Decision 005/2021: Register of Interests for elected members

Public authority: North Lanarkshire Council
Case Ref: 201900981

Summary

The Council was asked for information in the hard copy Register of Interests for all elected members.

The Council responded in terms of section 25 of FOISA for the majority of the information, which it claimed was publicly available on its website. It withheld the remaining information as personal information, disclosure of which would breach the data protection principles. The Council also withheld some of the information because it believed it would likely endanger the health and safety of individuals.

The Commissioner investigated and found that the Council had partially breached FOISA in responding to the request. While he was satisfied that some information had been properly withheld as personal data, he found that the remainder had been wrongly withheld. He also found the Council failed in its duty to provide advice and assistance.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1), (2)(a) and (2)(e)(ii) (Effect of exemptions); 15 (Duty to provide advice and assistance); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information); 39(1) (Health, safety and the environment)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of "personal data") (Definitions); 5(1)(a) and (c) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3)(a), (4)(d) and (10) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 18 April 2019, the Applicant made the following request for information to North Lanarkshire Council (the Council):

I wish to see the hard copy register of interests for all elected members within North Lanarkshire Council. Since your Local Authority currently does not make their property interests known to the council tax payer via your website. If you intend to use an exemption under the Freedom of Information Scotland Act, can you let me know?

2. The Council responded on 26 April 2019, stating it did not regard Freedom of Information legislation as being applicable to the request, so there was no question of an exemption being applied. The Council referred to paragraph 26 of the Standards Commission Guidance for Councillors and Local Authorities in Scotland, annexed to the Councillors' Code of Conduct (see paragraph 31, footnote 5), stating this provides that the electronic version of the Register need not include personal address information that would compromise councillors' personal security. As such, the Council explained, a significant number of elected members had indicated that, in the event that sight of the paper copy was requested by any individual, they would wish to be informed. The Council asked the Applicant if he had any objection to it advising councillors of his request in order to ascertain whether they had any particular concerns in this regard.

3. The Applicant replied that same day, contending that he did regard his request as an information request, and that the Council was referring to guidance, not legislation. He further confirmed that he did object to the Council's proposal to inform councillors of his request.

4. On 17 May 2019, the Council wrote to the Applicant, asking him to clarify more specifically what information he wished to access. The Council asked, in particular, if it was just the property interest information in the Register he wished to receive, or if he wished the home addresses of all elected members to be included.

5. The Applicant responded that same day, commenting, for clarification purposes, "… does it not contain within the hard copy of each elected member Register of Interests, does it not include their property interests?" He reiterated his request was for the "hard copy of all elected members' Register of Interests and no redactions".

6. On 30 May 2019, the Applicant wrote to the Council, requesting a review as he believed it was now in breach of Freedom of Information legislation, given that his request was made formally on 18 April 2019.

7. The Council replied on 31 May 2019, stating that, as clarification of the request was sought and received on 17 May 2019, it calculated the statutory deadline for responding to be 17 June 2019, taking account of public holidays.

8. On 13 June 2019, the Council issued a response. It informed the Applicant that the majority of the information held in the hard copy Register of Interests was reproduced in an online version of the Register, which was publicly available on its website via the Councillors Information System (CoInS). The Council provided the relevant weblink and explained how to find a particular member's Register of Interests. The Council withheld this information under section 25 (Information otherwise accessible) of FOISA, which provides exemption for information which is already reasonably obtainable by the Applicant.

9. The Council explained that, while the hard copy Register contained all relevant property addresses in the "Houses, Land and Buildings" section, some councillors had elected not to provide this information in the online version. The Council considered the address information, for councillors who had opted not to disclose it online, to be their personal data, disclosure of which would contravene the data protection principles. The Council withheld this information under section 38(1)(b) (Personal information) of FOISA.

10. The information included the home addresses of some elected members, which the Council also withheld under section 39(1) (Health, safety and the environment) of FOISA. It claimed that disclosure would likely endanger an individual's health and safety, and that on balance the public interest lay in protecting this.

11. On 13 June 2019, the Applicant wrote to the Council, stating he wished to appeal its decision.

12. The Council responded on 11 July 2019, fully upholding its original decision with further explanation. For the personal data withheld under section 38(1)(b), the Council identified no lawful basis for processing this data beyond that statutorily mandated in the Ethical Standards in Public Life etc. (Scotland) Act 2000[1], namely recording in the hard copy Register of Interests.

