Decision 003/2012 Mr Ben Henderson and Perth and Kinross Council Staff conduct Reference No: 201101315 Decision Date: 5 January 2012

Summary

Mr Ben Henderson asked Perth and Kinross Council (the Council) for (a) information relating to the actions and practices of Building Standards staff which resulted in recent disciplinary action, and (b) information on actions or practices of staff in the past which gave reason for suspicion that Council staff, particularly those from the Building Standards and Planning section, may have been involved in similar actions or practices prior to the current case. The Council refused to disclose the information on the basis that it was exempt from disclosure under sections 30(c) (effective conduct of public affairs) and 38(1)(b) (personal data) of the Freedom of Information (Scotland) Act 2002 (FOISA).Following a review, Mr Henderson remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Council had partially failed to deal with Mr Henderson's request for information in accordance with Part 1 of FOISA.

The Commissioner found that by applying the exemption in section 38(1)(b) of FOISA to all of the withheld information, which fell within scope of part (a) of Mr Henderson's request, the Council complied with Part 1.

However, in failing to notify Mr Henderson that it does not (and did not at the time of Mr Henderson's request) hold any relevant recorded information which would address part (b) of his request, the Council failed to comply with Part 1 and in particular section 17(1) of FOISA.Since this decision makes the position clear on this point, the Commissioner did not require the Council to take any action in relation to this breach.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and 2(e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held) and 38(1)(b), 2(a)(i), 2(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles) (the first and second data protection principles) and Schedule 2 (Conditions relevant for the purposes of the first principle: processing of any personal data) (condition 6)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data: recital 26.

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Information Commissioner's Data Protection Technical Guidance Determining what is personal data: http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/personal_data_flowchart_v1_with_preface001.pdf

House of Lords decision: Common Services Agency v Scottish Information Commissioner [2008] UKHL 47: www.publications.parliament.uk/pa/Id200708/Idjudgmt/jd/080709/comm-1.htm

Background

1.Between March and July 2010, the Council carried out an investigation into the conduct of certain staff within its Building Standards Section.This investigation resulted in the preparation of three investigation reports.These reports include interview notes and statements from individuals interviewed as part of each investigation.They also include evidence of areas of concern in the employees' work and conduct, including examples of work undertaken.A final report on the outcome of the investigation is also included for each case.

2.On 16 November 2010, Mr Henderson wrote to the Council requesting the following:

a.Any and all recorded information relating to the actions and practices of the staff which resulted in the recent disciplinary action.

b.Any and all recorded information relating to the actions and practices of staff in the past, which indicated or gave reason for suspicion, that Council staff, in particular Building Standards and Planning personnel, may have been involved in similar actions or practices prior to the recent case.

3.Mr Henderson indicated that personal information was not being sought by this request, and that he had no interest in the identities of any individual person.He indicated that the redaction of information which might lead to the identification of Council employees or any other individual was therefore acceptable to him.

4.The Council responded on the same day. It refused to supply the information on the grounds that it was exempt from disclosure under sections 30(c) and 38(1)(b).It stated that the information was personal data as defined in the DPA and its disclosure would breach the first and second data protection principles.It also argued that its disclosure would detrimentally affect the Council's ability to undertake similar investigations in the future.

5.On 16 December 2010, Mr Henderson wrote to the Council, requesting a review of its decision. Mr Henderson argued that documents could have been redacted to prevent the identification of individuals or the disclosure of investigative methods and procedures employed by the Council.Alternatively, Mr Henderson indicated that the preparation of a summary or digest of the requested information rather than release of the actual documents would probably also be appropriate and acceptable.Mr Henderson also commented that this is a matter of public interest and the rejection of the request for information does not promote confidence in the transparency, openness or accountability of local government.

6.The Council notified Mr Henderson of the outcome of its review on 17 January 2011.It upheld its original decision without amendment.The Council indicated that it had given thought to the possibility of redacting the information to anonymise it (so it would no longer be personal data), but commented that it believed that it was unlikely to be able to redact the information to adequately anonymise it without rendering the result meaningless.

7.On 14 July 2011, Mr Henderson wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying for a decision in terms of section 47(1) of FOISA. In his application, Mr Henderson expressed dissatisfaction with the Council's responses to his request and requirement for review and also commented that the Council had failed to address part (b) of his request for information.

