Home Decisions

Decision 198/2025

Decision 198/2025: Specific dates for the longest wait time for a smear test


Authority: Greater Glasgow and Clyde Health Board
Case Ref: 202500633
 

Summary

The Applicant asked the Authority for the specific dates for the longest wait time for the results of a smear test.  The Authority withheld the information on the basis that it was third party personal data.  The Commissioner found that the Authority had wrongly withheld the information and required it to be disclosed.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data” (Definitions) and 5(1)(a) (Principles relating to processing of personal data).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 26 February 2025, the Applicant made a request for information to the Authority.  She asked for “the longest wait time (specific dates included) for a smear test” and asked that the Authority also outline when it received the same said smear test and when the result was posted out to the GP.
  2. The Authority responded on 20 March 2025.  It disclosed the length of the current longest wait time.  However, it said that disclosing the specific dates for the longest wait would pose a risk that an individual could be identified from that information.  It therefore withheld that information under the exemption in section 38(1)(b) of FOISA.
  3. On 24 March 2025, the Applicant wrote to the Authority requesting a review of its decision. She stated that she was dissatisfied with the decision because she disagreed that disclosure of the specific dates could identify a living individual.  She found the Authority’s position “incredulous”, given the number of women who attended for smear tests.
  4. The Authority notified the Applicant of the outcome of its review on 7 April 2025, which fully upheld its original decision.
  5. On 28 April 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  She stated that she was dissatisfied with the outcome of the Authority’s review for the same reasons set out in her requirement for review.  

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 15 May 2025, the Authority was notified in writing that the Applicant had made a valid application.   The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided this information to the Commissioner, and the case was subsequently allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions related to its reliance on the exemption in section 38(1)(b) of FOISA.

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 38(1)(b) – Third party personal information

  1. Section 38(1)(b) of FOPISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA
  3. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
  4. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

  1. The first question that the Commissioner must address is whether the specific information withheld information by the Authority is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual.
  2. Section 3(3) of the DPA 2018 defines “identifiable living individual” as “a living individual who can be identified, directly or indirectly, in particular with reference to –

    1. an identifier such as a name, an identification number, location data or an online identifier, or

      1. one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

  3. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland (C-582/14)[1].  The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified.  In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party.  However, there must be a realistic causal chain – if the risk of identification is "insignificant", the information will not be personal data.
  4. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply.  As set out in Recital (26) of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly.  
  5. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, the available technology at the time of processing and technological developments.  It confirms that data should be considered anonymous (and therefore no longer subject to the UK GDPR) when the data subject(s) is/are no longer identifiable.

The Applicant’s submissions on identifiability

  1. As stated above, the Applicant disagreed that disclosure of the specific dates could identify a living individual.  She found the Authority’s position “incredulous”, given the number of women who attended for smear tests and said that it would be “quite an achievement” if she managed to identify someone by simply receiving dates.
The Authority’s submissions on identifiability
  1. The Authority’s review outcome noted that the Applicant considered it improbable that she could identify an individual from disclosure of the withheld information. However, it noted that disclosure under FOISA is disclosure to the world at large.  It therefore considered it conceivable that an individual could identify themselves (or another individual) from disclosure of the withheld information – either in its own right or in conjunction with other information.
  2. The Authority was asked to explain, with as much detail as possible, why it considered that disclosure of the withheld information would identify a living individual.
  3. The Authority responded that appointment waiting times for cervical screening were specific to individual GP practices and said that “a person could be identified from the data released with other information being known”.   It argued that the information was therefore more identifiable, related to a smaller population and to women only.  It said this “takes the sample to a “much smaller size” if the undisclosed information is used with any other “known information””.

The Commissioner's view 

  1. The Commissioner has carefully considered the submissions from both parties, together with the information withheld from the Applicant.
  2. The withheld information comprises two dates: the start and end date between the period the Authority disclosed as being the current longest wait time for a smear test. The Applicant did not ask for any information that would stratify this information further (e.g. by specifying a particular location or GP surgery or a particular age group of women).
  3. The Commissioner has therefore considered the number of individuals to whom these dates could relate.
  4. For the period April 2023 to March 2024, the Authority’s website[2] sets out the following facts and figures about the Authority:

  • it serves a population of 1.3 million people, covering East Dunbartonshire, East Renfrewshire, Glasgow City, Inverclyde, Renfrewshire and West Dunbartonshire

  • it employs around 41,000 staff

  • it has 23 hospitals of different types and has contracts with around 232 GP surgeries (employing 1,300 General Practitioners), which amounted to “13,300,000 GP contacts”.

  1. The Commissioner has also considered a recent article[3], which reported on statistics published by Public Health Scotland, which noted that over 233,000 women attended cervical screening appointments in Glasgow 2023/2024.
  2. The Commissioner has considered the possibility of the individual to whom the dates relate identifying themselves from disclosure of the withheld information. In doing so, he has had regard to the Authority’s submission in its initial response that 78% of individuals receive their cervical screening results within 14 days from the date of a sample being taken.
  3. The Commissioner acknowledges that this stratifies the pool of individuals to whom the withheld information could relate.  However, the individual is still one woman out of hundreds of thousands – and those subject to wait of longer than 14 days is still tens of thousands of women.
  4. In the circumstances, the Commissioner considers that for the individual to identify themselves from disclosure of the withheld information they would have to know and assume several things:

  • the individual would have to know the date on which their smear test was carried out

  • the individual would have to assume that the Authority’s calculation of the wait period was measured using the same start and end points as their own recollection.  For example, the date on which the GP surgery was notified of the result (electronically) may differ from the date on which the individual was actually informed (by postal letter)

  • the individual would have to assume both that they experienced the longest wait in the Authority and that their wait matched the longest wait time disclosed by the Authority.

  1. The Commissioner accepts that, under certain circumstances, disclosure of the withheld information might present a hypothetical possibility of identification of a living individual. However, he is not satisfied that disclosure of the withheld information requested would result in a realistic prospect of identification, particularly given the number of individuals to whom it could potentially relate, and the unlikely chain of knowledge and assumptions required for the individual to recognise themselves from the information.
  2. In this case, therefore, taking account of all the circumstances, the Commissioner is not persuaded that there is a realistic prospect of an individual being identified from disclosure of the withheld information in question.  Having taken account of the arguments presented by both parties, he is of the view that the risk of identification is insignificant and, consequently, that the information requested would not be personal data.
  3. In all the circumstances of the case, therefore, the Commissioner does not agree that a realistic causal chain exists where a living individual could be identified as a direct result of disclosing the withheld information.  As such, he does not agree that this is personal data as defined in section 3(2) of the DPA 2018.
  4. The Commissioner must therefore find that the Authority was not entitled to withhold that information under section 38(1)(b) of FOISA.  He requires the Authority to disclose the withheld information to the Applicant.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

The Commissioner finds that the Authority was not entitled to withhold the information as personal data and, by doing so, failed to comply with section 1(1) of FOISA.

The Commissioner therefore requires the Authority to disclose the withheld information to the Applicant, by 29 September 2025. 

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

 

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

David Hamilton

Scottish Information Commissioner

15 August 2025