13. For the information also withheld under section 39(1), the Council argued that, due to recent incidents of criminality and violence towards individual elected members in other local authority areas and other elected officials, some at their private residences, disclosure of home address information would present a real risk to elected members. The Council claimed the requirement to make public each elected member's principal residence did not extend beyond recording it in the hard copy Register of Interests, and disclosure would not further the public interest in transparency with regard to these individuals' private affairs.

14. On 8 July 2019, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the Council's decision to withhold information under the exemptions cited, as he did not agree these exemptions applied:

• For the personal information withheld under section 38(1)(b), he believed there was a public interest in disclosure of this information, given that the personal data had previously been published online in a polling notice. He argued that those standing for election as a councillor have their names and addresses published at the time of the election, yet following election the information leaves the public domain. In his view, this information, including addresses, should be published in the online Register of Interests.
• For the home addresses also withheld under section 39(1), he argued that there was no established link of endangerment to his information request, as claimed by the Council.
• For the information withheld under section 25, he queried whether the hard copy Register of Interests was different from the online version, believing information had been withheld.

Investigation

15. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

16. On 10 July 2019, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant.

17. On 12 July 2019, the Council wrote to the Commissioner's office, disagreeing that the application was valid as, at that point, the Council did not consider it had issued its review outcome. In the Council's view, the Applicant's email of 30 May 2019 was not a valid request for review, given that the Council had sought, and received, clarification of the request on 17 May 2019 (which it believed altered the response deadline to 17 June 2019). The Council explained it had responded to the request on 13 June 2019, and the Applicant had thereafter requested a review, the outcome of which had been issued to the Applicant on 11 July 2019.

18. On 26 July 2019, having further reviewed the application and supporting documentation, the Commissioner confirmed to the Council that he deemed the application to be valid. In the Commissioner's view, the Applicant's "clarification" of 17 May 2019 was a reiteration of the original request and, effectively, a rejection of the Council's request for clarification. Given that the Council had dealt with the request as originally stated, the Commissioner did not support the Council's view that "clarification" had been obtained (or, indeed, was required). The Council was informed that the Applicant's email of 30 May 2019 was considered to be a valid request for review, and that the Commissioner's investigation would proceed as previously advised.

19. On 1 August 2019, the Council provided the withheld information and the case was allocated to an investigating officer.

20. In relation to the Applicant's concerns that the online version of the Register did not match the hard copy, the investigating officer compared both versions in detail. Having done so, the investigating officer identified no evidence that the Council held any further information to that published, other than where it stated (in the online version) that the Council held further details (the information withheld by the Council under sections 38(1)(b) and 39(1) of FOISA).

21. On 24 October 2019, the Applicant was advised of, and accepted, the investigating officer's findings on this matter, and withdrew this part of his application.

22. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. These focused on the Council's justification for withholding information under the exemptions in sections 38(1)(b) and 39(1) of FOISA, including consideration of the public interest. The Council was also invited to comment on its decision to withhold some information from public access, with regard to guidance issued by the Standards Commission on making such information publicly available. It was also asked to comment on aspects of its handling of the request.

23. The Applicant was also invited to comment on his legitimate interest in accessing the personal data withheld under section 38(1)(b), and on the public interest in disclosure of the information withheld under section 39(1).

24. Both parties provided submissions to the Commissioner.

Commissioner's analysis and findings

25. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

Standards Commission Guidance / Councillors' Code of Conduct / Legislation

26. The Council was referred to the Standards Commission Guidance on the Councillors' Code of Conduct - Register of Interests (page 59, paragraph 26) which states that, while the electronic version of the Register of Interests need not include personal address information, councils are required to make available the full version of the Register of Interests for public inspection. In this regard, the Council was asked to:

(i) confirm its policy with regard to public access to inspect the full Register of Interests,

(ii) explain what guidance it gave to allow members of the public to understand where the full Register of Interests is held, and their rights to inspect it, and

(iii) explain why it considered the full Register could not be released in full in response to an information request under FOISA, given that, in line with Standards Commission guidance, the full version ought to be publicly accessible to any member of the public wishing to inspect it, regardless of who they are or their reasons for so doing.

