Investigation following complaint to Scottish ICO.
Dear Scottish Information Commissioner,
This relates to a situation where a complaint has been submitted to you concerning a council's failure to comply with the FOI Act. This council, being Dumfries and Galloway, has repeatedly failed to comply with the FOI Act. The person who made the complaint did it on behalf of someone else. The Scottish ICO asked for the identity of a person who was responsible for the complaint as well as information on the person who made this on their behalf.
What recorded information exists regarding the policy of the Scottish ICO in relation to complaints made on behalf of someone else?
In this case, the person declined to be named as is their right under GDPR. The Scottish ICO refused to accept the complaint as the person refused to be named. Prima facie, the Scottish ICO is acting unlawfully as they are insisting on having the name despite this breaching GDPR. Has the Scottish ICO obtained a legal opinion on this issue? What was the outcome of this? What is the statutory authority for requiring the name of a person who has had a complaint made on their behalf?
Complaints concerning failure to comply with the FOI Act made to the English ICO do not require details such as these. What is the reason for the requirement of the Scottish ICO which differs from that of their English counterpart?
Yours faithfully,
Richard Page
Our Ref: 201901840
Dear Mr Page,
Please find attached our letter of acknowledgement.
If you have any difficulties opening or viewing the file, please do not
hesitate in contacting me.
With best wishes,
Bethan Owen
Administrator
Scottish Information Commissioner
Kinburn Castle
Doubledykes Road
St Andrews
KY16 9DS
Phone: 01334 464610
Fax: 01334 464611
E-mail: [email address]
[1]www.itspublicknowledge.info
For information about what we do with personal data see our [2]Privacy
Notice
References
Visible links
1. http://www.itspublicknowledge.info/
2. http://www.itspublicknowledge.info/home/...
Dear Mr Page
Please find attached our response to your information request.
If you have any difficulty in reading the attachment, let us know so that
alternative arrangements can be made.
I would be grateful if you would acknowledge receipt.
Claire Stephen
Deputy Head of Enforcement
________________________________________
Scottish Information Commissioner
Kinburn Castle, Doubledykes Road
St Andrews, KY16 9DS
Tel: 01334 464610
Fax: 01334 464611
Email: [1][Scottish Information Commissioner request email]
Web: [2]www.itspublicknowledge.info
Twitter: [3]@FOIScotland
[4]cid:image002.jpg@01D1B812.C56B4A00
For information about what we do with personal data see our [5]Privacy
Notice
References
Visible links
1. mailto:[Scottish Information Commissioner request email]
2. http://www.itspublicknowledge.info/
http://www.itspublicknowledge.info/
3. https://twitter.com/FOIScotland
5. http://www.itspublicknowledge.info/home/...
Dear Scottish Information Commissioner,
Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Scottish Information Commissioner's handling of my FOI request 'Investigation following complaint to Scottish ICO.'.
Dear Scottish Information Commissioner,
Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Scottish Information Commissioner's handling of my FOI request 'Investigation following complaint to Scottish ICO.'.
Thank you for your reply of 22 October 2019.
The situation whereby someone is acting for another in submitting a request under The Freedom of Information Act has been addressed but the statute and case law predates the provisions of The General Data Protection Act 2018. This requires explicit consent for personal information to be shared with a third party. In the absence of consent then it isn't lawful to transfer information. In view of this, it seems that a FOI request can be made by someone acting for another without disclosing their identity. That this would be lawful.
Please note that complaints made to the for England and Wales do not require the information on the identity of the person who asked for the information. This matter never arises when a complaint is made concerning the failure to comply with a FOI Act by a public body.
A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/i...
Yours faithfully,
Richard Page
Our Ref: 201901840
Dear Mr Page
Please find attached our letter of acknowledgement.
If you have any difficulties opening or viewing the file, please do not
hesitate to contact me.
Yours sincerely
Kim Berry
Finance and Administration Manager
Scottish Information Commissioner
Kinburn Castle
Doubledykes Road
St Andrews
KY16 9DS
Phone: 01334 464610
Fax: 01334 464611
E-mail: [email address]
[1]www.itspublicknowledge.info
For information about what we do with personal data see our [2]Privacy
Notice
References
Visible links
1. http://www.itspublicknowledge.info/
2. http://www.itspublicknowledge.info/home/...
Dear Mr Page,
Thank you for your email of 24 December 2019. Please note that our office was closed from 24 December 2019 to 6 January 2020.
Our response of 22 October 2019 was a full response to your information request and provided you with copies of and links to all the information that we hold in relation to your request. You do not explain in your email why you are not happy with our handling of your information request. To be a valid request for a review you must tell us why you are not satisfied with our handling of your information request. Furthermore, a request for review must be made within 40 working days of receiving your response to the information request. We calculate this to be 18 December 2019. In the absence of an explanation as to why you are not happy with the handling of your information request and any mitigating factors which could have caused a delay in seeking a review, we have not conducted a review of your information request.
However, we note that you remain dissatisfied with our policy on the identity of the requester. You suggest that our policy should be updated in light of the General Data Protection Regulation (GDPR). You argue that this requires explicit consent for personal data to be shared with a third party and, in the absence of consent, it isn’t lawful to transfer information. As a consequence, you suggest that an FOI request can be made by someone acting for another without disclosing their identity.
You are correct to highlight that the GDPR brought about some changes in relation to consent, but organisations don’t always need consent to process personal data. Organisations can use personal data without consent if there is a valid reason. These reasons are known as a ‘lawful basis.’ There are six lawful bases an organisation can use to process personal data. There are two which can be relied on by public authorities and the Commissioner for the purposes of processing information requests and investigating appeals:
• Legal obligation: a public authority requires this information to comply with the law (section 8 of the Freedom of Information (Scotland) Act 2002 as explained in our response of 22 October 2019)
• Public task: a public authority is required to process personal data for its official functions. As a regulator, we are required to process personal data to investigate applications.
More information on the ‘lawful basis’ for processing personal data can be found on the UK Information Commissioner’s (the ICO's) website: https://ico.org.uk/.
It is our position that the GDPR does not alter our policy on the true identity of the requester. There is a clearly stated and tested legal basis for seeking the identity of the requester. It is our position that an FOI request still needs to identify the true applicant before we would consider it to be legally valid.
It is our understanding that the ICO's position is similar to ours with regard to the validity of requests and the identity of the requester – see paragraphs 13-16 of the following guidance: https://ico.org.uk/media/for-organisatio...
I’m sorry if you find this disappointing, but I hope some of the explanation detailed above addresses your concerns.
Margaret Keyse
Head of Enforcement
________________________________________
Scottish Information Commissioner
Kinburn Castle, Doubledykes Road
St Andrews, KY16 9DS
Tel: 01334 464610
Fax: 01334 464611
Email: [email address]
Web: www.itspublicknowledge.info
Twitter: @FOIScotland
For information about what we do with personal data see our Privacy Notice<http://www.itspublicknowledge.info/home/...>
We work to defend the right to FOI for everyone
Help us protect your right to hold public authorities to account. Donate and support our work.
Donate Now