Decision 127/2025: Complaint to Police Scotland

Authority: Police Service of Scotland
Case Ref: 202401611
 

Summary

The Applicant asked the Authority for information relating to a complaint made about a named individual.  The Authority refused to confirm or deny whether it held the information.  The Commissioner investigated and found that the Authority was entitled to refuse to confirm or deny whether it held the information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 18(1) (Further provision as respects responses to request); 38(1)(b), (2A)(a), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)( f) (Lawfulness of processing).

Data Protection Act 2018 (The DPA 2018) sections 3(2), (3), 4(d) and (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 18 September 2024, the Applicant made a request for information to the Authority. He asked for information relating to a complaint against a named person in relation to compliance with data protection legislation.  The Applicant made three requests in relation to the complaint:   

   1. how many persons were interviewed (a) under caution, or (b) other than under caution?

   2. how many (a) individuals gave statements to the Authority, and (b) how many statements were recorded by the Authority?

   3. how many man hours were expended by the Authority?

2. The Authority responded on 14 October 2024.   Citing section 18(1) of FOISA, it refused to confirm or deny whether it held information falling within scope of the request, saying that to do so would be contrary to the public interest.  It stated that if the information was held, it would be exempt in terms of sections 38(1)(b), (read with section 38(1)(2A)) and 34(1)(b) of FOISA.  The Authority provided some general information in relation to request (iii), stating that it did not routinely record the costs or policing hours associated with any specific operation or investigation.
3. On 18 October 2024, the Applicant wrote to the Authority requesting a review of its decision.   The Applicant stated that he was dissatisfied with the decision because he disagreed that it was in the public interest for the Authority to refuse to confirm or deny that the information was held.  Furthermore, he argued that if the information was held, it could not be exempt from disclosure under either of the exemptions cited.  
4. The Authority notified the Applicant of the outcome of its review on 20 November 2024, in which it upheld its original response in full.
5. On 4 December 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.   The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he believed there was no public interest in refusing to confirm whether or not the information was held (if it was held) and he did not agree that the information (if it was held) would constitute personal data or that it would be information gathered in the course of enquiries and held for such purposes.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 16 January 2025, the Authority was notified in writing that the Applicant had made a valid application, and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application. 

Commissioner’s analysis and findings

9. In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 18(1) – Neither confirm nor deny

10. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances: 

    1. a request has been made to the authority for information, which may or may not be held by it; 

    2. if the information existed and was held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and 

    3. the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest. 

11. In any case where section 18(1) is under consideration, the Commissioner must ensure that his decision does not confirm one way or the other whether the information requested exists or is held by the authority.  This means he is unable to comment in any detail, in this case, on the Authority’s reliance on any of the exemptions referred to, or on other matters that could have the effect of indicating whether the information existed or was held by the Authority.
12. It is not sufficient to claim that one or more of the relevant exemptions applies.  Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if held, would be exempt information under one or more of the listed exemptions.
13. In this case, the Authority submitted that, if it held any information falling within the scope of the requests, it would be exempt from disclosure under section 38(1)(b) of FOISA and section 34(1)(b).
14. The Commissioner must first, therefore, consider whether in relation to section 38(1)(b) of FOISA, the Authority could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and were held. 

Section 38(1)(b) - Personal information 

15. Section 38(1)(b), read in conjunction with section 38(2A) (a) or (b), exempts information from disclosure if it is "personal data", as defined in section 3(2) of the Data Protection Act 2018 (the DPA) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.

Would the information be personal data? 

16. "Personal data" is defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual".  Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular with reference to:

    1. an identifier such as a name, an identification number, location data or an online identifier, or 

    2. one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."