27. In response, the Council confirmed there was no Council policy or guidance specifically addressing points (i) and (ii) above. It explained the online Register was published on its website[2], and a hard copy of the Register was also retained at Council Headquarters for public viewing. It submitted that, on the basis that a number of elected members did not wish their addresses to be made public, in light of concerns (both locally and nationally) as to the safety and security of elected members, it did not consider it unreasonable to enquire as to the purpose of a request for that information.

28. The Council confirmed its position was that the full Register, containing details such as property addresses, does not need to be fully accessible by the public. It provided the Commissioner with a copy of correspondence with the Standards Commission for Scotland in May 2019, in which the Commission stated:

There is no statutory requirement for the full Register of Interests to be published on the Council's website. The Ethical Standards in Public Life etc. (Scotland) Act 2000 (Register of Interests) Regulations 2003 provide that a proper officer shall keep the Register of Interests open to public inspection at an office of the applicable Council at all reasonable hours and without charge. It does not state, however, that all information on the Register must be disclosed. It may be the case that, for reasons of personal security, a Council or councillor does not wish their exact address to be disclosed.

29. The Council confirmed that the online Register does not replicate the full Register, which contains the property details. It explained that the full Register was accessed by the Head of Legal and Democratic Solutions, and staff in Member Services (a division of the Council).

30. The Council further confirmed that a member of the public, seeking to inspect the hard copy full Register, would not be given full access: address information of councillors who did not wish this information disclosed would not be made available.

31. The Council's attention was drawn to the following Regulations and Standards Commission guidance, which appeared to set out that while the published (electronic) version of the Register did not have to be as detailed, the full Register had to be made available for public inspection, and must state the councillors' interests in any registrable property (along with the corresponding address or identifying description):

• The Ethical Standards in Public Life etc. (Scotland) Act 2000 (Register of Interests) Regulations 2003[3] (the 2003 Regulations) require an authority to make the Register of Interests open to public inspection at all reasonable hours and without charge (regulation 7).
• In respect of houses, land and buildings, councillors are required to provide a description of any rights of ownership or other interests that may have bearing (etc.) on the work of the authority. The Scottish Government Code of conduct for councillors[4] ("the Councillor's Code of Conduct") defines the registrable interest for houses, land and buildings as one where an elected member owns, or has any other right or interest in, houses, land or buildings, such as being an owner or a tenant, including council tenant (paragraph 4.19). Councillors are required to give the address of the property, or a description sufficient to identify it (paragraph 4.20).
• The Standards Commission Guidance on the Councillors' Code of Conduct[5] sets out, in paragraph 26 on page 59, that:
• the principal Register should be kept at Councils' head offices, with an electronic version published online
• the information should also be available at other main Council offices and public libraries
• any members of the public inspecting such information should be entitled to receive a printed copy of the information on request
• the electronic version need not include personal address information that would compromise personal security, the full version being available for public inspection.
• The Standards Commission Guidance "Councillors' Code of Conduct - Guidance"[6] sets out that, in terms of paragraph 4.20 (of the Councillors' Code of Conduct), councillors are required to provide the full address of houses, land and buildings, or sufficient information to allow them to be identified (paragraph 49 on page 14). This is for the purpose of the official register and the published version does not require to be as detailed.

32. In light of the above, the Council was asked to fully explain the legal justification for not making any part of the full Register available for public inspection.

33. In response, the Council submitted it held a public register in accordance with the requirements of regulation 7 of the 2003 Regulations. It reiterated that the full Register was available for public inspection at its head office: councillors' interests in the property, along with the corresponding addresses, were set out in the Register.

34. The Council went on to argue, however, that it had a duty to protect its elected members. In the current climate of threats and attacks on elected members, it had taken the view that inspection of the public Register was subject to vetting of the individual making the request, and knowing their reason for requiring access to the property address information. In the absence of such an explanation, and (in this case, in particular) the Applicant's refusal to share his identity with the councillors, the Council was unable to assess the risk of potential threat to an individual elected member, and so the request was not met.

35. Referring to the correspondence from the Standards Commission (referred to in paragraph 28 above), the Council argued that it could seek councillors' views prior to disclosure of their property addresses, to allow the assessment of any potential risk to them. As the Applicant had refused to share his identity, the Council was unable to assess the level of risk.

