Decision 001/2009 Mr X and Dumfries and Galloway Council
Name and address of a person providing information concerning the applicant
Reference No: 200801384
Decision Date: 05 January 2009
Summary
Mr X requested from Dumfries and Galloway Council (the Council) the name and address of the person who informed sheriff officers that he (Mr X) was employed at a particular place of work. The Council refused to release the information on the basis that it was exempt under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA).Upon review, the Council upheld this decision, and also applied the exemption in section 39(1).
Following an investigation, the Commissioner found that the Council had acted in accordance with Part 1 of FOISA by withholding the information from Mr X under the terms of section 38(1)(b) of FOISA. However, he identified that the Council had breached Part 1 (in particular, section 17(1)) of FOISA, because it had failed to notify Mr X that it did not hold the name of the person concerned.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA): sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held) and 38(1)(b), (2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 (the DPA): section 1(1) (Basic interpretative provisions) (definition of personal data); schedules 1 (The data protection principles) (the first data protection principle) and 2
(Conditions relevant for purposes of the first principle: processing of any personal data) (condition
6(1))
The full text of these provisions is reproduced in the Appendix to this decision. The Appendix forms
part of this decision.
Background
1.Before describing the information request under consideration in this case, it will be helpful to explain the context in which the request was made. In March 2008, an earnings arrestment schedule was sent to the premises of a particular employer in order to recover council tax arrears owed by Mr X.This schedule was issued after information was received by sheriff officers from a member of the public, suggesting that Mr X was an employee at those premises.It was subsequently confirmed that Mr X was not an employee at those premises.
2.On 13 April 2008, Mr X wrote to the Council requesting the name and address of the person who had provided information to the sheriff officers.
3.Following a significant delay (and the intervention of the Commissioner following the receipt of a valid application concerning the Council's failure to respond), the Council responded to Mr X's information request on 7 August 2008.It stated that it would not release the information requested, because it was exempt in terms of section 38(1)(b) of FOISA read in conjunction with (2)(a)(i) (Personal information).
4.On 13 August 2008 Mr X wrote to the Council requesting a review of its decision and stating that he did not consider the information he had requested to fall under any exemption.
5.The Council responded on 12 September 2008, stating that it was upholding its decision that the exemption in section 38(1)(b) of FOISA applied, and additionally relying upon the exemption in section 39(1) (Health, safety and the environment).
6.On 22 September 2008, Mr X made an application to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
7.The application was validated by establishing that Mr X had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
8.On 29 September 2008, the Council was notified in writing that an application had been received from Mr X and was asked to provide the Commissioner with any information withheld from him. The Council responded with the information requested and the case was then allocated to an investigating officer.
9.The investigating officer wrote to Mr X on 13 November 2008, requesting comments on his legitimate interests in the information he had requested, to assist the Commissioner's consideration of the exemption in section 38(1)(b) of FOISA.Mr X responded on 8 December 2008 providing his comments on the case.
10.The investigating officer wrote to the Council on 20 November 2008, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
11.The Council responded on 10 December 2008, providing comments on the application as a whole and on its application of the exemptions in section 38(1)(b) and 39(1) to the information withheld. The Council also provided background information relating to Mr X's request.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr X and the Council and is satisfied that no matter of relevance has been overlooked.
Is the information requested by Mr X held?
13.Mr X sought the name and address of the informant who had indicated that Mr X was employed at the relevant place of work.
14.The Council confirmed that the information had been given to sheriff officers by an unnamed member of the public who spoke to the officers at a residential address.The name of the informant and confirmation that this address was the informant's place of residence were never established by the sheriff officers.
15.The information under consideration in this decision is therefore an address at which the person concerned spoke to the sheriff officers.While it may be the case that this address is where that person resides, this cannot be confirmed from the information held by the Council.
16.Before going on to consider this information, the Commissioner has noted that, under the terms of section 17(1) of FOISA, an authority which receives a request for information that it does not hold, should notify the requestor that it does not hold that information.In this case, the Council failed to notify Mr X that it did not hold some of the information he requested.For this reason, the Council acted in breach of Part 1 and section 17(1) of FOISA.
17.Since this decision has clarified the position with respect to the extent of the information held by the Council, the Commissioner does not require any steps to be taken by the Council in relation to this breach.
Section 38: Personal information
18.The Council submitted that the information withheld from Mr X included information which is exempt from disclosure under section 38(1)(b) of FOISA because it is personal data relating to a living individual, and disclosure would contravene the first data protection principle.
19.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles laid down in Schedule 1 to the DPA.
Is the information under consideration personal data?
20.The first consideration in respect of section 38(1)(b) is whether the information constitutes personal data for the purposes of the DPA."Personal data" is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller(see the full definition in the Appendix).
21.Having considered the information which has been withheld by the Council (the address at which the informant spoke to the sheriff officers) the Commissioner is satisfied that this information constitutes personal data.Access to this information would confirm that a member of that household (or possibly a person who visited that household) had provided information to the sheriff officer in the period leading up to the issue of the earnings arrestment schedule.Given the small number of members of any household, and the information or knowledge that may be available to others concerning their activities, the Commissioner considers that the information does relate to a living individual who is identifiable from this information and other information which may come into the possession of the data controller.