The Applicant’s comments on whether the information would be personal data, if it was held

17. The Applicant stated that he did not accept that any information falling within the scope of his request, if it were held, would be personal data.  He submitted that the request was for information about the scope and nature of an investigation (the number of people interviewed and statements noted by the police) and that such information could not identify any individual.
18. Furthermore, the Applicant argued that he had not requested any information relating to the identity of anyone interviewed or making a statement.  The Applicant added that if (as he believed to be the case) no-one was interviewed under caution or otherwise and no statements were noted, then that could not amount to the personal data of any individual.
19. Moreover, he submitted that if it was the case, for instance, that the Authority claimed to have interviewed one person and to have noted four statements, that would not be the personal data of any individual since no-one could be identified from that information.  The Applicant argued that it was conceivable that information could have been sought from a wide range of individuals, none of whom would be identifiable.
20. The Applicant clarified that the purpose of the request was not to establish whether or not any individual had been questioned or had given a statement but to establish whether the Authority had carried out any external enquiries whatsoever.  The Applicant stated that had the focus of the request been on individuals, it would have explicitly sought the names of those who had been interviewed or given statements.
21. In the Applicant’s view, the Authority was being disingenuous and acting in bad faith in seeking to rely on exemptions which did not apply, in order to avoid confirming that it failed to carry out any investigation.  He submitted that, in the unlikely event that the Authority interviewed witnesses or noted statements, it would be in keeping with practice in other cases (examples of which had been provided) to confirm having done so, irrespective of the possibility that this might, in some circumstances, have the effect of identifying individuals.  He argued that this was particularly the case when those individuals had a public role such as those who could potentially have been interviewed or given statements in the circumstances of the current application.
22. The Applicant further commented that  Strathclyde Police (a predecessor of the Authority) had responded to a similar request made in 2012 and stated that this supported his position that disclosure of the information, if it was held, would not breach the Authority’s personal data obligations. 

The Authority’s view on whether the information requested would be personal data, if held

23. The Authority stated that the data subject of the information, if it existed and were held, would be identified and that all the information sought related to the Applicant and to the named third party.   The Authority submitted that Article 5(1) of the GDPR would be contravened by disclosure of the personal data, if it existed and were held. 

The Commissioner’s view on whether the information would be personal data, if held

24. The Commissioner has carefully considered the Applicant’s argument that the information requested, if it were held, would constitute numbers of people interviewed and statements, and not the information contained within those statements.
25. However, given that the information request was framed with specific reference to a named person and given the subject matter of the request (for information about a complaint to police about that named individual), the Commissioner is satisfied that, if this information did exist and was held, it would clearly relate to the named individual, i.e. to a police investigation relating to that individual.  The Commissioner therefore accepts that, if it existed and were held, the information would be personal data as defined in section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles?

26. The Authority argued that disclosing the personal data, if it existed and were held, would breach the first data protection principle in Article 5(1)(a) of the GDPR.  Article 5(1)(a) states that personal data shall be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.
27. The definition of “processing” is wide and is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d) “disclosure by transmission, dissemination or otherwise making available”. In the case of FOISA, personal data are processed when disclosed in response to a request.  This means that, if it existed and were held, the personal data could only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair. 

Lawful processing: Article 6(1)(f) of the UK GDPR

28. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
29. The Authority argued that the only potentially applicable conditions were Article 6(1)(a) (consent) and 6(1)(f) (legitimate interests) and that neither condition could be met in the circumstances.  
30. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.
31. Condition (f) states that processing shall be lawful if it is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
32. Though Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
33. The three tests which must be met before Article 6(1)(f) can be met are as follows: 

    1. Does the Applicant have a legitimate interest in the personal data? 

    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest? 

    3. Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data? 

Would the Applicant have a legitimate interest in obtaining the personal data, if held?

34. The Authority had not asked the Applicant what his interest might be but assumed that he was interested in the investigation.  It accepted that the Applicant would have a legitimate interest in the information, if it existed and were held.
35. Having considered the arguments put forward by the Applicant, the Commissioner accepts that, if they existed and were held, the Applicant would have a legitimate interest in obtaining the personal data.

Would disclosure be necessary?

36. The next question is whether, if the personal data existed, disclosure would be necessary to achieve the legitimate interest in the information.  “Necessary” means “reasonably” rather than “absolutely” or “strictly” necessary.
37. When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests could reasonably be met by means which interfered less with the privacy of the data subject.
38. The Authority stated that, overall, it did not consider that it was ever necessary for personal information of the sort which this information would constitute if it existed and was held, to be disclosed under FOISA.
39. Given the particular circumstances of this case, the Commissioner considers that the only way the Applicant’s legitimate interest could be met would be by disclosure of the information requested (if it existed and were held).  Only then would the Applicant be able to satisfy himself as to the particulars of the information he requested.  The Commissioner accepts, therefore, that disclosure of any information held would be necessary for the Applicant’s legitimate interests.

