Home Decisions

Decision 157/2025

Decision 157/2025: School bullying figures


Authority: East Dunbartonshire Council
Case Ref: 202500296
 

Summary

The Applicant asked the Authority for bullying incidents recorded by individual schools between specified dates.  The Authority provided some information and withheld other information on the basis that disclosing smaller figures could identify individuals.  The Commissioner investigated and found that the Authority had complied with FOISA in responding to the request.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data”); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)

Background

  1. On 13 December 2024, the Applicant made a request for information to the Authority. He asked the Authority to provide him with the total number of bullying incidents recorded by school in East Dunbartonshire schools for the following periods:

    • August 2022 to June 2023 (full school year)

      • August 2023 to June 2024 (full school year)

      • August 2024 until the date of the request.  

He stated that he understood this would be straightforward because the Authority captured and monitored the data in the SEEMiS Bullying and Equalities Module (BEM).  For clarity, the Applicant stated that he required every school listed with the number of recorded bullying incidents against them on an individual basis.

  1. The Authority responded on 16 January 2025.  It provided the Applicant with some of the information he had requested but it withheld information where the number of recorded bullying incidents was less than five, under section 38(1)(b) of FOISA.  The Authority stated that disclosing these exact figures could allow for the identification of individuals.
  2. On 19 January 2025, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because he disagreed that disclosure of an exact number of bullying incidents would identify a specific pupil or pupils.
  3. The Authority notified the Applicant of the outcome of its review on 14 February 2025, which upheld its original decision without modification.  
  4. On 23 February 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he did not believe disclosing the information would identify individuals.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 4 March 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These primarily focused on the Authority’s justification for withholding the information under section 38(1)(b) of FOISA, and its reasons for concluding that the information was personal data and that its disclosure could identify living individuals.  

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Background

  1. The Authority explained that the Scottish Government introduced the SEEMiS BEM into all Scottish Schools in 2018.  It stated that since August 2019 all schools and local authorities had been expected to use the module to record and monitor incidents of bullying and that standard practice was that schools would record all bullying incidents in real time using the BEM.

Section 38(1)(b) – Personal Information 

  1. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) (or (b)), exempts information from disclosure if it is “personal data“ (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
  3. To rely on the exemption in section 38(1)(b), the Authority must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Article 5(1) of the UK GDPR. 

Is the information personal data? 

  1. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual.  “Identified living individual” is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.) 

  2. Information will "relate to" a person if it is about them, is linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  The Commissioner’s guidance on section 38(1)(b)[1] is clear that numbers or statistics can be personal data (although of course this will not always be the case).  This guidance states:

    “The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland[2].  The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified.  
    In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party.  However, there must be a realistic causal chain – if the risk of identification is “insignificant”, the information won’t be personal data. 

  3. Although this decision was made before the GDPR, UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply.  Although no longer applicable in the UK, recital (26) of the GDPR bears this out – and confirms that data should be considered anonymous (and therefore no longer subject to the GDPR) when the data subject(s) is/are no longer identifiable.”

The Authority’s comments on whether the information is personal data

  1. The Authority stated that the information was personal data as it was likely to permit the identification of living individuals.  It submitted that the data which had been withheld represented a small number of incidents and that these were taken from an already small number of pupils attending individual schools.
  2. The Authority commented that it had (in its original response to the Applicant) attempted to disclose the information in a way which would prevent identification.  It submitted that it had not issued an outright refusal to disclose the information to the Applicant; instead, it had advised that the number was small and provided a banded figure (1 to 4) in its place.  It argued that this banded figure clearly indicated where there were recorded instances of bullying issues and the approximate scale of those instances, while also protecting young people from possible identification.
  3. The Authority argued that disclosure under FOISA was disclosure of the information into the public domain and this meant that individuals with access to further information and those within school communities would be able to use the information to identify particular children. For example, it stated that the Applicant would be able to identify certain individual children, due to his own particular knowledge, and that it would not be appropriate for the Authority to facilitate this identification through publication in response to a FOI request.
  4. The Authority explained, as above, that its decision to withhold some of the information (and provide it in banded form instead) was made on the basis that the number of incidents was small and from within an already small number of pupils within each school and that the number of pupils in a given school was relevant on that basis.  However, it argued that, even within the largest schools, the total number of children was still relatively small and predominantly community linked, and so the refusal (to disclose numbers which were less than five) was considered appropriate for all schools.

