Home Decisions

Decision 243/2026

Decision 243/2026:  Impairment decisions removed from the Scottish Social Services Council website

  
Authority: Scottish Social Services Council
Case Ref: 202501697
 

Summary

The Applicant asked the Authority for the number of, and information on, Impairment Decisions removed from the Authority’s website at the request of the care worker or their representative within a specified time period.  The Authority withheld the information on the basis that it was third party personal data.  The Commissioner investigated and found that the Authority was correct to withhold the information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 38(1)(b), (2A) and (5) (definitions of “data protection principles”, “data subject”, “personal data”, and “processing”, “the UK GDPR”) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data”); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing) and 9 (Processing of special categories of personal data).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), 4(d), (5), (10) and 14(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 1 August 2025, the Applicant made a request for information to the Authority.  He asked for the following information from 1 January 2023 to the date of the request:
    1. The number of Impairment Decisions removed from the Authority’s website after publication at the request of the care worker/representative of the worker.
    2. The date the report was published, the date the removal request was made, and the date it was removed.
    3. The reason the Authority removed the Impairment Decision from the website.
    4. The workers’ town of employment.  
  2. The Authority responded on 22 August 2025.  It informed the Applicant that fewer than five impairment decision notices were removed from its website after publication at the request of the worker (or their representative) and withheld the information requested under the exemption in section 38(1)(b) of FOISA. 
  3. On 25 August 2025, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he did not consider that the exemption in section 38(1)(b) of FOISA applied as disclosure of the information requested would not lead to the identification of specific individuals.  
  4. The Authority notified the Applicant of the outcome of its review on 22 September 2025, which fully upheld its original decision. 
  5. On 25 September 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated he was dissatisfied with the outcome of the Authority’s review for the reasons set out in his requirement for review. 

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 21 October 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was subsequently allocated to an investigating officer. 
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions related to its application of the exemption in section 38(1)(b) of FOISA. 
  4. The Applicant was also invited to provide further comments to the Commissioner, which he did.  

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.  
  2. As stated in previous decisions, in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8, at paragraph [18], the Court of Session recognised that:

"… in giving reasons for his decision, [the Commissioner] is necessarily restrained by the need to avoid, deliberately or accidentally, disclosing information which ought not to be disclosed."

  1. In this decision notice, the Commissioner has endeavoured to give as full account of his reasoning as he can, but, by necessity, in this case the comments of the Court of Session are applicable to some aspects.

Section 38(1)(b) – personal information

  1. Section 38(1)(b) read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test in section 2(1)(b) of FOISA. 
  3. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
  4. The Commissioner must determine whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA. 

Is the withheld information personal data? 

  1. The first question the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018 i.e. any information relating to an identified or identifiable individual.  “Identified living individual” is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.) 
  2. Information will "relate to" a person if it is about them, is linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
  3. In this case, part (i) of the request asked for the number of Impairment Decisions (fewer than five) removed from the Authority’s website after publication at the request of the care worker/representative of the worker and information related to such decisions.  The Commissioner’s guidance on section 38(1)(b) is clear that numbers or statistics can be personal data (although of course this will not always be the case).
  4. In the case of Breyer v Bundesrepublik Deutschland, the Court of Justice of the European Union looked at the question of identification.  The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified.  When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain – if the risk of identification is insignificant, the information will not be personal data.
  5. Although this decision was made before the GDPR, UK GDPR and the DPA 2018 came into force, the Commissioner considers the same rules should apply.  Although no longer directly applicable in the UK, recital (26) of the GDPR bears this out – and confirms that data should be considered anonymous (and therefore no longer subject to the GDPR) when the data subject(s) is/are no longer identifiable.
  6. The Authority considered that all of the withheld information (including the figure withheld in response to part (i) of the request) related to living individual(s) and that such individual(s) would be identifiable, either directly or indirectly, were the withheld information to be disclosed.  It also considered some of the withheld information to be special category personal data and explained why. 
  7. The Applicant highlighted that it was the Authority’s role as the industry regulator for the care sector to protect the public by setting standards for the practice, conduct, training and education of care workers across Scotland.   He noted that sanctions imposed on workers were routinely published on the Authority’s website and commented he did not consider that providing the information requested (or the exact number requested in part (i) of his request, rather than the “fewer than five” disclosed by the Authority) would lead to individual workers being identified.   
  8. The Applicant also argued that disclosure of the dates the reports were published or removed, the reasons they were removed and the town of employment would not lead to identification of individuals.  He noted that Impairment Decisions were often published on the Authority’s website with the names of workers redacted.  As such, he did not consider that disclosing the information requested would contravene data protection legislation. 
  9. The Commissioner has carefully considered the submissions from both the Applicant and the Authority, together with the withheld information. 
  10. While he must be careful not to reveal the specific content of the withheld information, the Commissioner considers it likely, due to the small numbers involved (i.e. fewer than five), that disclosure of the withheld information could realistically lead to the identification of individuals.  While, as stated above (at paragraph 12), he cannot fully set out his reasoning for his conclusion, he is satisfied that the Authority has demonstrated a realistic causal chain of identification as a consequence of disclosure.
  11. In all of the circumstances, the Commissioner therefore accepts that the withheld information is personal data for the purposes of section 3(2) of the DPA 2018. Additionally, he accepts that some of the withheld information is special category personal data.   