The data subject’s interests or fundamental rights and freedoms (and balancing exercise) 

40. The Commissioner has concluded that the disclosure of the information (if it existed and were held) would be necessary to achieve the Applicant’s legitimate interests.  However, this must be balanced against the fundamental rights and freedoms of the named individual.  Only if the legitimate interests of the Applicant outweighed those of the data subject could personal data be disclosed without breaching the first data protection principle.
41. The Commissioner has considered the submissions from both parties carefully, in the light of the decision by the Supreme Court in South Lanarkshire Authority v Scottish Information Commissioner [2013] UKSC 55[1].
42. In carrying out the balancing exercise, much will depend on the reasonable expectations of the data subject.  Factors which will be relevant in determining reasonable expectations include: 

    1. whether the information relates to the individual’s public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

    2. the potential harm or distress that may be caused by disclosure. 

    3. whether the individual objected to the disclosure.

43. The Authority argued that, even assuming disclosure was necessary to meet the legitimate interest of the Applicant, the interests or fundamental freedoms of the data subject far overrode any interest in circumstances such as those in this case.  Furthermore, the Authority stated that disclosure would also affect future investigations and would impact on its ability to garner public trust in the future.
44. The Authority concluded that in relation to any personal information, and particularly in relation to information about an investigation into a complaint, the fundamental rights and freedoms of the data subject would far override the interest of any third party because an individual’s overwhelming right to privacy should be superseded only in exceptional circumstances.
45. The Applicant commented that in relation to the information he had requested (as opposed to confirmation that it was held) there was a necessary balancing of the legitimate interests of the requester (and the wider public) and any specified data subject.  The Applicant submitted that it appeared to be the practice of police forces in both England and Scotland to confirm some details of early stage investigations when approached to do so, and he provided examples of this.
46. He argued that confirmation that individuals had been interviewed did not imply guilt but simply confirmed that the police had undertaken inquiries.
47. The Commissioner’s view is that the information, if it existed and were held, would be information a person would generally expect to be kept confidential and only shared amongst limited individuals for specific purposes.  In this case, these would be (if the information existed and were held) purposes relating to the processing of a complaint against that individual.
48. The Commissioner has also considered the potential harm or distress that could result from disclosure of the information (if it existed and were held).  Disclosure under FOISA is a public disclosure.  At the most general level, disclosing that a named individual was the subject of a complaint is likely to cause some reputational and/or professional damage to the named individual.
49. The Commissioner has carefully noted the examples provided by the Applicant in relation to police forces providing confirmation of certain details in relation to certain separate investigations.  However, as he has already stated, each case must be considered in light of its individual circumstances.  He considers the examples given to be sufficiently different (for example, in terms of the public profiles of both investigations and the individuals involved) so as to reduce their relevance to the Applicant’s argument in this case.
50. Moreover, in relation to the Applicant’s reference to an earlier request for information, and a reply other than in terms of section 18 of FOISA in relation to it, the Commissioner’s view, once again, is that each request must be considered on its own merits, and he notes that the response in that case expressed the view of the predecessor authority (presumably, in the light of its understanding of the data protection regime in place at that time) and not that of his own office.
51. After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subject, the Commissioner finds that the legitimate interests served by disclosure of any information held would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the individual in question in this case.
52. In all the circumstances of this particular case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the withheld personal data (if it exists and were held).

Fairness and transparency

53. Given that the Commissioner has concluded that the processing of the personal data, if existing and held, would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject.

Conclusion on the data protection principles 

54. For the reasons set out above, the Commissioner is satisfied that disclosure of any personal data, if it existed and were held, would breach the data protection principle in Article 5(1)(a) of the UK GDPR.  Consequently, he is satisfied that such personal data would be exempt from disclosure under section 38(1)(b) of FOISA and that the Authority could give a refusal notice under section 16(1) of FOISA, on the basis that the information would be exempt by virtue of section 38(1)(b).

