24-25/71

I refer to your request for information (FOI 24-25/71) dated 28 November 2024 for records related to an email dated 30 September 2024, in particular in relation to an internal process, which we have handled under the Freedom of Information (Scotland) Act (FOISA).

You asked:

“Please could you therefore let me know:

The internal processes that were used by you to progress the matter and provide me with:

• Copies of all internal correspondence which demonstrates that the matter was appropriately investigated
• Copies of any document or correspondence which demonstrates that any conclusion was reached regarding what you refer to as “an allegation” through you progression of the matter
• Copies of any document or correspondence which demonstrates that a need for improvement in GTCS processes was found as a result of your progression of the matter
• Copies of any document or correspondence which demonstrates that any irregularity or failing was found in the actions of any individual(s) as a result of your progression of the matter
• Copies of any document or correspondence which demonstrates that any learning or improvement resulted from your progression of the matter”

We have considered your request in the context of the rights of the employee in question (the data subject) as balanced against your legitimate interests as the requester, specifically in relation to Article6(1)(f) of the UK GDPR, which provides that disclosure would be lawful if “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”.

Having considered the requirements under Article 6(1)(f) we consider that the information requested in bullet points 1, 2 and 4 would generally be considered confidential and only shared among limited individuals for specific purposes; and that the rights and freedoms of the named employee would be prejudiced, as they would have no expectation that information requested would be disclosed into the public domain under FOISA. We have therefore applied s38(1)(b)– personal information – to your request on the basis that disclosing the personal data that you have requested would contravene the data protection principle in Article 5(1)(a)of the UK GDPR, namely that “personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.

With regard to bullet points 3 and 5, we do not hold any information in relation to these points. I therefore apply section 17 – information not held.

If you are dissatisfied with this response, you may contact informationgovernance@gtcs.org.uk to request GTCS conduct a review of it. You should describe the original request and explain your grounds of review. You have 40 working days from receipt of this response to submit a review request. When the review process has been completed, if you are still dissatisfied, you may use the Scottish Information Commissioner’s guidance on making an appeal to do so.

I refer to your request dated 30 December 2024 for a review of the response you received 24 December 2024 to your original information request to GTC Scotland (FOI 24-25/71), dated 28 November 2024.

You have expressed dissatisfaction with our response to your information request. To enable your review request to be considered afresh and by someone who has not responded to your original request, I have been appointed to undertake the internal review on behalf of GTC Scotland.

Your original request

In your original request you asked for the following:

• Copies of all internal correspondence which demonstrates that the matter was appropriately investigated
• Copies of any document or correspondence which demonstrates that any conclusion was reached regarding what you refer to as “an allegation” through you progression of the matter
• Copies of any document or correspondence which demonstrates that a need for improvement in GTCS processes was found as a result of your progression of the matter
• Copies of any document or correspondence which demonstrates that any irregularity or failing was found in the actions of any individual(s) as a result of your progression of the matter
• Copies of any document or correspondence which demonstrates that any learning or improvement resulted from your progression of the mater

On 30 December 2024, you sent an email requesting we review our decision in FOI 24-25/71 under section 20(1) of FOISA.

Your internal review request

In your review request of 30 December 2024, you state:

What I submitted was a complaint which I could reasonably have expected would be dealt with under your complaints procedure. Pauline Stephen decided not to use the complaints procedure but did not give a coherent reason for this. It is reasonable that I receive at least the information that I would have received had the complaints procedure been properly followed. It is a normal part of any complaints process that providing a response to the complaint will involve disclosing some personal information about staff. Staff can expect that in working for an organisation they are subject to the complaints procedures and that therefore limited personal information may be disclosed if a complaint is made.

Where you have applied an exemption I believe that it is possible to largely comply with my request through appropriate redactions or summarisation to keep personal information private while respecting the public’s right to know.

You cannot apply an exemption to information unless you have already concluded that the information exists. Therefore on points 1, 2 and 4 you are indicating that the information exists. I don’t believe that it is reasonable to say that information exists which demonstrates that an irregularity or failing was found while also saying that there is no document or correspondence which demonstrates that a need for improvement in GTCS processes was found.

Please see our response to your request for an internal review below.

Our response

I would note that you refer to an email sent to you by GTC Scotland’s CEO on 30 September. Having reviewed the records, I note that the extract of an email you are referring to was sent on 25 September, to which you replied on 30 September. I have therefore considered the relevant email that forms the basis of your request to be that of 25 September.

Having carried out the review, I note that s38(1)(b) was applied to part 1, 2 and 4 of your request as this is, given its very nature, personal information about an identifiable individual. Parts 3 and 5 of your request had s17 – no information held – applied.

I would note from the outset, for clarity, that our initial application of s38(1)(b) was made in order to confirm that we consider the request to be inherently relating to personal data. The information you requested refers directly to an individual whose identity you are aware of. As a result, personal data is immediately engaged and data protection requirements must be considered, in line with FOISA.

The response was not intended to, nor did it, confirm that information was held. However, I consider that the response provided to you was incomplete in that, in my review of the information, and given the nature of the information requested, s18(1) ought to have been applied to the whole request.

However, in the circumstances and in light of some information having been confirmed as not being held under s17 (namely part 3 and part 5), and having considered the information available, I provide you with my review response.

I uphold the application of s38(1)(b) to Part 1 of your request and the reasons provided in the original response, namely that disclosing the personal data that you have requested would contravene the data protection principle in Article 5(1)(a) of the UK GDPR, namely that “personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.

In considering the application of s38(1)(b) we must balance the legitimate interest of the data subject and the requester. While we note your interest in this information as a result of you raising a concern against the member of staff and wishing to know the outcome of any such internal process, we consider that that interest of that individual to have personal matters, including any employment matters, to be kept confidential and there would be no expectation that any such information would be disclosed in to the public domain. We consider the interest of the data subject outweighs your interest in the progression of a complaint against an employee of GTC Scotland.

In relation to parts 2 and 4 of your request, having reviewed the records, I instead apply s17 – no information held. In relation to parts 3 and 5 of your request, I uphold the application of s17 – no information held.

If you are dissatisfied with this response to your review request, you have a right of appeal to the Scottish Information Commissioner within 6 months of this review response. The Scottish Information Commissioner’s guidance on making an appeal describes the process, including the application form. Further information, including relevant contact details is available on the website. If you are dissatisfied with the decision of the Commissioner, following an appeal to the Commissioner, you have a right of appeal to the Court of Session on a point of law.