Would disclosure contravene one or more of the data protection principles?

  1. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”
  2. “Processing” of personal data is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d)) disclosure by transmissions, dissemination or otherwise making available personal data. The definition therefore covers disclosing the information into the public domain in response to a FOISA request. 

Special category personal data 

  1. Having considered the information in question, the Commissioner accepts that some of the withheld information is special category data for the purposes of Article 9(1) of the UK GDPR. 
  2. The Commissioner’s guidance on section 38(1)(b) notes that Article 9 of the UK GDPR only allows special category personal data to be processed in very limited circumstances.
  3. Although Schedule 1 to the DPA 2018 contains a wide range of conditions which allow authorities to process special category data, for the purposes of FOISA, the only situation where it is likely to be lawful to disclose third party special category data in response to an information request is where, in line with Article 9(2)(e) of the UK GDPR, the personal data has manifestly been made public by the data subject.   Any public authority relying on this condition must be certain that the data subject made the disclosure with the intention of making the special category data public.
  4. In this case, there is nothing to suggest that disclosure of the special category personal data would comply with Article 9(2)(e) of the UK GDPR.  
  5. Having considered the terms of the condition in Article 9(2)(e), the Commissioner is satisfied that the special category data has not been made public as a result of steps deliberately taken by the data subject(s) and therefore this condition of processing could not be met in this case. 
  6. Consequently, the Commissioner finds that in the absence of a condition in Article 9(2) of the UK GDPR allowing the special category personal data to be processed, disclosure of the special category personal data would be unlawful.
  7. Given that the Commissioner has determined that the processing of the special category personal data would be unlawful, he is not required to go on to consider whether any such disclosure would otherwise be fair or transparent in relation to the data subject(s).

Non-special category personal data

  1. The Commissioner must now consider the remaining personal data which has been withheld and decide whether disclosing it would breach the first data protection principle in Article 5(1)(a) of the UK GDPR.

Article 6(1)(f) of the UK GDPR

  1. In considering lawfulness, the Commissioner must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
  2. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case. This states that processing shall be lawful if it “is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”
  3. Although Article 6 of the UK GDPR states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
  4. The three tests which must be fulfilled before Article 6(1)(f) of the UK GDPR can be relied on are as follows:
    1. Does the Applicant have a legitimate interest in the personal data?
    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject(s) which require protection of personal data?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
  2. The Applicant considered that it was in the public interest to know of sanctions imposed on workers and equally to find out how many impairment decisions had been removed from its website after publication, at the request of the worker/representative of the worker.   He argued that the public had a right to know why such impairment decisions could be removed, in order to maintain continued trust and confidence in the profession and the Authority as the regulator of that profession. 
  3. The Authority acknowledged that there was legitimate public interest in transparency, accountability and in the scrutiny of the actions of a public authority.  It therefore considered that the Applicant likely had a legitimate interest in the information requested. 
  4. The Commissioner accepts that the Applicant has a legitimate interest in obtaining the withheld personal data, for the reasons set out by the Applicant and acknowledged by the Authority. 