Section 18(1) – The public Interest

55. The exemption in section 18(1) is subject to the public interest test in section 2(1)(b) of FOISA.  Where this exemption is correctly applied, the Commissioner must consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.
56. The “public interest” is not defined in FOISA but has been described as “something which is of serious concern and benefit to the public”, not merely something of individual interest.  The public interest does not mean “of interest to the public” but “in the interest of the public”, i.e. disclosure must serve the interests of the public.
57. The Commissioner must now consider whether the Authority was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

The Authority’s comments on the public interest

58. The Authority argued that a response under FOISA was not the appropriate method to obtain such information, if it existed and were held.  It argued that it would not want to release such information, if it existed and were held, to any individual for their own purposes and not for the greater good of the public at large.
59. The Authority acknowledged that confirming whether or not the information was held would arguably increase public awareness as to the handling of police investigations generally, and in relation to this case specifically, and it might also allow greater public scrutiny of policing activity, which is often welcome, particularly where public funds are involved.  Furthermore, the Authority recognised that it must be accountable for the use of public funds and that confirming whether or not the information existed and was held might better inform the public as to the allocation of resources and processes involved in investigations into similar allegations.
60. However, the Authority stated, that while there was a strong public interest in the transparency of police performance in relation to the prevention and detection of crimes across Scotland, this would be outweighed by the need to ensure that the Authority could conduct investigations thoroughly and the integrity of any subsequent court proceedings, both of which the Authority argued were more compelling factors.
61. The Authority argued that it was not in the public interest to confirm or deny that it held information relating to the request where that jeopardised either the impartial integrity of the police report to the Crown Office and Procurator Fiscal Service or the force’s ongoing efforts against criminality.  In this instance, the Authority argued, there was no meaningful purpose for confirming or denying it held the information.
62. The Authority further argued that confirming whether or not the information was held would result in certain harm to the named individual and stated that it owed a duty of confidentiality, not only to the Applicant but also to the third party whose personal data the information would be, if it existed and were held.

The Applicant’s comments on the public interest 

63. The Applicant argued that there could be no public interest in refusing to confirm the information was held.
64. Furthermore, the Applicant submitted that there was a clear public interest in the Authority confirming that it held information within the scope of the request, in terms of public confidence in policing and the extent to which it complied with any instruction from the Crown Office and Procurator Fiscal Service to investigate allegations.
65. He further argued that there was a public interest in the Authority confirming it was investigating serious allegations concerning an individual who was a public employee.
66. He stated that where issues of integrity, public trust and transparency were engaged, such as this appeal, there was a clear public interest in the Authority confirming that it held information falling within scope of the request – particularity since, in the Applicant’s view, it could not be otherwise.  The Applicant argued it would be risible for the Authority to claim that it did not hold the information requested in the circumstances of this case.

The Commissioner’s conclusions

67. The test the Commissioner must consider is whether (having already concluded that the information, if it existed and was held, would be exempt from disclosure) it would be contrary to the public interest to reveal whether the information existed or was held.
68. The Commissioner has fully considered the submissions from the Applicant and appreciates that, where an allegation has been made and not upheld, there is a public interest in ensuring that adequate consideration had been given to all facts of the case and a full and robust investigation is carried out.
69. However, the Commissioner is aware that the action of confirming or denying whether the information existed or was held would have the effect of revealing (publicly) whether the named individual was subject to a complaint or allegation. Doing so, would, of itself, lead to the Authority breaching its duties as a data controller under data protection legislation.  In the circumstances, the Commissioner must find that it would be contrary to the public interest for the Authority to reveal whether it held the requested information, or whether the information existed.
70. Consequently, the Commissioner is satisfied that the Authority was entitled to refuse to confirm nor deny whether the information requested by the Applicant existed or was held, in accordance with section 18(1) of FOISA.
71. As the Commissioner has found that the Authority was entitled to apply section 18 on the grounds that if the information existed and was held if would be exempt under section 38(1)(b), there is no need for him to consider the Authority’s argument that it would also have been subject to section 34(1) (Investigations by Scottish public authorities and proceedings arising out of such investigations) of FOISA.

Decision 

The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch 

Head of Enforcement 

26 May 2025