8.The application was validated by establishing that Mr Henderson had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.

Investigation

9.On 27 July 2011, contact was made with the Council, during which time the Council confirmed that the information being withheld from Mr Henderson was the same as the information that had been withheld in relation to an information request from Mr Alan Richardson which led to Decision 112/2011 Mr Alan Richardson and Perth and Kinross Council.The Council also confirmed, and evidenced to the Commissioner, that it had provided Mr Henderson with the information that it was required to provide to Mr Richardson as a consequence of the Commissioner's decision. This was provided to Mr Henderson on 22 July 2011.

10.On 16 August 2011, the Council was notified in writing that an application had been received from Mr Henderson and was given the opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asked to respond to specific questions. In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.

11.The Council was also asked to explain why (it appeared) it had not provided a response to part (b) of Mr Henderson's information request, and to provide a submission advising whether it holds information in relation to this part of Mr Henderson's request.

12.The Council responded on 5 September 2011, and advised that it considered all of the information falling within scope of part (a) of Mr Henderson's request to be exempt under sections 30(c) and 38(1)(b) of FOISA.The Council provided an explanation of its reasoning in support of this view, and also explained that it was relying on the arguments it advanced in support of its position in Mr Richardson's case for applying the exemptions in sections 30(c) and 38(1)(b) of FOISA in this case.

13.With regard to part (b) of Mr Henderson's request, the Council explained that, during the review process, confirmation had been received that no relevant information was held which would address this part of the request.The Council acknowledged that this was omitted from its response to Mr Henderson and so it had failed to provide him with a notice that the requested information was not held, as required by section 17 of FOISA.

14.Further, more detailed submissions were requested and obtained from the Council during the course of the investigation as to the nature of the searches that it had carried out to determine whether information relevant to part (b) of Mr Henderson's request was actually held.

15.Mr Henderson was also invited to comment on the matters raised by this case, in particular in relation to accessing the withheld information insofar as it was personal data, and the application of the exemption in section 30(c) of FOISA. Unfortunately, Mr Henderson was not in a position to provide these comments and so the Commissioner has taken account of the matters raised by Mr Henderson in his earlier correspondence which the Commissioner.He has also had regard more generally to the matters surrounding the actions of the Council's staff, which the Commissioner understands to have given rise to Mr Henderson's interest in the information he requested, and his wider concerns.

Commissioner's analysis and findings

16.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Henderson and the Council and is satisfied that no matter of relevance has been overlooked.

Part (b) ?actions and practices of staff in the past

17.The Commissioner first considered the second part of Mr Henderson's request.This sought any and all recorded information relating to the actions and practices of staff in the past (the Commissioner understands this to mean prior to the actions that were the subject of recent investigations), which indicated, or gave reason for suspicion, that the Council staff, in particular Building Standards and Planning personnel, may have been involved in similar actions or practices prior to the recent case.

18.The Council's responses to Mr Henderson's request and subsequent request for review both suggested that it was withholding all of the requested information from him as it considered it to be exempt under sections 30(c) and 38(1)(b) of FOISA.In doing so, however, it did not make clear whether this response covered information falling within part (b) of the request.In his application to the Commissioner, Mr Henderson indicated that the Council had failed to address part (b) of his request.

19.In its submissions, the Council explained that, during the review process, information had been received from relevant staff members which indicated that no relevant recorded information which would address part (b) of Mr Henderson's request was held.As noted above, the Council acknowledged that it had omitted to provide Mr Henderson with a relevant notice in terms of section 17 of FOISA which explained this.

20.Section 1(1) creates a general right of access to recorded information held by a public authority.

21.In terms of section 1(4) of FOISA, the information to be provided in response to a request made under section 1(1) is, subject to limited provisions which are not relevant here, that held at the time the request is received.

22.Section 17(1) of FOISA provides that where a Scottish public authority receives a request for information but it does not hold that information, it must give the applicant notice in writing that it does not hold it.

23.In assessing whether the Council is correct in arguing that no relevant recorded information was held by it falling within scope of part (b) of Mr Henderson's request, the Commissioner must consider what was held at the date it received Mr Henderson's request.

24.During the course of the investigation, the Council was asked to detail the searches it had carried out to determine whether relevant information was held which would address this part of Mr Henderson's request.

