Decision 302/2025:  Number of children placed with named childminder via the Community Childminding Service

Authority: Fife Council 
Case Ref: 202500835
 

Summary

The Applicant asked the Authority for the number of children placed in the care of a named childminder via the Community Childminding Service.  The Authority withheld the information requested on the grounds that it was third party personal data and that disclosure would, or would be likely to, prejudice substantially the effective conduct of public affairs.  The Commissioner investigated and found that the Authority was not entitled to withhold the information requested.  He required the Authority to disclose the information to the Applicant. 

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data” (Definitions) and 5(1)(a) (Principles relating to processing of personal data).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 18 March 2025, the Applicant made a request for information to the Authority relating to the Community Childminding Service (CCS).  Among other things, he asked the Authority:

   “How many children in total were placed with [named childminder] via the [CCS]?”  

2. The Authority responded on 17 April 2025.  It withheld the information requested under the exemption in section 38(1)(b) of FOISA.
3. On 24 April 2025, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he did not accept that the exemption in section 38(1)(b) of FOISA applied.
4. The Authority notified the Applicant of the outcome of its review on 22 May 2025, which fully upheld its original decision.
5. On 26 May 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated that he was dissatisfied with the outcome of the Authority’s review because he did not accept that the exemption in section 38(1)(b) of FOISA applied.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 5 June 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions relating its reliance on the exemption in section 38(1)(b) of FOISA.
9. When providing submissions on the exemption in section 38(1)(b) of FOISA, the Authority notified the Commissioner that it also wished to apply the exemption in section 30(c) of FOISA. 

Commissioner’s analysis and findings

10. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 38(1)(b) – Third party personal information 

11. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
12. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA
13. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
14. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data? 

15. The first question that the Commissioner must address is whether the specific information withheld information by the Authority is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual.

16. Section 3(3) of the DPA 2018 defines “identifiable living individual” as “a living individual who can be identified, directly or indirectly, with reference to –

    a) an identifier such as a name, an identification number, location data or an online identifier, or

    b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

17. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland (C-582/14)[1].  The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified.  In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party.  However, there must be a realistic causal chain – if the risk of identification is "insignificant", the information will not be personal data.
18. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply.  As set out in Recital (26) of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly.  
19. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, the available technology at the time of processing and technological developments.  It confirms that data should be considered anonymous (and therefore no longer subject to the UK GDPR) when the data subject(s) is/are no longer identifiable.

The Applicant’s submissions on identifiability 

20. The Applicant noted that his request had asked for the total number of children placed with the named childminder via the CCS.  In other words, he had requested a single figure – and he had not asked for names, ages, dates or any other identifying characteristics.
21. The Applicant acknowledged that personal data could include information which, even without a name, might indirectly identify someone.  However, he did not believe that the figure he had requested met that threshold.  He argued that, on its own and without any context, the number of children placed with the named childminder via the CCS was unlikely, in practice, to lead to the identification of any individual(s).
22. The Applicant noted that the Authority had suggested that media interest, combined with a small number, could risk identification.  Without knowing the figure itself, he said it was difficult to see how that argument held.  However, he submitted that a simple headcount should not “expose sensitive detail” and that the Authority’s concerns about how others might interpret that figure felt speculative at best.

The Authority’s submissions on identifiability 

23. The Authority maintained that the number of children placed with the named childminder via the CCS constituted personal data (as defined in section 3(2) of the DPA 2018).  While the withheld information comprised a single figure, it argued that it related to identifiable individuals.
24. The Authority explained that, in a small cohort, even a single figure could be used to infer identities, especially when combined with other known details (which it described).  It argued that the precision and specificity of the number increased the risk of identification and made the withheld figure personal data, particularly “in small communities or sensitive contexts”.
25. The Commissioner asked the Authority to provide further detail on how it anticipated that disclosure of the withheld figure would result in a realistic prospect of someone being identified, including how it thought someone could distinguish between a child placed with the named childminder via the CCS and other children to whom they provided childminding services.
26. The Authority responded that, given pending court proceedings and related media attention, it anticipated that there would be increased focus on the children placed in the care of childminders by the Authority.  It argued that existing available information and information uncovered or disclosed because of this increased attention could, when combined, enable the identification of specific individuals and that disclosure of the exact number of children involved would “significantly heighten” the risk of individual children being identified.
27. Specifically, the Authority explained that disclosure of the withheld figure would increase the risk of identification because it would provide a precise data point that could be cross-referenced with other publicly available or emerging information (e.g. dates, locations and known individuals involved).
28. While the Authority informed the Applicant that the figure concerned was “low”, it argued that this introduced an “ambiguity that helps protect anonymity”. Disclosure of the specific figure would, however, narrow the scope considerably, making it easier for those, particularly with partial knowledge or access to related details, to piece together identities.  In sensitive cases involving vulnerable families and children, it argued that even seemingly minor disclosures could contribute to “a broader mosaic of information that comprises confidentiality”.