Is disclosure necessary to achieve the legitimate interest?

  1. Having satisfied himself that the Applicant has a legitimate interest, the Commissioner must consider whether disclosure of the withheld information, the personal data, is necessary to achieve the legitimate interest in the information.
  2. Here, “necessary” means “reasonably” rather than absolutely or strictly necessary.  The Commissioner must therefore consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the data subject(s). 
  3. It was the Authority’s view that the public interest in fitness to practise processes was served by the communication of information about cases, in accordance with the Public Information Policy.  It explained that it had discretion in terms of its Fitness to Practise Public Information Policy to withhold or withdraw an impairment decision from publication (in whole or in part), for the reasons set down in section 13 of the Public Information Policy. 
  4. The Authority commented that this ensured that enough information about fitness to practise cases was shared to protect the public, while being fair to workers and others involved in the case.  It did not consider it would be appropriate, fair or proportionate for it to publish the circumstances behind every decision to withhold or withdraw an impairment decision from the website. 
  5. The Authority’s view was that the Applicant (and the general public) could therefore be satisfied that impairment decisions were withheld or withdrawn from publication for the reasons set down within section 13 of the Public Information Policy.  It was not, therefore, necessary or proportionate to disclose the withheld personal data in order to achieve the Applicant’s legitimate interest.
  6. The Authority noted it had informed the Applicant that impairment decisions had been published and taken down at workers' request fewer than five times over the specified time period.  It considered that this demonstrated such events were rare and exceptional and that providing the precise number of instances was unnecessary to illustrate this point.
  7. In summary, the Authority concluded that disclosure of the withheld information was not necessary to achieve the Applicant’s legitimate interest (or that of the public).
  8. The Commissioner acknowledges the Authority’s position that it has already published, and has already provided the Applicant with, information that goes some way to satisfying the Applicant’s legitimate interest. However, the Commissioner acknowledges that the Applicant wants to receive the specific information requested; information in respect of which he has already accepted the Applicant has a legitimate interest.  There seems no other way to achieve a complete understanding of this specific information requested without it being disclosed in full.
  9. On balance, the Commissioner considers that disclosure of the withheld information would be necessary to achieve the Applicant’s legitimate interest.  Consequently, he will go on to consider whether the interest in obtaining the personal data outweighs the rights and fundamental freedom of the data subject(s).

The data subject(s) interests or fundamental rights and freedoms (and balancing exercise)