36. These submissions will be taken into account below, in considering the exemptions claimed by the Council.

Section 38(1)(b) - Personal information

37. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.

38. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

39. To rely on this exemption, the Council must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.

40. In his request, the Applicant sought all the information held in the hard copy Register of Interests. During the investigation, he clarified that, in addition to the information being withheld in the "Houses, Land and Buildings" section of the published Register, he also wished to obtain the home addresses and signatures of elected members, as recorded in the hard copy Register.

41. The Council explained that the information in question comprised the addresses and property addresses of identified individuals, specifically its own councillors. The Council submitted that disclosure would contravene the first and third data protection principles.

42. The Commissioner must decide whether the Council was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

43. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 ? see Appendix 1. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR, also set out in in Appendix 1.)

44. Information which could identify individuals will only be personal data if it relates to those individuals. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus. It is clear that the information withheld in this case (i.e. addresses, property interests and signatures of named councillors) "relates to" identifiable living individuals.

45. Having considered the withheld information, the Commissioner therefore concludes that the information withheld is personal data, for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

46. The Council stated that disclosure of this personal data would contravene the first and third data protection principles (Article 5(1)(a) and (c)). Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 5(1)(c) states that personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

47. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing. In the case of FOISA, personal data is processed when it is disclosed in response to a request.

48. All of the Council's submissions relate to Article 5(1)(a). It is not apparent why the principle in Article 5(1)(c) would be contravened by disclosure of the withheld personal data in this particular case and, in the absence of submissions from the Council, the Commissioner must conclude that it would not be.

49. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)). In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed. The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

50. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).

51. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

52. The Council argued that the legitimate interests of the data subjects which favoured non-disclosure outweighed those of the Applicant in favour of disclosure.

53. The tests which must be met before Article 6(1)(f) can be met are as follows:

(i) Does the Applicant have a legitimate interest in obtaining the personal data?

(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

54. In his application to the Commissioner, the Applicant believed there was a public interest in disclosure of the information. In support of his position, he submitted that the personal data had previously been published in a polling notice. He argued that those standing for public office as a member of the local authority have their names and addresses published as part of the election process yet, once councillors are elected, the information leaves the public realm.

55. During the investigation, the Applicant made further submissions. These included the submission that, as councillors receive public monies, they should be publicly accountable.

56. The Council acknowledged the legitimate interest of the Applicant, and the wider, general legitimate interest in openness and accountability of all elected members.

57. With the exception of certain information (namely the signatures recorded in the hard copy Register of Interests), the Commissioner accepts that disclosure of the majority of the withheld information would facilitate transparency and accountability to the Applicant (and the wider public) regarding the property interests of elected members, as declared in the full Register of Interests. Indeed, the Scottish Parliament and the Scottish Ministers have recognised the public interest in such information in the Ethical Standards legislation referred to in paragraph 31 above. The ownership of or interest in property, particularly a home, may well impinge on the discharge of a councillor's functions, or at least reasonably be perceived to do so, and there is clearly a legitimate interest in the public being aware of such matters. Consequently, the Commissioner accepts that the Applicant has a legitimate interest in disclosure of this personal data.

58. However, in respect of the signatures recorded in the hard copy Register of Interests, the Commissioner is not satisfied that the Applicant has a legitimate interest in obtaining this information. The Commissioner accepts that disclosure of this information would evidence that the individual elected members had, by signing the completed forms, declared that the information provided was accurate. It would also provide evidence of receipt of the forms by the Council. However, the Commissioner does not consider disclosure of this remaining information would advance, to any other extent, the legitimate interests he has identified above. He can, for the record, confirm that the forms in question have all been signed.

59. In the circumstances, therefore, the Commissioner finds that the Applicant does not have a legitimate interest in obtaining the signatures of individuals as recorded in the hard copy Register of Interests, and he finds that this information has been properly withheld under section 38(1)(b) of FOISA.

Is disclosure of the personal data necessary?

60. Having accepted that the Applicant has a legitimate interest in the remaining withheld personal data, the Commissioner must consider whether disclosure of those personal data is necessary for the Applicant's legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means.

61. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[7]. In this case, the Supreme Court stated (at paragraph 27):

A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.

62. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.

63. In its submissions to the Commissioner, the Council explained that information about councillors' property interests is published in the online Register, for example, whether they are a tenant or own a property (or properties). In the Council's view, this satisfied the general legitimate interest in openness and accountability without disclosing the property addresses.

64. The Commissioner accepts that disclosure of the remaining personal data is necessary to achieve the Applicant's legitimate interests. The Council already publishes certain property information in the online Register which, in his view, takes the Applicant some way towards satisfying his legitimate interest. However, more specific details of the property or properties concerned (including their location) might well be considered relevant to the discharge of a particular councillor's functions and would be quite appropriate matters for transparency and accountability in this context. The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects than providing the remaining withheld information in full. In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of the Applicant's legitimate interests.

65. The Commissioner will now consider whether the Applicant's legitimate interest in obtaining the remaining withheld information in the hard copy Register of Interests outweighs the rights and freedoms of the data subjects.

The data subjects' interests or fundamental rights and freedoms

66. It is necessary to balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subjects would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

67. The Commissioner's guidance[8] on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties. He notes that Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects. These are some of the factors public authorities should consider:

(i) Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?

(ii) Would the disclosure cause harm or distress?

(iii) Whether the individual has objected to the disclosure.

Does the information relate to public or private life?

68. Disclosure under FOISA is public disclosure; information disclosed under FOISA is effectively placed into the public domain.

69. The Commissioner acknowledges that the withheld information relates to the individuals' private lives, in that it comprises their property interests including their home addresses and whether they own or rent a property or properties. However, he also acknowledges that elected members are required to declare this information for the purposes of it being recorded in what is stated and legally required to be a publicly accessible Register of Interests, to ensure that potential conflicts of interest are identified and can be managed. In the Commissioner's view, therefore, the information also relates, by association, to the councillor's role as an elected member.

70. The Commissioner notes the arguments put forward by the Applicant that elected members are required to make known their home addresses when standing for election. He also acknowledges that, once elected, councillors are required to declare all property interests, including their homes, for inclusion in the principal Register of Interests.

71. Having examined the "Notes on Registration of Councillors Interests" set out on page 2 of the pro forma which councillors are required to complete when registering their interests, the Commissioner observes that "Note 5" states: "The Register of Councillors' Interests is open to public inspection without charge and the principal Register is retained at the Council's Head Offices at the Civic Centre, Motherwell. The Register is also available for inspection on the Council's website."

72. This, in the Commissioner's view, appears to be in line with the relevant Ethical Standards regulations, the Councillors' Code of Conduct and the Standards Commission guidance referred to above.

73. The Commissioner has also taken regard of the Council's submissions. He notes that the Council operates an "opt-in" system where property and home address information is excluded from the online version of the Register, unless a councillor wishes it to be published.

74. In the Commissioner's view, whether or not property and home address information is published in the electronic version of the Register is separate from the fact that it is recorded in the hard copy Register, which is, in accordance with the relevant Ethical Standards legislation referred to above, to be available for public inspection, a fact which elected members are made aware of from the outset. While the Commissioner notes the Council's practice in relation to property details, there would appear to be no basis in law for this arrangement (see further paragraphs 79 and 81/2, below): the reasonable expectation of councillors would appear to be that the information will be public.

75. In the circumstances, the Commissioner concludes that the withheld information relates to both the private and public lives of the data subjects.

Would disclosure cause harm or distress to the data subject and has the individual objected to the disclosure?

76. The Commissioner has also considered the harm or distress that might be caused by disclosure.

77. He has considered the Council's arguments that disclosure of the remaining withheld information would have potential consequences for the data subjects. While the Council recognised elected members should be subject to heightened scrutiny and available to their constituents, it believed this was satisfied by the information published in the online version of the Register. In the Council's view, disclosure of home address information, in particular, could subject elected members to unwanted contact at their place of residence, where security arrangements (such as those at councillor surgeries and Council offices) were not in place.

78. The Commissioner also notes that the Council stated it would not allow a member of the public full access to the hard copy Register of Interests, nor would it allow access to address information of councillors who, for personal security reasons, did not wish this information to be disclosed.