25.The Council provided submissions outlining the searches that it carried out to determine whether any relevant information was held. This included details of the personnel who were contacted to ascertain if they held any relevant information, together with details of the retention policy that the Council has in place for records of this kind.

26.Searches were also carried out by the Council of all personnel records which it holds relating to staff employed within the Building Standards and Planning sections.The Council advised that none of these searches identified any relevant recorded information falling within scope of part (b) of Mr Henderson's request.

27.Having considered the submissions from the Council, the Commissioner accepts that the searches carried out by the Council to determine whether any relevant recorded information falling within scope of part (b) of Mr Henderson's request were adequate.

28.As a consequence, the Commissioner accepts that the Council does not (and did not at the time of Mr Henderson's request and request for review) hold any information that would address part (b) of his request for information.

29.Having reached this conclusion, but noting that the Council did not make this clear to Mr Henderson when responding to his request, the Commissioner finds that the Council failed to comply with Part 1 and section 17(1) of FOISA in failing to notify Mr Henderson that it did not hold that information.

30.Since his decision has made the position on this point clear, the Commissioner does not require the Council to take any action in relation to this breach.

Part (a) - actions and practices of staff which resulted in the recent disciplinary action

31.The Commissioner next considered the first part of Mr Henderson's request.This sought any and all recorded information relating to the actions and practices of the staff which resulted in the recent disciplinary action.

32.The Council identified that information as the content of the investigations files described in paragraph 1 above.This information was considered by the Commissioner previously in Decision 112/2011 Mr Alan Richardson and Perth and Kinross Council.As noted above, the Council disclosed a small number of items to Mr Henderson following the issue of Decision 112/2011, in line with the Commissioner's findings therein.These items will not be considered any further in this decision.The remaining information was withheld on the grounds that it was exempt from disclosure under sections 38(1)(b) and 30(c) of FOISA.

Section 38(1)(b) ? Personal information

33.The Council has applied the exemption in section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i), to all of the withheld information coming within scope of part (a) of Mr Henderson's request.

34.Section 38(1)(b) (read with section 38(2)(a)(i) or, as appropriate, section 38(2)(b)) of FOISA exempts information from disclosure if it is "personal data" as defined in section 1(1) of the DPA and its disclosure would contravene any of the data protection principles contained in Schedule 1 to the Data Protection Act 1998 (the DPA).This particular exemption is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.

35.In order to rely on this exemption, therefore, the Council must show firstly that the information being withheld is personal data for the purposes of the DPA, and secondly that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.

36.The Council has submitted that all of the information withheld from Mr Henderson is personal data, disclosure of which would contravene the first and second data protection principles.

37.In considering the application of the exemption, the Commissioner will therefore first consider whether the information that has been withheld is personal data as defined in section 1(1) of the DPA.

Is the information personal data?

38.Section 1(1) of the DPA defines personal data as data which relate to a living individual who can be identified (a) from those data or (b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

39.The information under consideration is almost the entire content of three files relating to disciplinary investigations and processes.The Council noted that each of these files refers to the employee by their name and the content was gathered as part of the investigation of the allegations against the individual and to facilitate a disciplinary hearing for that individual.

40.The Council recognised that the files contain information that is not ostensibly personal data, including copies of plans and copies of other non-personal documents, but explained that this information was also considered to be personal data in the context of the file as a whole, since that information related in some way to either the employee or to the allegations about them.

41.The Commissioner has considered these points, and accepts that all of the information contained within the three investigations files which is under consideration in this case comprises personal data.The contents in general relate to one or more living individuals, primarily the employees who were the subject of the investigations, but also to third parties who gave statements or provided information in the course of the investigations, and individuals otherwise involved in the investigations or the events under investigation.The individuals concerned can be identified from that information.

42.The Commissioner has accepted that, in the context of the relevant investigations, information relating to certain planning/building control applications is also the personal data of the individuals under investigation, since, in the context of the investigations about the conduct of staff concerned, this information relates to those individuals.

Could the withheld information be made fully anonymous?

43.In the case of Common Services Agency v Scottish Information Commissioner[1] (the Collie judgement), the House of Lords considered a request for information relating to childhood leukaemia statistics in the Dumfries and Galloway postal area.

