Home Decisions

Decision 162/2026

Decision 162/2026:  Medical opinions referenced in a published research paper

Authority:  Mental Welfare Commission for Scotland
Case Ref:  202300942
 

Summary

The Applicant asked the Authority for copies of medical opinions given as part of mental health assessments, some of which were published in a research paper. The Authority withheld the information requested because it considered it to be exempt from disclosure as court records and personal data.  The Commissioner investigated and found that the Authority was correct in withholding only a very small amount of information.  He required disclosure of all the remaining information captured by the request.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 37(1)(a) (Court records, etc); 38(1)(b) (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing); 9(1) and (2) (processing of special categories of personal data).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data).

Background

  1. The Authority (in conjunction with the University of Essex) carried out research work on the consideration of Significantly Impaired Decision-Making Ability (SIDMA) in applications for the issuing of a Compulsory Treatment Order (CTO).  The research contained analysis of 100 medical opinions and was published in the International Journal of Law and Psychiatry 78 (2021) in a paper entitled “SIDMA as a criterion for psychiatric compulsion: An analysis of compulsory treatment orders in Scotland”.
  2. On 14 June 2023, the Applicant made a request for information to the Authority.  He asked for copies of the 100 medical opinions, referenced in the journal article, that were used to support applications for a CTO, redacted if necessary.  The Applicant clarified that he only required the reasons given by the psychiatrists for believing that the patient had SIDMA.
  3. The Authority responded on 4 July 2023.  It withheld the information under section 38(1)(b) of FOISA, stating that the information was personal data and its disclosure would breach one or more of the data protection principles in the UK GDPR. 
  4. On 5 July 2023, the Applicant wrote to the Authority requesting a review of its decision. The Applicant commented that the information had already been disclosed to members of the research team, and that some of it had been published in anonymised form within the research paper. He stressed that he was seeking the anonymised extracts shared with the research team, that further processing of the data was not necessary, and that the exemption did not apply.
  5. The Authority notified the Applicant of the outcome of its review on 26 July 2023.  The Authority upheld its initial response in terms of section 38(1)(b) of FOISA.  The Authority explained that it was also withholding the information under section 37(1) of FOISA, as the information was used in legal proceedings, as part of a CTO application.
  6. On 26 July 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he did not agree that the exemptions applied.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 7 August 2023, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments. 
  3. The Authority was also asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information.
  4. The case was subsequently allocated to an investigating officer.

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 37 – court records etc

  1. Section 37(1)(a) of FOISA states that information is exempt information if it is contained in a document:
    1. lodged with, or otherwise placed in the custody of, a court for the purposes of proceedings in a cause or matter;
    2. served on, or by, a Scottish public authority for the purposes of such proceedings; or
    3. created by a court or member of its administrative staff for the purposes of, or in the course of, such proceedings.
  2. This exemption is not subject to the public interest test in section 2(1)(b) of FOISA. This means that the Commissioner is not required to (and, indeed, cannot) go on to consider whether the public interest in disclosing the information is outweighed by that in maintaining the exemption.  So, provided the information falls into one of the categories listed in section 37, it will be exempt from disclosure.

The Authority’s comments

  1. The Authority referred the Commissioner to information about CTOs on its own website and on the Scottish Government website and it explained that CTOs were applications to the court made by a mental health officer. It submitted that the information was exempt from disclosure under the terms of section 37(1)(a)(i) and (ii) of FOISA because a CTO application was a document that was lodged with, or otherwise placed in the custody of, a court for the purposes of proceedings in a cause or matter and was served on, or by, a Scottish public authority for the purposes of such proceedings.
  2. The Authority submitted that it held the information requested (the SIDMA) solely because it was contained in the CTO documentation.  The Authority explained that it received copies of these documents in order to fulfil its duties under the Mental Health (Care and Treatment) (Scotland) Act 2003 (the Act).
  3. The Authority argued that the CTO documents were, in themselves, court records created for submission to the Mental Health Tribunal, which is also a statutory body with specific functions under the Act.  The Authority noted that the Mental Health Tribunal is listed in Schedule 1 of the Tribunals Scotland Act 2014.  The Authority also commented that the former Scottish Information Commissioner, Kevin Dunion, in his book “Freedom of Information in Scotland in Practice” (ed. 2011, page 139), acknowledged that the Mental Health Tribunal should be considered to be a tribunal which falls within the definition of a court. 

