Vetting Appeal
Freedom of information request reference no: 01.FOI.24.035678
I note you seek access to the following information:
1. I need the exact laws, legislation and case law, that you are referring to when you state "you are legally unable to provide the reasons for refusal".
2. Can you give me full details of what's happening
3. and the details of who the company is that conducts vetting
4. and who their data protection officer is
5. Also can you provide the Met recruitment Data Protection Officer details
Decision
I have today decided to disclose some of the requested information. Some data has been withheld as it is exempt from disclosure and therefore this response serves as a Refusal Notice under Section 17 of the Freedom of Information Act 2000 (the Act).
In respect of Questions One (1) and Two (2) the Metropolitan Police Service (MPS) neither confirms nor denies that it holds the information you have requested as the duty in Section 1(1)(a) of the Freedom of Information Act 2000 does not apply by virtue of the following exemption;
Section 40(5A)(5B) - Personal Information
The answer to Question Four (4) and Five (5) is exempt by virtue of Section 21 as this information is accessible by other means. The link to where the answer is published is within the Section 16 element of this response letter. The MPS is not required by statute to re-release the information requested and so this data is exempt from disclose by virtue of the following exemption;
Section 21 - Information accessible by other means
Reason for decision
In respect of Questions One (1) and Two (2), it is important to explain that any information confirmed as held and then disclosed under FOIA is effectively a disclosure to the world at large and would be disclosed to any individual upon request. For this reason, a request under the Act is not a private transaction. Both the request itself, and any information which may be disclosed (or confirmed as held), is considered suitable for open publication. Therefore, when considering whether information is suitable for being confirmed as held and disclosed, a public authority is entitled to consider the effect of disclosure to any individual.
These two questions appear to indicate you have been in contact with the MPS. An FOIA decision letter is a response to the world (as we publish FOIA disclosures on our Publication Scheme) and so is not the forum to confirm or deny if we hold any personal information about you or why. Any such, correspondence should be directed to the relevant business unit outside the arena and outside the remit of the FOIA. Further advice can be found within the Section 16 element of this response letter to assist you on this.
Section 40(5A)&(5B)(a)(i) – Personal Information - It should be noted that personal information is not limited to the name of an individual. Information that can be used to identify an individual linked in some way to the individual referred to in the request can also be classed as personal information. The information you have requested, if held, relates to personal information of individuals who may be linked to police contact / investigations that the MPS has had a duty to conduct.
If held, the information you have requested is considered by the MPS to be personal. The MPS believes that the release of the requested information, if held or not, by way of a FOIA disclosure would be unfair, constituting unfair processing of personal data under principle one of the DPA 2018.
Any disclosure would not be solely to you and therefore the type of information requested could be used to identify not only the named individual but also others linked with any possible investigation / contact with police which may have occurred. This would be unfair as those linked to police contact / investigations who would not reasonably expect the MPS to publish information that would allow them to be identified. Such identification may lead to unwanted and unsolicited intrusion from the media or others interested in the facts of the matter.
Section 40(5)(b) (i) is applicable in circumstances where a confirmation or denial in relation to whether information is held would breach one or more of the data protection principles specified within the Data Protection Act 2018 and GDPR. For the MPS to confirm or deny whether information is held may inadvertently disclose whether or not an individual(s) has been or is linked to an allegation of a crime.
Criminal offence data - There is a possibility that information, if held, relates to criminal offences and convictions as defined in GDPR Article 10 and Section 11(2) of the Data Protection Act 2018), specifically information relating to:
• the alleged commission of offences by one or more data subjects
• proceedings for an offence committed or alleged to have been committed by one or more data subjects or the disposal of such proceedings, including sentencing.
The ICO’s guidance titled ‘Personal information (section 40 and regulation 13) states:
‘In order for you to disclose criminal offence data lawfully, under Article 10 of the GDPR, in addition to an Article 6 basis for processing, the disclosure must either:
• be carried out under the control of official authority; or
• meet a specific condition in Schedule 1 of the DPA.