79. In the Commissioner's view, this appears to be at odds with the relevant Ethical Standards Regulations, the Councillors' Code of Conduct and the Standards Commission guidance referred to previously. While the Commissioner accepts that there is a theoretical risk that disclosure of home address information could facilitate security risks, the Council has not provided sufficient evidence of how this would manifest directly as a result of disclosure of the information requested, information which has been volunteered by the data subjects for inclusion in what is stated and legally required to be a register open to public inspection. Beyond the broad supposition that elected members are in a high-risk category, the Commissioner considers the Council has provided only the most general reference to security issues, not supported by specific evidence.

80. In the Commissioner's view, there was an existing expectation of disclosure of the information provided by councillors for inclusion in the hard copy Register, at the point of declaration. As such, the Commissioner does not accept that the Council has sufficiently evidenced that disclosure would cause any harm or distress to the data subjects, or that they have objected to disclosure.

Balance of legitimate interests

81. After carefully balancing the legitimate interests of the data subjects (the elected members) against those of the Applicant, the Commissioner finds that the balance of legitimate interests falls in favour of the Applicant. It is a matter of law that the principal Register must be made available for public inspection. Statute has decided what type of information should be recorded in the Register, clearly because any conflict of interest in these areas would have a bearing on an elected member's ability to perform their functions as a councillor.

82. There is nothing in the relevant Ethical Standards Regulations, the Councillors' Code of Conduct or the Standards Commission guidance that allows any part of the principal Register to be withheld from the public. Regardless of what level of information an authority chooses to publish online, the regulations governing the Register appear to contain a clear obligation to make the principal Register available for public inspection, in full. The Council may have chosen a different approach in respect of property details, but it has not explained satisfactorily how that approach is justified in law. The views of the Standards Commission are noted, but these are not a substitute for what appears to be a clear legislative requirement.

83. The Commissioner does not accept that there would be a degree of distress caused to the data subjects by the disclosure of this information, sufficient to override the legitimate interests of the Applicant and the wider public interest. Neither, bearing in mind the nature of the information and the legal requirements surrounding the Register, does he believe there to be a reasonable expectation that this information should be other than public. In all the circumstances, he concludes that condition (f) could be met in this case and that disclosure of the information would therefore be lawful.

Fairness

84. Given that the Commissioner has determined that the processing of the personal data would be lawful, and bearing in mind his reasons for reaching that conclusion, he can identify no reason for finding that disclosure would be other than fair.

Conclusion on the data protection principles

85. The Commissioner is satisfied that the withheld personal data (other than signatures) can be disclosed without breaching the data protection principles in Article 5(1) of the UK GDPR.

86. Given that the Council has also withheld some of this information (namely home address information) under the exemption in section 39(1) of FOISA, he will go on to consider that exemption in relation to that information.

87. However, for the remaining withheld personal data, the Commissioner requires the Council to disclose this to the Applicant.

Section 39(1) - Health, safety and the environment

88. Section 39(1) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual. This is a qualified exemption and is subject to the public interest test required by section 2(1)(b) of FOISA.

89. In the Commissioner's briefing[9] on this exemption, it is noted that section 39(1) does not contain the usual harm test. Instead of the "substantial prejudice" test found in various other exemptions contained in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety. The briefing also notes that the test of "endangerment" is less demanding than the "substantial prejudice" test applied in other exemptions.

90. The Commissioner's view is that the term "endanger" is broad enough to apply where there is a (direct or indirect) threat to the safety of a person which would foreseeably arise in the future, as well as immediate harm, since the exemption does not specify that any threat should be imminent before it applies. The Commissioner believes that for endangerment to be considered likely, however, there must be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.

91. In its submissions to the Commissioner, the Council confirmed it wished to maintain reliance on section 39(1) of FOISA to withhold the home address information of certain elected members.

92. The Council submitted that, in this case, the physical or mental safety of those elected members would, or would be likely to, be endangered by disclosure of the information. In general, the Council argued, councillors are considered to be at a higher risk of being targeted by disgruntled constituents or organisations who are dissatisfied with the outcome of any investigation or assistance given. In evidence of this, the Council referred to an incident in a neighbouring local authority area, where a councillor's car was set on fire outside his home[10].

93. The Council further submitted it was currently investigating potential risks or threats referred from Police Scotland investigations and incidents of anti-social behaviour. It was also issuing personal safety alarms to all elected members who were considered to be at a higher risk.