The Applicant's comments

  1. The Applicant acknowledged the statutory role of the Mental Health Tribunal and the status of the CTO documents within that sphere.  However, he disagreed that the exemption applied. 
  2. The Applicant argued that the Authority had already disclosed the information he requested to people who were not under the control of the Authority and who had published samples of the information in a scientific paper that was freely available to the public online.  He noted there was no statutory requirement for the Authority to do either of those things and he did not understand why the information could not be disclosed to him. 
  3. The Applicant commented that if it was unlawful for the Authority to provide him with the information, then it was unlawful for it to have disclosed the information to its academic partners and wider public.

The Commissioner's view

  1. The Commissioner has considered the views of both parties carefully.  He has also considered the withheld information provided to him by the Authority.
  2. While the Commissioner is in agreement with his predecessor on the status of the Mental Health Tribunal, he notes that the information withheld is contained in a spreadsheet and is not contained within the original CTO documents that would be lodged with the Mental Health Tribunal.  Rather, the information requested has been extracted from those original documents into one column of a spreadsheet.  As such, the Commissioner is not persuaded by the Authority’s argument that the spreadsheet is a document which has been lodged in a court for any of the purposes listed in section 37(1)(a)(i) or (ii) of FOISA. Furthermore, the Commissioner cannot be satisfied that the Authority holds this information solely because it is contained in such a document.  It is clear that the Authority holds the information in the spreadsheet for purposes other than those listed in section 37 of FOISA.
  3. Given this, the Commissioner does not accept that the Authority was entitled to withhold this information under sections 37(1)(a)(i) and (ii) of FOISA, and he is not satisfied that the Authority has complied with Part 1 (in particular section 1(1)) of FOISA in responding to the Applicants request.

Section 38(1)(b) – Third party personal data

  1. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
  3. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.

Is the withheld information personal data?

  1. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018 i.e. any information relating to an identified or identifiable individual.  “Identified living individual” is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
  2. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland (C-582/14)[.  The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified.  In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party.  However, there must be a realistic causal chain – if the risk of identification is "insignificant", the information will not be personal data.
  3. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply.  As set out in Recital (26) of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly.
  4. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, the available technology at the time of processing and technological developments.  It confirms that data should be considered anonymous (and therefore no longer subject to the UK GDPR) when the data subject(s) is/are no longer identifiable.

The Authority’s comments on identifiability

  1. The Authority explained that the information held in the spreadsheet, extracted from the original CTO documents, had been pseudonymised.  The Authority acknowledged that it would be unlikely for someone without previous knowledge to identify these individuals.
  2. However, it noted that while the information had been extracted and the names removed, in the Authority’s view, the extracts could contain bibliographical data or individuals’ details.
  3. The Authority argued that some of the assessments contained some additional information that could lead to reidentification or self-identification for those with previous knowledge of who the individuals were.  To evidence this, the Authority highlighted (for the Commissioner’s consideration) an example from the spreadsheet.
  4. The Authority noted that while the data had been shared with another organisation for research purposes, it had taken steps to minimise the risk of a data breach and that it closely monitored how the information was processed and used by the University of Essex.

The Applicant’s comments

  1. The Applicant argued that the information he had requested had previously been extracted from the original documents and had been stripped of all means of personal identification.  It was his view that no further processing was necessary to enable disclosure.
     
  2. The Applicant also commented that the extracts had been shared with individuals (researchers) who were external to the Authority and that some of the information captured by his request had been published (as a result of that research) in an online journal and, therefore, was already in the public domain.