The Applicant’s comments on whether the information is personal data

  1. The Applicant disagreed that disclosing the information would enable the identification of an individual.  He argued that disclosing, for example, one or two bullying incidents at a school did not expose a child’s identity given that so few incidents of bullying were recorded in schools.  He submitted that the reality was that there would be more bullying incidents than the figures suggested (and that the Authority was significantly under-reporting bullying) and that, consequently, it was not possible to confirm who the records related to and who was being bullied on the information alone.
  2. The Applicant argued that bullying was rife across schools and could affect any child at a specific school, and therefore it would be impossible to identify any child if this information were disclosed on its own.
  3. The Applicant further stated that knowing a particular school had recorded one, two, three or four bullying incidents would disclose only the particular number of incidents and nothing more.  He contended that such a number would not disclose how many individual children were bullied and that even if only one was recorded, that would not allow anyone to know for sure who it was because the Authority under-reported bullying incidents.
  4. In addition, the Applicant stated, if there was only one incident, it would be easy to prove that more than one child had been bullied at a school.
  5. The Applicant argued that it was preposterous for the Authority to suggest that he (the Applicant) or others might be able to identify individuals if the information was disclosed, because bullying was under-reported.

The Commissioner’s view on whether the information is personal data

  1. The Commissioner has carefully considered all the submissions in this case and the nature of the withheld information.
  2. The Commissioner has also considered the nature of the immediate and wider school communities (for both primary and secondary schools). School communities (i.e. those individuals with a connection to the school) vary in size depending on the number of pupils.  The Commissioner considered the specific rolls of some the schools listed by the Authority. He noted that primary schools ranged from around 170 to 430 pupils, with high schools much larger, in some cases more than 1300 pupils.  In general, primary schools will have smaller communities than high schools but, for both primary and secondary schools, the Commissioner’s view is that, where instances of bullying range from one to four, a number of people are likely to be able to identify a child (or children) from the numbers, were they to be disclosed.
  3. He considers it likely, due to the small numbers involved, that disclosure of the information requested (e.g. 1, 2, 3 or 4) taken with information already known to pupils, their relatives, staff members and other individuals, could lead to the identification of individuals.
  4. In the first instance, that would include the child themselves (in the case of older children who may become or be made aware that such a disclosure had been made), their family and friends, teaching and support staff and also the individual who carried out the bullying, along with their friends and family.
  5. Moreover, in a school community (as in any community), children and parents will talk, both in person and on social media.  The Commissioner considers information – and speculation – can spread quickly within a school community and that a determined individual could, without undue effort, discern the name or names of those children who were (or were understood to have been) bullied, particularly where the instances were one or two but also in cases where four instances of bullying had been recorded.
  6. He has carefully considered the Applicant’s argument that schools routinely under-report bullying so that it would be easy to prove that the true figures were higher and that the instance (or instances) reported did not necessarily relate to a particular individual.
  7. While the Commissioner has sympathy with the Applicant’s concerns, he is not persuaded by them.  The Commissioner’s view is that even if, as the Applicant suggests, the recorded incidents of bullying are much lower than the actual incidents of bullying in those schools, it does not necessarily stop the withheld information from being personal data.  

    (In any case, while the backdating of records referred to in the Applicant’s submissions may be a matter of public concern in itself, it cannot reasonably be inferred from that alone that incidents of bullying are being significantly under-recorded: to establish that, more research would appear to be required.)
  8. If a member of the school community already had, or gained, knowledge of a particular child or children who had (or was understood to have) been bullied they could then, upon disclosure of the information, identify that child or children solely from that information (and would become aware, if they were not before, that the child had been the subject of a bullying report).  Even if it could be argued (after the fact of disclosure) that a particular number did not relate to a particular child or children that would, in the Commissioner’s view, be too late and could not “un-identify” any individual child.
  9. The Commissioner is satisfied that individual children could be identified from the information, were it to be disclosed.   He accepts that this is a real risk, in the circumstances, and that he must take a precautionary approach when considering the personal data of children (see paragraph 42 below).  Speculation (and consequent identification) informed by the withheld information could, in that context, be of as much concern as definitive identification.  He also accepts that the information relates to a key aspect of the personal lives of those children and therefore it must be said to relate to them.   He finds the information is personal data for the purposes of section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles? 