94. In the Council's view, were property addresses made publicly available, this posed a potential risk that the information could be used to cause harm, whether that be physical (such as a physical attack at the property) or mental (such as blackmail, stalking etc.).

95. The Council was asked whether it had considered asking the individuals in question whether they believed there was any risk to their health and safety, as a direct result of disclosure of the information. In response, the Council took the view that, given the number of elected members (77), and excluding those few whose property information is published in full, it was highly disproportionate to ask them all to state their specific health and safety concerns.

The Commissioner's view

96. In considering the Council's submissions, the Commissioner has to be satisfied that the Council has evidenced threats to the physical health or safety of councillors, resulting directly from disclosure of the information sought. He needs to be persuaded that such instances would be made more likely, at least, as a result of disclosing the information.

97. As rehearsed under section 38(1)(b) above, the Commissioner accepts that there is a theoretical risk that disclosure of home address information could lead to harassment (and therefore distress) and/or facilitate security risks. However, he is not persuaded that the Council has submitted sufficient arguments and evidence to support the case that disclosure of the information would lead to actual direct risk to personal health or safety, as claimed.

98. In the Commissioner's view, the Council has provided only generic arguments on safety and security risks, which lack evidence. While the Council has made reference to one incident in another local authority, it has provided no evidence to suggest that this occurred directly as a result of information that might have been published in that authority's Register of Interests (or by the authority in any form): indeed, it would appear to have been only suspected that the incident related to the owner of the car being a councillor. Further, while the Commissioner notes that the Council has decided to issue personal safety alarms to elected members deemed to be in a high-risk category, the fact that this measure is being taken does not, in itself, provide evidence of risk.

99. The Commissioner notes that the Council considered it disproportionate to ask the elected members in question whether they perceived there to be any risk to their personal health or safety, given the number of individuals involved. In the Commissioner's view, this would be no different - in terms of proportionality - to the Council's intention to ask each of these individuals whether they objected to the Applicant accessing their information in the Register of Interests (in the event that the Applicant had agreed to share his details with these individuals for this purpose). If the Council has the genuine intention of responding meaningfully to genuine risks faced by councillors, then presumably it must make some effort to understand what these risks are.

100. The Commissioner notes the obligations on councillors to record, in the Register of Interests, property and address information, and the Council's obligation to make available, for public inspection, the principal Register of Interests (as set out in paragraph 31 above). Given that his consideration of these matters has already been rehearsed earlier in this decision notice, he will not repeat that consideration in detail here.

101. In conclusion, the Commissioner finds that the Council has not demonstrated that its arguments about increased endangerment, should home address information be disclosed, are based on more than hypothetical supposition. He is not persuaded by these unsupported arguments that disclosure of the information - information volunteered by the data subjects for inclusion in a publicly accessible Register - would result in the harm identified by the Council. He therefore finds that the exemption in section 39(1) of FOISA does not apply to the withheld information comprising elected members' home addresses.

102. Having concluded that the exemption was wrongly applied, the Commissioner is not required to consider the public interest test in relation to disclosing or withholding this information. He requires the Council to disclose it to the Applicant.

Section 15 - Duty to provide advice and assistance

103. Section 15(1) of FOISA requires a Scottish public authority, so far as is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it. Section 15(2) states that a Scottish public authority shall be taken to have complied with this duty where (in relation to the provision of advice and assistance in a particular case) it conforms with the Scottish Ministers' Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004 (the Section 60 Code[11]).

104. The Section 60 Code states, at paragraph 5.1.1 in Part 2:

Authorities have a duty to provide advice and assistance at all stages of a request. It can be given either before a request is made, or to clarify what information an applicant wants after a request has been made, whilst the authority is handling the request, or after it has responded.

105. It further states, in section 9.2 in Part 2:

Duty to advise and assist when responding to a request

The obligation to provide advice and assistance continues at the point of issuing a response. For example, if directing the applicant to a website, the authority should take all reasonable steps to direct the applicant to the relevant section.

106. The Council was asked to explain why it did not consider the request satisfied the requirements for it to be an information request under FOISA, and why it considered it necessary to ask the Applicant whether he objected to the Council contacting each councillor in regard to his request.