22.Having accepted that this information is personal data, the Commissioner must therefore consider whether the release of this information would (as the Council has argued) breach the first data protection principle.
Would disclosure of the information breach the first data protection principle?
23.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA (see Appendix for full text) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.The Commissioner has considered whether the information under consideration in this case is sensitive personal data and is satisfied that it is not.
24.In the circumstances of this case, the Commissioner has first considered the application of the conditions in Schedule 2 to the DPA.
Can a condition in Schedule 2 be met?
25.In order to determine that processing (in this case by disclosure) would be in accordance with the first data protection principle, the Commissioner would require to be satisfied that at least one of the conditions in Schedule 2 to the DPA was met. Condition 6 of Schedule 2 (see Appendix) would appear to be the only condition which might permit disclosure in the circumstances of this case. Condition 6 is met where:
"The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject."
26.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met.These are:
i)Does the applicant have a legitimate interest in obtaining this personal data?
ii)If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject(s)?
iii)Even if the processing is necessary for the legitimate purposes of the applicant, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s)?This will involve a balancing exercisebetween the legitimate interests of the applicant and those of the data subjects. Only if (or to the extent that) the legitimate interests of the applicant outweigh those of the data subject(s) can the personal data be disclosed.
27.Turning to the first of these questions, Mr X has indicated that he wishes to establish the identity of the informant because he believes that false claims were made against him.He wishes to know the identity of the person concerned with a view to instructing his solicitor.
28.The Commissioner accepts that, as the subject of these claims, who has been affected as a result, Mr X has a legitimate interest in knowing who had provided information to the sheriff officer.
29.The Commissioner also accepts that disclosure is necessary for those ends, and that they could not be pursued without the disclosure of the information under consideration.
30.Turning to the final question, the Council has submitted that disclosure of the information would be prejudicial to the legitimate interests of the individual concerned.The Council stated that the informant (the data subject) was not asked if they would consent to the release of their personal data and that the fact that they did not supply their name to the sheriff officers would indicate that they did not wish their details to be known.
31.The Council went on to state that it felt on balance that, having taken into account the legitimate interests of both sides, that the evidence weighed in favour of the legitimate interests of the informant.
32.Given that disclosure of the address at which the individual talked to the sheriff officers would be likely to lead to the identification of the person concerned, and given that there is a possibility of retaliation from Mr X against the person who informed the Council, the Commissioner is of the view that to disclose the information in this case into the public domain would prejudice the rights and freedoms of the individual in question
33.In balancing the legitimate interests of the individual concerned and those of Mr X, the Commissioner has considered whether the individual would have any expectation of their personal details being put into the public domain as a result providing information to sheriff officers.He has also taken into account the Council's account of the way in which the information was obtained, namely in an informal conversation.He has also noted that, as the individual concerned did not volunteer their name to the sheriff officers during the course of the conversation, it is most unlikely that he or she would have expected Mr X (or any other person) to gain access to their personal information as a result of their imparting the information.
34.The Commissioner has weighed up the legitimate interests of both Mr X and the informant, and in this case, has decided that disclosure of details of the informant would be unwarranted in terms of condition 6 of Schedule 2 to the DPA.
35.The Commissioner has also considered the expectations of the person who gave the information and is satisfied that disclosure of the information would be unfair.Given that the Commissioner is satisfied that none of the conditions in Schedule 2 can be met, and that the processing would be unfair, he is satisfied that the disclosure of the information to Mr X would breach the first data protection principle.Consequently, he is satisfied that the information is exempt in terms of section 38(1)(b) of FOISA.
36.As the Commissioner has found that the information was properly withheld under section 38(1)(b) of FOISA, he is not required to consider the application by the Council of the exemption contained in section 39(1) of FOISA.
DECISION
The Commissioner finds that Dumfries and Galloway Council acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) by refusing to provide the information requested by Mr X.
However, the Commissioner finds that the Council breached the requirements of Part 1 and, in particular, section 17(1) of FOISA, by failing to notify Mr X that it did not hold some of the information sought by his request.
The Commissioner does not require any action to be taken in relation to this breach.
Appeal
Should either Mr X or Dumfries and Galloway Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
05 January 2009
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(?)
(6)This section is subject to sections 2, 9, 12 and 14.
2Effect of exemptions
(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a)the provision does not confer absolute exemption; and
(b)in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(?)
(2)For the purposes of paragraph (a) of subsection (1), the following provisions of Part 2 (andno others) are to be regarded as conferring absolute exemption ?
(e)in subsection (1) of section 38 -
(?)
(ii)paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
(?)
38Personal information
(1)Information is exempt information if it constitutes-
(?)
(b)personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(2)The first condition is-
(a)in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i)any of the data protection principles; or
(?)
(b)in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires -
(?)
"personal data" means data which relate to a living individual who can be identified-
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
(?)
Schedule 1 ? The Data Protection Principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