44.In that case, the Lords concluded that the definition of "personal data" in the DPA had to be taken to permit the disclosure of information which had been rendered fully anonymous in such a way that individuals were no longer identifiable from it, without having to apply the data protection principles.If individuals cannot be identified from the actual information requested, then this information is not personal data and cannot, therefore, be exempt under section 38(1)(b) of FOISA.

45.The Commissioner has considered whether such anonymisation would be possible in this case, since Mr Henderson suggested in his request and in subsequent communications with both the Council and the Commissioner that the withheld documents could have been redacted to prevent identification of those concerned.He also suggested that the Council could have provided him with a summary or digest of the requested information, as he did not expect to receive any personal information.Mr Henderson indicated that he found it inconceivable that the Council could not provide such information without breaching data protection principles.

46.In responding to Mr Henderson's request for review, the Council explained, that whilst extensive redaction could be undertaken to anonymise the information, the resulting information would be meaningless and, whilst satisfying the letter of the law, would be contrary to the spirit of FOISA.

47.The Council did not address Mr Henderson's point regarding the provision of a summary of information in its response to his request for review, but did when asked to comment on it during the investigation.It explained that it did not consider that it would be possible to prepare a meaningful summary that would not provide identifiable personal data when used in conjunction with other information which was either in the possession of the Council or known to colleagues.

48.The Council submitted that it was unable to assess the degree to which other people could identify the individuals to whom the personal data relates, but it was aware of the possibility of colleagues, relatives and some of the individuals interviewed being able to establish the identity of one or more of the employees.The Council also considered that, as each of the employees whose conduct was investigated have copies of their relevant file and correspondence, it was likely that they could also identify their own redacted information.The Council also considered it likely that each of the employees could identify information about each other.

49.The Commissioner has considered all of the comments made by Mr Henderson (both to the Council and to him) with respect to the possibility of redaction.

50.In considering questions of identifiability, the Commissioner must also bear in mind the reference in recital 26 to the EU Directive 95/46/EC (reproduced in the Appendix below) to "all the means reasonably to be used either by the controller or by any other person to identify the said person", which is the subject of further discussion in the Information Commissioner's Data Protection Technical Guidance Determining what is personal data.In this context, the Commissioner notes that, even if the names of those interviewed and their responses to questions, together with the personal data on the building warrant and planning application information, were redacted there would still be sufficient information available which would allow the data subjects to be identified.

51.The Commissioner has also considered whether it would be possible for the Council to provide Mr Henderson with a summary or digest of the withheld information in such a way that would not lead to the individuals being identified. In his correspondence with the Commissioner, Mr Henderson provided examples of the way in which he considered the information could be summarised without leading to the identification of individuals. The Commissioner has considered the examples given by Mr Henderson and other permutations that could be used as a method of presenting the withheld information in a summarised form.However, he has been unable to identify a method which would enable meaningful information to be provided, which would not allow the identification of one or more of the individuals whose personal data is included in the withheld information.As a consequence the Commissioner is not persuaded that it would be possible for the Council to provide a meaningful summary or digest of the information sought by Mr Henderson which would not lead to the identification of individuals.

52.Having considered the information that has been withheld in this case, and having considered all relevant submissions and other materials, the Commissioner accepts that the withheld information does constitute personal data for the purposes of section 1(1) of the DPA, and that it is not possible in the circumstances to fully anonymise that personal data by redacting certain information.This would, in the Commissioner's opinion, require the redaction of the information to the extent that what remained would not in any sense be meaningful.

53.Having reached this conclusion, the Commissioner must now go on to consider whether disclosure of the personal data would contravene any of the data protection principles cited by the Council.In doing so, the Commissioner has taken into consideration the guidance [2] issued by the Information Commissioner which indicates for the purposes of disclosure under the Freedom of Information Act 2000, it is only the first principle ? that data should be processed fairly and lawfully ? that is likely to be relevant.Given that this point is relevant also to the consideration of whether personal data is exempt under FOISA, the Commissioner will first consider the Council's submissions relating to the first data protection principle before going on to consider, if necessary, submissions relating to any of the other data protection principle..

Would disclosure contravene the first data protection principle?

54.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure of the personal data into the public domain in response to Mr Henderson's information request.

