/

Strategy & Commissioning

Children’s Services Directorate
Minerva House, Pendlebury Road,
Swinton, Salford, M27 4EQ
C Murton
What Do They Know
By e-mail:
/ Phone
Fax
Email
Web
My Ref
Your Ref / 0161 778 0147
0161 728 6110


17th June 2009
Subject: /

REQUEST FOR INFORMATION – APPEAL

THE FREEDOM OF INFORMATION ACT 2000

Dear Sir/Madam,

I refer to your e-mail of 22 April 2009 seeking an internal review of the Council’s Section 17 refusal notice of 16 April 2009 to the following FOI request you had made:

A The number of persons in the local authority of compulsory school age who are, or claimed to be, electively home educated and who have been either suspected or found to be involved in child abuse, neglect, forced marriage, sexual exploitation or domestic servitude

B. How many (if any) Serious Case Reviews or Joint Area Reviews have reported with respect to home educated children in the LA.

The purpose of my review is to consider whether the Council has complied with its obligations under FOI, in refusing to provide you with the information to Part A of your request: and in its response to part B. I have reviewed your request, and any information held completely afresh

Dealing with the Part B of your request first, I am satisfied that the response advising that there have been no Serious Case Reviews or Joint Area Reviews complies with the Council’s FOI obligations. The Council does not hold any recorded information about any Serious Case Reviews or any Joint Area Reviews in relation to home educated children.

Turning to Part A of your request, the Council previously refused to provide you with the requested statistic in reliance of the Section 40 FOI exemption relating to breaching the personal data principles of the Data Protection Act 1998 (DPA).

For the avoidance of doubt, I confirm that the Council holds the requested information. However the Council does not hold any recorded information regarding children electively home educated and have been either suspected or found to be involved in forced marriages.

As to the balance of Part A of your request, I regret to advise, that having reviewed the information held in respect of Part A, the Council maintains its reliance upon the FOI Sections 40(2)(b) & 40(3)(a)(i) exemption. i.e. that this would be disclosure of third party personal data in breach of one or more of the DPA data protection principles.

Although the Council accepts that the request is for a statistic: in this specific instance, having regard to the number of individuals about whom the information is held, the Council considers that the statistic itself amounts to personal data. Further, the Council considers that to disclose this information would breach some of the data protection principles. The reasons behind these views are as follows:

-As your request concerns a focussed set of circumstances, being a combination of being electively home educated AND having been suspected of/ having been involved in child abuse etc etc, the statistic involved is extremely low across the range of parameters. So much so that there is a very real risk of either: self–identification by the individual(s) concerned; or identification by others by piecing together other information already out in the public domain or obtained through further more detailed FOI requests to either other departments within the Council, central government departments or non-departmental public bodies. The nature of the request is such that, if combined with disclosure of the statistics of the people involved, is sufficiently unique, as to amount to their biographical information.

-Some of these issues were considered in the ICO decision in The Department of Health,reference FS50122432;

'The Commissioner accepts that there is a problematic area where several requests made under the Act, which in themselves are focused on non-personal data, may be compiled to form a ‘mosaic’ of requests, which can lead to personal data being deduced from a number of disclosures of information. He acknowledges that it is possible that an informed individual, with a particular interest in an issue, may be able to discover personal data about particular individuals by combining apparently anonymous data with other information at their disposal.'

The ICO also discusses:

“Self-identification/identification: Where a cell has a large value, risks arising from identification are not usually significant. Where a cell has a small value, this does need more consideration as identification or self-identification can lead to the discovery of rareness, or even uniqueness, in the population of the statistic. For certain types of information, rareness or even uniqueness may encourage others to seek out the individual. The threat of reality of this could cause harm or distress to the individual, or may lead them to claim that the statistics are inadequate to protect them, and therefore others. Due to the sensitive nature of abortion statistics, and in particular those due to medical conditions protection should be provided against identification.

The Motivated Intruder: Here the information in the statistic is combined with information from local sources to identify an individual and disclose further details…Although the local sources reveal the identity of the individual it is the statistics that cause the motivated intruder to start looking and attempting to reveal what is disclosive.”

The Council is particularly concerned because of the unique nature of the information about the individuals concerned. The very unique qualities of that data to which any statistic would relate, would mean that it would require less effort to discover the identity of the data subjects. Release of the requested data could provide significant biographical detail which could, in conjunction with other data available, lead to the identities of the individuals concerned.

The Council is not suggesting that you are a “motivated intruder” or are seeking to identify any specific individuals. However the fact that the numbers involved are low, coupled with the potential ease of discovery, due to the uniqueness of the information, could pose significant detriment to the individuals concerned, were their identities discovered. The potential harm to those individuals self-identifying is also significant. The Council is of the view that the risk to detriment ratio is high.