107. In response, the Council explained that, on receipt of the request to see the hard copy Register, it considered this could be fulfilled by arranging an inspection of the Register, as outlined in the Standards Commission Guidance. The Council submitted that its response of 26 April 2019 was to advise that an inspection could be arranged on a "business as usual" basis, without recourse to FOISA. The Council acknowledged that its email did not explain this adequately, and should not have stated that Freedom of Information legislation did not apply.

108. The Council further explained that councillors might have objections to certain individuals accessing their address information. It submitted that the purpose of asking the Applicant whether he had any objections was to make him aware that his request to view the hard copy Register could not be fulfilled without councillors being informed of this, as a minimum.

109. The Council was asked to explain why it took approximately four weeks to decide to seek clarification of the request, and why it considered it necessary to do so.

110. In response, the Council explained that a number of officers were to be involved in formulating the response: they agreed the initial steps to be taken, following which a further discussion was to be held on how to proceed. Due to competing work pressures, this further discussion - during which it was agreed clarification would be sought - did not take place until around 16-17 May 2019, which was later than hoped.

111. The Council further submitted that, in his request, the Applicant stated the Council did not make councillors' "property interests" known via the online Register. It understood the Applicant to be aware of the level of information held in the full Register (including home addresses and other property information), and that published in the online Register, and believed the Applicant's use of the term "property interests" could relate to the other property interest information, and not necessarily home addresses.

112. The Council subsequently established that, for the majority of councillors, the only information not published online comprised home addresses. In the Council's view, had the request been clarified as relating solely to other property interests, this would have greatly reduced its scope by reducing the number of entries to be considered. However, the Applicant's email of 17 May 2019 made it clear that he required copies of all entries with no redactions.

113. The Commissioner has carefully considered the request, together with the Council's explanations above. The request was made in a recorded form, described the information requested and included the name of the Applicant. It even mentioned Freedom of Information. In his view, the request met all the requirements for it to be a valid request under section 8(1) of FOISA, and the Council ought to have treated it as such from the outset.

114. The Commissioner notes the Council's explanations for deciding to seek clarification, and the delay in so doing. In his view, the request clearly described the information sought, even if there might have been a degree of convenience in narrowing its scope, and so seeking clarification appears to have been an unnecessary step, leading to further delay. Neither can he excuse the four weeks it took the Council to do so. While the Commissioner accepts that public authority staff face competing, and often unexpected, work pressures, this does not permit an authority to ignore its obligations under FOISA. It is evident that the matter was not addressed by the Council adequately at review stage, leading to an unnecessary exchange with the Commissioner on the question of whether the Commissioner was entitled to investigate.

115. The Commissioner cannot regard unnecessary resort to clarification as an appropriate use of a public authority's powers in relation to the provision of advice and assistance. He cannot regard the Council's duty under section 15 of FOISA as having been met in this case. However, having made the points set out above, he does not consider there to be anything else he can usefully require the Council to do in this regard.

Decision

The Commissioner finds that North Lanarkshire Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that by withholding signatures under the exemption in section 38(1)(b) of FOISA, the Council complied with Part 1.

However, the Commissioner also finds that the Council failed to comply with Part 1 (and in particular section 1(1)) by wrongly withholding the remaining information under, variously, the exemptions in section 38(1)(b) (Personal information) and section 39(1) (Health, safety and the environment) of FOISA. He also finds that the Council failed to comply with its duty under section 15 of FOISA to provide advice and assistance to the Applicant.

The Commissioner therefore requires the Council to disclose to the Applicant the information found to have been wrongly withheld under sections 38(1)(b) and 39(1) of FOISA, by 26 February 2021.

Appeal

Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Daren Fitzhenry
Scottish Information Commissioner
12 January 2021

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

(a) section 25;

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

15 Duty to provide advice and assistance

(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in -

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

…

"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

39 Health, safety and the environment

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, endanger the physical or mental health or the safety of an individual.

…

United Kingdom General Data Protection Regulation

4 Definitions

For the purposes of this Regulation:

(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

…

5 Principles relating to processing of personal data

1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation")

…

6 Lawfulness of processing

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

…

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

…

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -

…

(d) disclosure by transmission, dissemination or otherwise making available.

…

(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4).

---