The Commissioner's view

29. The Commissioner has carefully considered the submissions from both parties.  He has also taken account of the withheld information itself (i.e. the number of children placed with the named childminder via the CCS).
30. The Commissioner recognises that the Applicant has not asked for any other information that might aid identification of the children concerned (e.g. names, dates or other identifiers relating to the number of children placed with the named childminder via the CCS).
31. The Commissioner notes that it is in the public domain that the CCS was launched in Fife in 2011 and that the named childminder had been childminding before 2011 (and continued to do so until 2024).  Given that the Applicant’s request did not specify a timeframe and that the named childminder also provided childminding services for children placed with them outwith the CCS, the Commissioner considers it likely that the named childminder provided childminding services to many more children than the “low” number of children that the Authority advised the Applicant comprised the withheld figure.
32. The Commissioner has considered whether it would be possible for a motivated individual to specifically identify children placed with the named childminder via the CCS.  Having done so, he can see no viable way to distinguish between children placed with the named childminder via the CCS and other children to whom they provided childminding services.
33. The Commissioner acknowledges that the Authority considered it likely, given pending court proceedings and related media attention, that certain information would be likely to enter the public domain in the future, which it considered would aid the prospect of identification of the children concerned.  However, the Commissioner must consider the circumstances at the date of the review outcome (at the latest).
34. In any event, the Commissioner is not persuaded that the information that the Authority speculated would be likely to enter the public domain in the future would materially aid the prospect of identification.  He recognises, and is sensitive to, the circumstances described by the Authority (although it does not appear reasonable to describe the community in question as small), but he cannot see how these circumstances (including the potential future disclosure of certain information) would address the question of how even a motivated individual would distinguish between children placed with the named childminder via the CCS and other children to whom they provided childminding services.
35. In the circumstances, the Commissioner is not convinced that disclosure of the information requested (i.e. the number of children placed with the named childminder via the CCS – a number the Authority had already informed the Applicant is “low”) would make it any easier or any more likely that any one of these children would be identified.
36. Consequently, in all the circumstances of the case (even acknowledging the need to take a precautionary approach when considering the personal data of children), the Commissioner is not satisfied that a realistic causal chain exists where living individuals could be identified as a direct result of disclosure of the information.  The Commissioner therefore does not accept that the withheld information qualifies as personal data, as defined in section 3(2) of the DPA.  Having reached this conclusion, he is not required to go on to consider whether any of the further tests for section 38(1)(b) of FOISA apply.
37. The Commissioner therefore finds that the Authority was not entitled to withhold this information under section 38(1)(b) of FOISA.  
38. As the Authority is also withholding the same information under the exemption in section 30(c) of FOISA, the Commissioner will now go on to consider the application of that exemption to the information requested.

Section 30(c) – Prejudice to the conduct of public affairs 

39. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs".
40. The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b) of FOISA.  This is a broad exemption, and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
41. In order for the exemption in section 30(c) of FOISA to apply, the prejudice caused by disclosure must be substantial and therefore of real and demonstrable significance.  The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility.  Each request should be considered on a case-by-case basis, taking into consideration the content of the information and all other relevant circumstances.

The Authority’s submissions

42. The Authority stated that it had a duty to protect personal information and disclosure of the withheld information would be considered a violation of the strict confidentiality it was legally required to handle cases with.  It submitted that disclosure of the withheld information would therefore cause reputational damage to the Authority and be likely to prejudice substantially the effective conduct of public affairs.
43. Specifically, the Authority argued that disclosure of the withheld information could undermine the trust and confidence that service users place in its Social Work Services. It submitted that such a breach of confidence may deter individuals from engaging openly with Social Work Services, thereby impairing its ability to deliver essential support and safeguarding functions.   It said that the resulting reputational damage and erosion of trust would negatively influence future interactions with Social Work Services, ultimately compromising the effectiveness of service delivery.

The Commissioner's view

44. The Commissioner has carefully considered the submissions made by the Authority, together with the withheld information.
45. While he accepts that in some circumstances the withholding of sensitive information would be necessary to maintain the effective conduct of public affairs, he does not believe, based on the Authority’s submissions and the nature of the withheld information, that is the case here
46. Specifically, the Commissioner is not persuaded that the service users for whom the CCS was set up to benefit would be discouraged from seeking help or engaging with the CCS based on disclosure of the withheld information in this case, or that disclosure would result in the reputational damage claimed by the Authority.  He considers that these arguments become even more tenuous, given his conclusion that there no realistic causal chain exists where living individuals could be identified as a direct result of disclosure of the information.  
47. As stated above, the Commissioner recognises, and is sensitive to, the circumstances described by the Authority (in terms of media attention and the potential future disclosure of certain information).  However, he must consider the circumstances at the date of the review outcome (at the latest).  In any event, he is not satisfied that disclosure of the specific information requested would, were these circumstances to arise, result in the harm required for the exemption in section 30(c) of FOISA to be engaged.
48. Given the above, the Commissioner is not satisfied that disclosure of the withheld information would prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.  He therefore finds that the exemption is not engaged and that the Authority was not entitled to apply section 30(c) to the withheld information.
49. As the Commissioner is not satisfied that the exemption in section 30(c) is applicable to the information, he is not required to go on to consider the application of the public interest test in section 2(1)(b) of FOISA.
50. As the Commissioner has found that neither of the exemptions in section 30(c) and 38(1)(b) of FOISA apply to the withheld information, he requires the Authority to disclose the withheld information to the Applicant.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

Specifically, he finds that the Authority failed to comply with Part 1 of FOISA by wrongly withholding the information requested under the exemptions in sections 30(c) and 38(1)(b) of FOISA.

The Commissioner therefore requires the Authority to disclose the wrongly withheld information to the Applicant, by 29 January 2026.  

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement 
 

15 December 2025