In the UK there is currently no definition of an official authority in this context. Therefore, for the purpose of considering the disclosure of such information under FOIA or the EIR, you need to consider whether any of the conditions in Schedule 1 of the DPA apply…
Due to its sensitivity, the conditions for processing criminal offence data are very restrictive and generally concern specific, stated purposes. Consequently, only two are relevant to allow you to lawfully disclose under FOIA or the EIR. They are similar to those identified above for special category data. These are:
• consent from the data subject; or
• the processing relates to personal data which has clearly been made public by the individual concerned.
If a relevant condition cannot be met, you must not disclose the information as disclosure would be unlawful and therefore in contravention of principle (a).’
The processing of this data by way of disclosure for the purposes of responding to a FOIA request does not meet a specific condition within Schedule 1 of the DPA.
Although your request may relate to the investigative information regarding an individual, the MPS has to be mindful of the impact of confirming or denying that information is held on any individuals who could be identified or personally impacted by disclosure of the requested information, if held. As mentioned, those linked to such information if held (such as victims, witnesses, family and associates) would not reasonably expect the MPS to publish information that could lead to their personal information being placed into the public domain and / or cause them to be subjected to unwarranted intrusion and / or distress.
In relation to balancing the rights of data subjects and the legitimate interests in disclosure the ICO guidance also states:
'Public authorities should note that this is not the same as the public interest test for qualified exemptions and there is no assumption of disclosure.'
Therefore, to justify disclosing if personal data is held, it would be necessary to establish a substantial public interest that would outweigh the rights of the data subject.
Is there a legitimate public interest in disclosure?
The MPS recognises that there is no legitimate public interest in confirming or denying that information is held in this case.
Will disclosure cause unwarranted harm to the interests of the individual?
Confirmation of whether or not the information requested is held under FOIA may cause unwarranted harm to the interests of individual(s). In light of the nature of the information (if held) and reasonable expectations of individual(s), I do not believe there is any reasonable expectation of interested parties', if applicable, that information pertaining to any police investigation / contact they are linked to (if held), either directly or indirectly being publicly disclosed under the Freedom of Information Act which could also potentially cause unnecessary and unjustified distress. The subject(s) of this request would have no reasonable expectation that the MPS would place their personal information into the public domain as this could lead to unsolicited contact, intrusion and distress.
Confirming or denying whether or not the information requested is held would contravene the 1st data protection principle, relating to the fair and lawful processing of personal data. The MPS has a legal obligation to take appropriate steps to protect personal data that may be held. A statement confirming or denying via FOIA whether information is held would require disclosing personal data and would impair the ability of the MPS to fulfil its legal obligations.
Please note that this notice does not confirm nor deny that the MPS hold the information that you have requested.
Section 21 (1) (Information accessible to applicant by other means) - Some information requested has been identified as being accessible via other means as it is already published.
Where information is already in the public domain we are not required to re-publish the data. Instead public authorities are required to direct you to the information, which we have done in this instance.
This notice should not be taken as an indication of whether or not the requested information is held
Disclosure
Q3 - The details of who the company is that conducts vetting
The MPS can confirm the Metropolitan Police Vetting Unit undertake MPS vetting, no other company.
SEction 16 - Advice and Assistance outside of the FOIA
Q1 - I need the exact laws, legislation and case law, that you are referring to when you state "you are legally unable to provide the reasons for refusal".
Q2 - Can you give me full details of what's happening
I have referred to Question One and Two back to the Data Rights Unit Enquires team and advised them to be in contact with you regarding this element of your letter. I have also referred them your follow up email to me dated 12/02/2024 and asked them to advise on the SAR/ Data Protection element.
If you wish to make contact earlier, you can email;
[email protected]
Q4 - and who their data protection officer is
The MPS Data Protection Officer is published and named within the MPS Privacy Notice below;
Privacy notice | Metropolitan Police