55.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

56.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If he considers that there is a condition in Schedule 2 which would permit the data to be disclosed, he will then go on to consider whether that information comprises sensitive personal data for the purposes of section 2 of the DPA and, if so, whether there are any conditions in Schedule 3 to the DPA which would allow the data to be processed.

57.Where a Schedule 2 condition (and if necessary a schedule 3 condition) can be met he will then go on to consider whether the disclosure of the personal data would otherwise be fair and lawful.

Can any Schedule 2 condition be met?

58.In its submissions, the Council indicated that it had considered the conditions in Schedule 2 of the DPA, but that it was unable to identify a condition that would be satisfied in order to make the processing lawful.

59.The Council was asked by the investigating officer whether the data subjects have been asked to consent to the information being disclosed.In response, the Council explained that the individual data subjects had not been asked for consent (as required to fulfil condition 1 in Schedule 2) and, given the confidentiality associated with the disciplinary process, the Council considered that it was unreasonable in the circumstances to seek consent.

60.The Commissioner has therefore determined that condition 1 cannot be met in the circumstances of this case.

61.Condition 6 would appear to be the only condition which might permit disclosure to Mr Henderson in the circumstances of this case.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. the individuals to whom the data relate).

62.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met.These are:

Does Mr Henderson have a legitimate interest in obtaining the personal data?

If yes, is the disclosure necessary to achieve these legitimate interests?In other words, is the disclosure proportionate as a means and fairly balanced to its ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?

Even if the processing is necessary for Mr Henderson's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

63.There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Henderson must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Henderson.

Does Mr Henderson have a legitimate interest?

64.In his correspondence with the Council and the Commissioner, Mr Henderson contended that the Council's refusal of his and others requests for information which would permit the public a clear picture of the nature of the misconduct of the officials, raise public awareness of such issues for the future, and enhance the potential early detection and reporting of such practices by members of the public, serves only to reinforce the perception of a Council "whitewash", to undermine public belief in the integrity and transparency of local government, contrary to the public interest.

65.It is Mr Henderson's view that the disclosure of the information sought is necessary to fulfil the general public interest in determining whether or not misconduct by public sector employees constituted criminal activity, the incidence and duration of this misconduct, the period over which the Council has had knowledge or grounds for suspicion that such acts of misconduct were taking place, and whether the Council has been negligent in permitting the occurrence of these practices or culpable in allowing their continuance.

66.Mr Henderson also commented that the matter which is the subject of his request is a matter of public interest and the rejection of his request for information does not promote confidence in the transparency, openness or accountability of local government.

67.The Commissioner considers that there is a general legitimate interest in understanding the nature of the behaviour or actions taken by staff which have led to investigations of the kind undertaken in this case being carried out.The Commissioner accepts that this is particularly the case where these actions have been taken by frontline staff whom the public are expected to interact with and trust on a daily basis.

68.Such knowledge would also, the Commissioner accepts, enable the public to be more aware of areas of concern should they arise in future, and could facilitate the early detection of matters which may be detrimental to the Council and the public as a whole.

69.Release of the withheld information would, the Commissioner accepts, also allow Mr Henderson and the general public to understand whether relevant actions have been taken by the Council in a timeous manner to address the actions and behaviour of the staff concerned.

70.Furthermore, the Commissioner agrees that disclosure of the withheld information would also go some way to satisfying the public interest in ensuring that public authorities which receive and spend public money are both transparent and accountable, and where issues arise the Council is able to take relevant action to address these in a manner which encourages the public to have confidence in them.

71.Having considered all the comments from the Council and Mr Henderson, the Commissioner has concluded that Mr Henderson does have a legitimate interest in obtaining the information.

Is disclosure of the information necessary to achieve those legitimate interests?

72.The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so he must consider whether these interests might reasonably be met by any alternative means.

73.The Council has explained that it does not consider that disclosure of the withheld information is necessary for the purposes of condition 6 in Schedule 2 to the DPA.It submitted that each of the employees investigated were provided with complete copies of the investigation files into their case, and so it was possible that the information could be obtained from them and consequently it was not "necessary" for the Council to provide it.