The Commissioner’s view

  1. The Commissioner has considered the withheld information and the submissions from both parties carefully.
  2. The information captured by the request is contained in column L of the spreadsheet. Column L contains the opinions of the medical professionals in their carrying out of the SIDMA assessment.  This is the only information within the spreadsheet that the Commissioner has considered in his deliberations.
  3. The Commissioner notes the Authority’s concerns in relation to self-identification and re-identification of those with close knowledge of the original information, if all of the information contained in column L of the spreadsheet were to be disclosed.  While the Commissioner acknowledges that there is a risk of someone identifying comments that were written about them or recognising the comments that they made in the course of their carrying out the SIDMA assessment, the Commissioner considers that this risk is low.  He cannot identify any risk of identification beyond that small circle, and would not consider the risk of self-identification to be a sufficient basis for finding information to be personal data.
  4. Furthermore, in the case of those medical professionals who made comments in the process of carrying out the SIDMA assessment, these individuals would likely be subject to strict professional obligations of confidentiality and therefore the identities of the individuals that were subject to assessment in those circumstances (if, indeed, they could be identified) would remain confidential.
  5. In all of these circumstances, the Commissioner is not satisfied that individuals could be identified by disclosure of most of the information requested; namely the majority of the information contained in column L of the spreadsheet.
  6. The Commissioner considers that the vast majority of information captured by the request, contained in column L of the spreadsheet, does not constitute personal data as defined in section 3(2) of the DPA 2018 and, as such, he must find that it has been improperly withheld under section 38(1)(b) of FOISA. 
  7. He requires the Authority to disclose the information that has been wrongly withheld under section 38(1)(b) of FOISA to the Applicant.
  8. However, the Commissioner does accept that there are some words and phrases within the withheld information (in column L) which could be considered personal data and might lead to identification in the wider community; although such instances appear to be few.  This applies to some of the information in rows 18, 42, 45, 39 and 90 of the spreadsheet, which the Commissioner has marked up for the Authority.
  9. The Commissioner will now go on to consider the application of section 38(1)(b) of FOISA to this remaining information.

Special category personal data

  1. Having considered the information in question, the Commissioner accepts that some of the withheld information (some of the information in rows 18, 42, 45, 39 and 90 of the spreadsheet) would be special category data for the purposes of Article 9(1) of the UK GDPR.
  2. The Commissioner’s guidance on section 38 of FOISA notes (paragraphs 70 to 72) that Article 9 of the UK GDPR only allows special category personal data to be processed in very limited circumstances.
  3. Although Schedule 1 to the DPA 2018 contains a wide range of conditions which allow authorities to process special category data for the purposes of FOI, the only situation where it is likely to be lawful to disclose special category data in response to an information request is where the condition in Article 9(2)(e) applies; that is, where the personal data has manifestly been made public by the data subject.
  4. The Applicant has not suggested that the personal data have manifestly been made public by the data subject(s) and, indeed, in his request he accepted that some redaction might be necessary.
  5. The Authority has considered all of the conditions in Article 9(2), including 9(2)(e), and does not believe any of these conditions could be met by the processing of this personal data in response to the Applicant’s request.
  6. Having considered the terms of the condition in Article 9(2)(e), the Commissioner is satisfied that the information has not been made public as a result of steps deliberately taken by the data subject and therefore this condition of processing could not be met in this case, for the small amount of remaining information in question.
  7. Consequently, the Commissioner finds that in the absence of a condition in Article 9(2) of the UK GDPR allowing the special category personal data to be processed, disclosure of a small amount of the information in rows 18, 42, 45, 39 and 90 of the spreadsheet would be unlawful.
  8. Given that the Commissioner has determined that the processing of these special category personal data would be unlawful, he is not required to go on to consider whether any such disclosure would otherwise be fair or transparent in relation to the data subjects.

Decision 

The Commissioner finds that the Authority partially failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that by relying on the exemption in section 38(1)(b) for withholding a small amount of the information in rows 18, 42, 45, 39 and 90 of the spreadsheet captured by the Applicant’s request, the Authority complied with Part 1 of FOISA.

However, by wrongly relying on sections 38(1)(b) and 37(1) to withhold the remaining information captured by the Applicant’s request, the Authority failed to comply with Part 1 (and, in particular, section 1(1)) of FOISA.

The Commissioner therefore requires the Authority to disclose the information that has been wrongly withheld to the Applicant by 6 August 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

 

Euan McCulloch 

Head of Enforcement 


22 June 2026

  1. ^

  2. ^

  3. ^

  4. ^

  5. ^

  6. ^

  7. ^