  1. The Authority argued that disclosure would breach the first data protection principle in Article 5(1)(a) of the UK GDPR.  Article 5(1)(a) states that personal data shall be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”  The Authority argued that the processing of the personal data would not be fair to the children concerned.
  2. The Authority submitted that the children who reported bullying would not expect that doing so would result in information which would be likely to identify them being made public.  It stated that the children involved would expect the Authority to deal with the issues in confidence.
  3. The Authority argued that there was an obvious risk that publication of information which might, or did, lead to children being identified in relation to incidents of bullying, could result in other children feeling less able or less willing to report such concerns for fear of identification and the potential consequences of that.   Moreover, the Authority argued, this risk was exacerbated by the often covert nature of bullying.
  4. Furthermore, the Authority stated that the second data protection principle required that information was collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.  It argued that it was concerned that children may feel the Authority had not respected this principle were it to release information which would identify them.
  5. The Authority added that it did not consider the information to be special category data and it was unaware that any information had been made public through the intention of any data subject.
  6. "Processing" of personal data is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data.  The definition therefore covers disclosing information into the public domain in response to a FOISA request.
  7. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
  8. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.
  9. The Information Commissioner’s Office (ICO) has published guidance on using condition (f) as the basis for processing children’s personal data[3], which states:

  10. “Article 6(1)(f) places particular emphasis on the need to protect the interests and fundamental freedoms of data subjects when they are children. This recognises Recital 38[4] which says that children require specific protection with regard to their personal data because they may be less aware of the risks and consequences of the processing, the safeguards that could be put in place to guard against these, and the rights they have.

  11. When using ‘legitimate interests’ as a lawful basis for processing children’s personal data, you therefore have a responsibility to protect them from risks that they may not fully appreciate and from consequences that they may not envisage.  It is up to you, not the child, to think about these issues and to identify appropriate safeguards.  You should be able to demonstrate that you have sufficiently protected the rights and fundamental freedoms of the child and that you have prioritised their interests over your own when this is needed.”

  12. The Commissioner has taken this guidance into account in considering whether condition (f) permits disclosure in this case.

Condition (f): legitimate interests 

  1. Condition (f) states that processing shall be lawful if it:

  2. “is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

  3. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
  4. The three tests which must be met before Article 6(1)(f) are as follows (see paragraph 18 of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[5]. Although this case was decided before the GDPR (and UK GDPR) came into effect, the relevant tests are almost identical): 

    1. does the Applicant have a legitimate interest in the personal data?

    2. if so, would the disclosure of the personal data be necessary to achieve that legitimate interest? 

    3. even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data (in particular where the data subject is a child)?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. The Authority accepted that the public had a legitimate interest in knowing the extent of bullying within its schools, but it did not accept that the public had a right to know the identity of the children involved.
  2. The Applicant (while he did not accept that the information was personal data) provided comments on the reasons for and background to his request.  The Applicant explained that he had made his information request for reasons of public interest, because he was concerned that the Authority was significantly under-reporting school bullying and that this was a safeguarding risk and a danger to children.
  3. The Applicant submitted that it was in the public interest to understand how many bullying incidents had been recorded at every school, so that this information could be shared with school Parent Teacher Associations and Parent Councils in order that they could examine whether under-reporting was a problem at their school.  He argued that under-reporting was not in the public interest because it put children at risk.  He commented that the Scottish Government, Education Scotland, the unions, the GTCS (the General Teaching Council for Scotland) and employers were turning a blind eye to the practice (of under-reporting) as under-reporting suited them.  The Applicant stated that it was left to members of the public to expose these risks to children and to try to bring about change.   
  4. Furthermore, he argued that the Authority encouraged this under-reporting in order to make the problem look smaller than it was.  The Applicant claimed that if a (bullying) situation went from bad to worse, the Authority then allowed teachers to create new records and backdate them “to cover their tracks”.  The Applicant argued that this was dangerous conduct which had to stop, but that it suited the Authority to continue to do this, and that this was not in the public interest.
  5. The Commissioner has considered the submissions from both the Authority and the Applicant carefully.  Having considered the subject matter of the request (the number of bullying incidents in schools) and the Applicant’s belief that not all bullying incidents are recorded, he has concluded that there remains a legitimate interest in understanding the extent of under-recording, if any.  To the extent that it might reasonably be expected to contribute to that understanding, the Commissioner accepts that the Applicant has a legitimate interest in obtaining the personal data.