74.The Commissioner has considered this point, but does not accept that this represents an alternative route to Mr Henderson to access the information.Although the Commissioner is aware that there has been coverage in the local press about the matter that gave rise to the investigation of the particular employees' conduct, these individuals were not identified and so the Commissioner does not accept that Mr Henderson would know who they are or how to contact them.Even if it were the case that Mr Henderson did know the identity of the employees and how to contact them, there is no evidence to suggest that the individuals concerned would provide this information to him.They would certainly be under no obligation to share the information available to them with any other person.The Commissioner therefore cannot accept that Mr Henderson's legitimate interests would be fulfilled by approaching the individual employees to obtain the withheld information.

75.In this case, the Commissioner can identify no viable means of meeting Mr Henderson's legitimate interest in understanding the nature of the behaviour of the staff under investigation which would interfere less with the privacy of the data subjects other than by obtaining the information requested.Therefore, he is satisfied that disclosure of the information is necessary for the purposes of the legitimate interests identified by Mr Henderson.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

76.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects.As noted above, this involves a balancing exercise between the legitimate interests of Mr Henderson and those of the data subjects.Only if the legitimate interests of Mr Henderson outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

77.In considering the legitimate interests of the data subjects, the Commissioner must consider the legitimate interests of a range of individuals whose personal data is contained in the withheld information.This is principally the employees who were the subject of the investigations, but also includes individuals who were interviewed or gave statements as part of the investigations and individuals who were otherwise involved in the investigations or the events under investigation.

78.The Council has submitted that the data subjects have no expectation or understanding that this personal data will be released to the public.

79.It explained that its disciplinary process is conducted in confidence.Those persons interviewed as part of the process were asked if they consented to the disclosure of their statement for the purpose of a subject access request under the DPA, and were advised that a copy of their statement would be issued to the subject of the investigation if a disciplinary hearing was called.

80.The Commissioner has seen the text that was used to obtain witnesses' consent to disclosure and recognises that any consent given was limited to disclosure in terms of the DPA (i.e. to another data subject).Such consent (if given) would not extend to the public disclosure in response to a request under FOISA.

81.The Council has also noted that the withheld information relates primarily to the employees whose conduct was investigated as part of the Council's internal disciplinary procedures, and internal discipline is considered to be a private matter between the employer and the employee.

82.The Council submitted that it considers that disclosure of the information would represent a breach of the rights contained in Article 8 of the European Convention on Human Rights, which provides for the right to respect for private and family life.

83.As mentioned previously, the Council did not approach the data subjects to seek their consent to disclose the information in response to a FOISA request.The Council considered that, given the confidentiality associated with the disciplinary process, it was unreasonable in the circumstances to do so.

84.While acknowledging that the passage of time since the completion of the investigation is relevant when considering whether there has been a reduction in the prejudice to the rights and freedoms of the data subjects, the Council is of the view that it is likely to be in excess of five years before sufficient time will have passed for this matter to reduce in importance sufficiently to allow any of the withheld information to be released.

85.Turning first to the legitimate interests of the staff whose conduct was under investigation, the Commissioner recognises that disciplinary proceedings are internal processes between employer and employee and any investigation or hearing would normally be conducted in private.This would be the case whatever the outcome of that process.

86.The Commissioner acknowledges that it would not be within the reasonable expectation of the employees that the information forming the report following the investigation of their conduct would be made available to anyone other than themselves, their representatives and those persons conducting the disciplinary hearing.The Commissioner also recognises that the employees would expect that this information, to the extent that it is personal data, would be kept confidential in the event that it may be subject to any further proceedings raised by either themselves or by the Council.Indeed the Commissioner considers that the staff concerned would have a strong expectation that the disciplinary process, and the information gathered as part of that, would remain private.

87.The Commissioner considers that disclosure of the personal data would cause a significant intrusion into the privacy of these staff, revealing details of the allegations made against them and the evidence gathered by the Council in relation to these, and the conclusions reached by the Council.

88.In all the circumstances, having considered the Council's arguments, and having weighed Mr Henderson's legitimate interests against the legitimate interests, rights and freedoms of the staff who were under investigation, the Commissioner has concluded that the legitimate interests of those staff outweigh those of Mr Henderson.As a result, he has determined that disclosure would be unwarranted in this case.