-Also in the context of fairness, the Council also considers that the statistic is de facto personal data itself. Section 1 of DPA defines personal data as:

“personal data” means data which relate to a living individual who can be identified—

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

Part (b) of the definition refers to (the ability to identify living individuals) from those data which is in the possession of, or is likely to come into the possession of the data controller.

The Council as data controller, already possesses other personal data and other information related to the requested statistical data which could lead to the identification of the individuals. In other words the statistic in combination with other “data and other information” could lead to identification. So the statistic is therefore already personal data in the Council’s hands.

The statistical data is taken directly from detailed biographical personal and sensitive data obtained by the Council. In reaching this decision, the Council has also considered the Information Commissioner’s Office (ICO) decision notice in respect of Cardiff County Council Reference FS50162459.

In this case, the ICO agreed that;

'It is clear that the information withheld does relate to living individuals (the pupils concerned) and that those individuals can be identified by that information and other information in the possession of the ‘data controller’ (the public authority). This is because the statistical information requested by the complainant is itself derived from records that include the names of the data subjects.

Accordingly, it is the Commissioner’s decision that the information requested does constitute personal data, within the definition at section 1(1) of the DPA”

The above view is also supported in the ICO’s own Legal Guidance to the Data Protection Act ( at p13 onwards (ibid)

The guidance appears to imply that even though a statistic could on the face of it be anonymous information, in the sense that it is stripped of its personal identifiers, per the guidance: “the fact that the data controller (i.e. Salford City Council) is in possession of this data set which if linked to the data which have been stripped of all personal identifiers, will enable a living individual to be identified, means that all the data, including the data stripped of personal identifiers, remain personal data in the hands of the data controller and cannot said to be anonymised. The fact that the data controllers may have no intention of linking these two data sets is immaterial”

As stated above the statistic has been taken from biographical personal and sensitive data i.e. information linked to other personal identifiable information held.

It is acknowledged that the personal data may or may not be such in the hands of the person to whom it is disclosed, (although in this instance for the above reasons we believe it is). However this does not detract from the Council’s position that even stripped of its personal identifiers, the Council would have to justify to the ICO whether the statistic stripped of all personal identifiers is no longer personal data. The Council does not consider it would be able to, especially in the context of the request made, and the unique nature of the individuals the statistic appertains to.

As the Council is of the view that even if undisclosed, the statistic is personal data, (in combination with other information it holds), in its hands, it has to process personal data in accordance with the data protection principles. It is not the fact that the information may hypothetically lose its status as personal data upon disclosure, but rather that it is personal data in the Council’s hands when it processes it in the first place.

Applying the data protection principles therefore:

- In the context of the first data protection principle and the requirement to process personal data fairly and lawfully, as will be appreciated, disclosure whereby specific individuals could be identified, would, in this instance involve disclosure of sensitive personal data as well as their ordinary personal data. In particular, some the atrocities you have identified would go towards the data subjects’ physical or mental conditions or indeed, if it was applicable, their sexual life.

The Council does not consider there are any DPA Schedule 3 conditions that could be met in disclosing sensitive personal data. As no Sch 3 conditions can be met, in the absence of consent, which in these instances cannot be reasonably obtained, any ability to meet a Sch2 condition is academic. Accordingly disclosure would lead to unlawful and unfair processing of personal and sensitive personal data in breach of the first data protection principle.

-In accordance with the 2nd data protection principle, the Council cannot process (which includes disclosure to you) personal data for a purpose incompatible with the purpose for which it was obtained.

Against the backdrop of low numbers being involved, the ease of discovery, and that those numbers are in any event considered to be personal data: there would be no expectation of the individual data subjects involved, that their personal data would be released into the public domain. Neither were the data subjects informed nor would they expect, that statistics amounting to their personal data is collected for release into the public domain.

So for the reasons stated above, the Council regrets having to advise that it is withholding the requested information in reliance of FOI Sections 40(2)(b) & 40(3)(a)(i)

On a more general note, I feel compelled to observe that the Council is striving to ensure that it meets it FOI obligations and also safeguard the privacy of specific vulnerable children. The Council has formed the view, in this instance weighing up the risk of identity discovery and risk of detriment to the individuals, which goes towards fairness of processing their personal data.

I hope this goes some way towards explaining why the information cannot be released. However, as the review has concluded, should you remain dissatisfied, then you may take the matter up with the ICO, as previously advised.

Yours sincerely,
Terry Walsh
Head of Service
Management Information & Sharing
Salford Children’s Services