, or from that and other information in the possession of the holder of the record; and
(b)has been made by or on behalf of a health professional in connection with the care of that individual
(2)In this Act, "holder", in relation to a health record, means ?
(a)in the case of a record made by a health professional performing medical services under a general medical services contract made with a Health Board, the person who entered into the contract with the Board;
(aa)in the case of a record made by a health professional performing such services in accordance with arrangements under section 17C of the National Health Service (Scotland) Act 1978 with a Health Board, the person who made the arrangements with the Board;
(b)in the case of a record made by a health professional for purposes connected with the provision of health services by a health service body (and not falling within paragraph (aa) above), the health service body by which or on whose behalf the record is held;
(c)in any other case, the health professional by whom or on whose behalf the record is held.
2Health professionals
(1)In this Act "health professional" has the same meaning as in the Data Protection Act 1998.
3Rights of access to health records
(1)An application for access to a health record, or to any part of a health record, may be made to the holder of the record by any of the following, namely ?
[?]
(f)where the patient has died, the patient's personal representative any person who may have a claim arising out of the patient's death.
Human Rights Act 1998
6. Acts of public authorities
(1)It is unlawful for a public authority to act in a way which is incompatible with a Convention right.
European Convention on Human Rights and Fundamental Freedoms
Article 8
(1)Everyone has the right to respect for his private and family life, his home and his correspondence.
(2)There shall be no interference by a public authority with this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