  1. The Commissioner has concluded that the disclosure of the information would be necessary to achieve the legitimate interests of the Applicant.  However, this must be balanced against the fundamental rights and freedoms of the data subject(s).  Only if the legitimate interests of the Applicant outweighed those of the data subject(s) could the information be disclosed without breaching the first data protection principle.
  2. The Commissioner’s guidance on section 38 of FOISA list certain factors that should be taken into account in balancing the interests of the parties.  He makes it clear that, in line with Recital (47) of the UK GDPR, much will depend on the reasonable expectations of the data subject(s) and that these are some of the factors public authorities should consider:
    1. Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)? 
    2. Would the disclosure cause harm or distress? 
    3. Whether the individual has objected to the disclosure.
  3. The Authority recognised that under the terms of its Public Information Policy, the Applicant, workers and the public could reasonably expect certain information in relation to fitness to practise hearings and sanctions to be published.  While it acknowledged that the removal of an impairment decision from the website (at the request of the worker) was not explicitly covered within the Public Information Policy, it noted that the Policy provided that there would be circumstances where the Authority would not publish information about fitness to practise hearings or sanctions. 
  4. The Authority highlighted that where a decision was taken not to publish an impairment decision, this fact would not be published anywhere.  However, the Public Facing Register would be updated to show the worker’s removal (without including a link to the impairment decision).  It stated that no explanation would be provided as to why the impairment decision was unavailable, nor whether the worker had requested that the impairment decision be withheld or withdrawn.  It submitted that a worker would not reasonably expect the Authority to publicly share this information. 
  5. While a fitness to practise case related to the public life of a worker, the Authority considered the withheld information could also be said to relate to the private life of a worker.  In other words, a request to remove an impairment decision, and the reason for removing it, may be related to personal and private matters.  Given the possible reasons for removing an impairment decision from the website, it explained that it had considered whether a worker would likely to find the disclosure of this information (as well as the fact that a request had been made for an impairment decision to be withheld or withdrawn) intrusive and distressing.
  6. The Authority also explained that its Privacy Notice, Fitness to Practise Rules and Public Information Policy did not provide that the withheld information would be shared or made public in response to a FOISA request.  It therefore considered that disclosure of the withheld information would not be compliant with the principles of fairness and transparency.
  7. On balance, the Authority concluded that disclosure of the withheld information in order to satisfy the Applicant’s legitimate interest was not proportionate given the potential impact on the interests and fundamental rights and freedoms of the data subject(s). 
  8. The Commissioner has fully considered the submissions made by the Applicant, which are rehearsed earlier at paragraphs 23-24 and 43. 
  9. Additionally, the Applicant explained that his request was made following a sanction by the Authority against an individual which it had subsequently removed from its website.  He considered that there was a “recognised public interest when these reports are published in the first instance”.  He noted that a recent impairment decision published by the Authority stated:

"The [Authority] considers a Removal Order is the most appropriate sanction as it is both necessary and justified in the public interest and to maintain the continuing trust and confidence in the social service profession and the [Authority] as the regulator of the profession."

  1. The Applicant submitted that there was also an “overriding” public interest in the Authority providing reasons for impairment decisions being removed from its website.  He considered that public had the right to know why impairment decisions were removed in order to maintain the continuing trust and confidence in the social service profession and the Authority as the regulator of the profession.
  2.  The Commissioner has carefully considered the submissions of the Applicant and the Authority.  He notes that any sanction imposed as a result of an impairment decision is still publicly available on its Register, whether the decision itself is published or not.  As such, if, for example, an organisation or member of the public wished to engage the services of a worker they could freely check whether a person was registered and if any sanctions had been imposed or their registration had been removed.  In this way, the Commissioner considers that the Authority can fulfil its duty to protect the public without disclosing the withheld information. 
  3. The Commissioner agrees that there is a strong public interest in ensuring regulators are held to account, particularly where the population they are protecting are a vulnerable group in society.  However, against this he must balance the effect of disclosure of the withheld information on the data subject(s) in question. 
  4. In all of the circumstances, the Commissioner considers that disclosure of the withheld information would be likely to cause distress and harm to the data subject(s). He accepts that, having had agreement for an Impairment Decision to be removed from the Authority’s website, the data subject(s) would have no reasonable expectation that the withheld information – which the Commissioner has concluded is the personal data of the data subject(s) – would then be disclosed to the world-at-large in response to a request under FOISA.
  5. After carefully balancing the legitimate interest of the Applicant against the interests and fundamental rights and freedoms of the data subject(s), the Commissioner finds that the legitimate interest served by disclosure of the information would be outweighed by the effect disclosure would have on the rights and freedoms of the data subject(s).
  6. As such, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met in this case and that disclosure of the information in question would be unlawful.
  7. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent in relation to the data subject(s).
  8. The Commissioner is satisfied, in the absence of a condition in Article 6 of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful.  He therefore finds that the withheld personal data is therefore exempt from disclosure under section 38(1)(b) of FOISA.

Decision 

The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

 

 

Euan McCulloch 

Head of Enforcement 


21 September 2026

  1. ^

  2. ^

  3. ^

  4. ^

  5. ^

  6. ^

  7. ^

  8. ^

  9. ^