Is disclosure of the personal data necessary?

  1. The Authority argued that the banded figures (1-4) released to the Applicant satisfied the legitimate public interest in the extent of bullying within its schools, while still respecting and protecting the rights of the children involved.  It submitted that it was a pragmatic and appropriate response in circumstances where the Authority was required to balance the competing interests of different individuals.
     
  2. The Applicant (in addition to his argument that authorities were content to have the problem under-reported, with the result that it was effectively up to members of the public to investigate the issue) explained that he was trying to stop the inaccurate recording of data. He argued that disclosure was in the public interest and it was important that he had detailed and accurate data, including the figures he was seeking in this request.

The Commissioner’s view on whether disclosure is necessary

  1. The Commissioner has carefully considered the arguments in relation to legitimate interests and, in particular, the Applicant’s comments on why he believes the information should be disclosed.
  2. The Commissioner notes that the general background to the Applicant’s request is his contention that the Authority routinely under-reports instances of bullying and acknowledges that the wider issue of bullying in schools is one of legitimate interest not only to the Applicant but to wider communities.
  3. In the Commissioner’s view, the Applicant’s arguments and concerns over the specific issue of the accuracy and integrity of the reporting of instances of bullying within schools reflect a legitimate interest.
  4. However, the Commissioner also notes that the information which has been withheld in this appeal relates only to instances where the figure is one, two, three or four.  Anything above this has been disclosed to the Applicant and cases where the figure is zero have also been disclosed.
  5. This means that even where the information has been withheld, the Applicant already knows that the figure is four or below (that is, that the number is small).  In the Commissioner’s view, disclosure of the information, while it would provide a specific figure, would make no material difference to the already established fact that the number involved is a small one, and would not prevent the Applicant making the arguments he has already highlighted in relation to under-reporting.
  6. Given the Applicant’s contention, that the true number of incidents is far beyond that which is reported in these cases, the Commissioner considers that merely then confirming whether the specific number was one, two, three, or four would not enhance to any great degree the Applicant’s ability to make that argument. To take a hypothetical example, if the Applicant was provided with a figure of three in relation to a particular school, and he subsequently argued that this figure was under-reported because the true figure was (for example) 13, in the Commissioner’s opinion, knowing the precise recorded figure would not greatly enhance the argument – if it enhanced it at all.  Knowing the precise recorded figure would certainly take the applicant no closer to ascertaining the true figure, if indeed it were higher.
  7. The Commissioner must also give consideration to the fact that the personal data that has been requested by the Applicant in this case, is the personal data of children, and that disclosure could identify individual children who have been bullied.
  8. On balance, the Commissioner considers, in light of the arguments provided and in all the circumstances of this particular case, that disclosure is not necessary to meet the Applicant’s legitimate interests and that any such disclosure of the personal data would therefore be unlawful.
     
  9. In the absence of a condition in Article 6 of the UK GDPR which would allow the specific numbers of bullying incidents to be disclosed lawfully, disclosure would breach Article 5 of the UK GDPR.  The figures which are less than five are, therefore, exempt from disclosure under section 38(1)(b) of FOISA.

Decision 

The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
 

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

 

Euan McCulloch 

Head of Enforcement 


25 June 2025