89.The Commissioner has also carried out a similar balancing exercise in relation to the information insofar as it is personal data of other third parties.Given the general expectations of confidentiality associated with the disciplinary process, the Commissioner recognises that the individuals who were interviewed or who provided information within the disciplinary process would expect that the information they provided would be taken into account in the disciplinary process, but they would not expect that information to be disclosed into the public domain as part of a response to a FOISA request.

90.The Commissioner also considers that those individuals whose personal data is present as a result of their indirect connection to the matters under investigation (for example, whose planning and/or building warrant applications, maps and plans form part of the investigation file) would not expect this information to be released into the public domain in response to a FOISA request seeking information relating to investigations into a Council employee's conduct.He notes that the context of such disclosure would be different from the routine publication of information relating to the planning and building warrant process.While the individuals concerned could only reasonably expect disclosure of their planning applications in that routine process, disclosure in response to Mr Henderson's information request would be different, and unexpected, since it would reveal which applications had been considered or found to be pertinent to the investigations of employee conduct.

91.Having balanced Mr Henderson's legitimate interests against the rights, freedoms or legitimate interests of these other data subjects, the Commissioner has again found that the legitimate interests served by release of the investigation reports to Mr Henderson would not outweigh the prejudice that would be caused to the rights, freedoms or legitimate interests of the data subjects, and so the disclosure would be unwarranted.

92.The Commissioner has also considered the name which has been redacted from two of the documents which were released to Mr Henderson in redacted form, and finds that the named recipient to the email communications is a junior member of staff who would not expect their identity to be disclosed in response to an FOI request.As such, the Commissioner has again found that the legitimate interests served by release of this information to Mr Henderson would not outweigh the prejudice that would be caused to the rights, freedoms or legitimate interests of that data subject, and so disclosure of their name would be unwarranted.

93.The Commissioner has also taken into account the time that has passed since the investigations were completed in July 2010 and the date on which the Council notified Mr Henderson of the outcome of its review of his request (17 January 2011).Having done this, the Commissioner accepts the submission of the Council that insufficient time has passed to reduce the unwarranted prejudice that would be caused to the rights, freedoms or legitimate interests of all of the data subjects if the withheld information were to be disclosed.

94.Having drawn these conclusions, the Commissioner has concluded that condition 6 in Schedule 2 (to the DPA) is not met in this case in relation to all of the personal data that has been withheld in this case.

95.Having accepted that disclosure of all of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects as described above, the Commissioner also concludes, for the same reasons, that disclosure of the majority of the withheld information would be unfair.

96.As disclosure of the withheld personal information would be unfair and no schedule 2 condition can be met, that personal data cannot be disclosed without contravening the first data protection principle.Consequently, disclosure would also be unlawful.The Commissioner therefore concludes that disclosure of the withheld personal data would breach the first data protection principle, and so this information was properly withheld on the grounds of the exemption in section 38(1)(b).He will not, therefore, go on to consider whether disclosure would also breach the second data protection principle.

97.The Commissioner has therefore concluded that the Council acted correctly in withholding the requested information from Mr Henderson as it is exempt from disclosure under section 38(1)(b) of FOISA.

98.As the Commissioner is satisfied that the Council acted correctly in relying on section 38(1)(b) of FOISA for withholding all of the requested information coming within scope of part (a) of Mr Henderson's request, he is not required to consider the Council's application of the exemption in section 30(c) of FOISA.

DECISION

The Commissioner finds that Perth and Kinross Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Henderson.

The Commissioner finds that the Council was entitled to withhold the information falling within part (a) of Mr Henderson's request under section 38(1)(b) of FOISA.

However, in failing to notify Mr Henderson that it does not (and did not at the time of his request) hold any relevant recorded information which would address part (b) of his request, the Commissioner finds that the Council failed to comply with Part 1 and in particular section 17(1) of FOISA.

As the Commissioner is satisfied that the narrative within this decision makes clear that the Council does not hold such information, he does not require the Council to take any action in relation to this breach.

Appeal

Should either Mr Henderson or the Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
5 January 2012

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2.Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

Directive 95/46/EC of the European Parliament and the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

Recital 26 Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable?.

---

[1] [2008] UKHL 47: http://www.publications.parliament.uk/pa/Id200708/idjudgmt/jd080709/comm-1.htm

[2]http://www.ico.gov.uk/~/media/documents/library/Freedom_of_Information/Detailed_specialist_guides/PERSONAL_INFORMATION.ashx