Decision 010/2014 Mr Ian M Irving and Argyll and Bute Council
Name of complainant
Reference No: 201302368
Decision Date: 28 January 2014
Summary
On 29 August 2013, Mr Irving asked Argyll and Bute Council (the Council) for the identity of a complainant. The Council withheld the information in terms of regulation 11(2) of the EIRs on the basis that it was personal data, the disclosure of which would breach the first data protection principle.
Following an investigation, the Commissioner accepted that the Council was entitled to withhold the information on this basis.
Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (b) (Personal data)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles: Part I - the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 29 August 2013, Mr Irving emailed the Council requesting the identity of an individual who had made a complaint against him in relation to a specified matter.
2. The Council responded on 16 September 2013. The Council informed Mr Irving that it had dealt with his request in terms of the EIRs. The Council further informed Mr Irving that it was withholding the information in terms of regulation 11(2) of the EIRs. This was on the basis that the information comprised the personal data of an individual and its disclosure under the EIRs would contravene the first data protection principle of the DPA.
3. On 18 September 2013, Mr Irving emailed the Council requesting a review of its decision. Mr Irving stated that he was not satisfied with the Council's decision and he considered the information should be disclosed to him.
4. The Council notified Mr Irving of the outcome of its review on 4 October 2013. The Council upheld its previous decision withholding the information in terms of regulation 11(2) of the EIRs.
5. On 8 October 2013, Mr Irving wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.
6. The application was validated by establishing that Mr Irving made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.
Investigation
7. The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. The Council was asked to justify its reliance on regulation 11(2) of the EIRs.
8. The Council responded by providing submissions on its application of regulation 11(2) of the EIRs and the relevant provisions of the DPA.
9. During the investigation, the investigating officer also sought and received submissions from Mr Irving.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the submissions, or parts of submissions, made to her by both Mr Irving and the Council. She is satisfied that no matter of relevance has been overlooked.
Regulation 11 (Personal data)
11. Regulation 10(3) of the EIRs requires that any personal data included in environmental information shall not be made available otherwise than in accordance with regulation 11. Regulation 11(2) prohibits the disclosure of personal data of which the applicant is not the data subject, where either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies to the information.
12. In order for a public authority to rely on the provisions of regulation 11(2) to withhold information, the information which has been requested must be personal data for the purposes of the DPA and disclosure of the information must contravene at least one of the data protection principles laid down in the DPA.
13. In considering the application of regulation 11(2), the Commissioner will firstly consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether its disclosure would breach the first data protection principle.
Is the information under consideration personal data?
14. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is the possession of, or is likely to come into the possession of, the data controller ..." (the full definition is set out in the Appendix).
15. The Commissioner is satisfied that the withheld information in this case is personal data, in line with the definition in part a) of section 1(1) of the DPA. A living individual (i.e. the complainant) can be identified from this information. The name of the complainant would clearly allow their identification, is biographical about them, and relates to them by revealing that they had made a complaint concerning Mr Irving.
Would disclosure of the personal data contravene the first data protection principle?
16. As noted above, the Council argued that making this information available would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The processing in this case would be making the information available in response to Mr Irving's request.
17. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and she is satisfied that the personal data under consideration in this case do not fall into any of the categories set out in that definition. Therefore, it is not necessary to consider the conditions in Schedule 3 in this case.
18. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that disclosure would also be fair and lawful.
19. The Commissioner must now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether disclosure of the personal data would otherwise be fair and lawful.
20. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA (and, by extension, the EIRs), given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
Can any schedule 2 conditions be met?
21. The Commissioner considers that the only condition in Schedule 2 to the DPA which might apply in this case is condition 6. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
22. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:
i. Is Mr Irving pursuing a legitimate interest or interests?
ii. If yes, is the processing (in this case, the disclosure of the information) necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject.
iii. Even if the processing is necessary for Mr Irving's legitimate interests, is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? As noted by Lord Hope in the CSA case, given that there is no presumption in favour of the release of personal data, the legitimate interests of Mr Irving must outweigh the rights, freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Irving.
Is Mr Irving pursuing a legitimate interest or interest?
23. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on section 38 of FOISA[2] states:
In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
24. In his application to the Commissioner, Mr Irving stated that he required the information in order to contact the complainant to provide an explanation regarding the matter which had been the subject of the complaint. Mr Irving considered he had a right to formally respond to the complaint.
25. The Council stated that it accepted that Mr Irving had a legitimate interest in understanding the reasons why he had been contacted in relation to the complaint and, therefore, in obtaining the personal data of the complainant.
26. The Commissioner accepts that Mr Irving has a legitimate interest, as the subject of the complaint, in understanding the identity of complainant and the basis of their complaint.
Is the processing necessary for the purposes of those interests?
27. The Commissioner must now consider whether disclosure of the personal data is necessary in order to satisfy the legitimate interests identified above. In doing so, she must consider whether these interests might reasonably be met by any alternative means.
28. In the Council's view, in order for Mr Irving to understand why he was contacted in relation to the complaint, he did not need to know the identity of the person who made the allegation.
29. In the Commissioner's view, without disclosure of the personal data under consideration, Mr Irving would not be able to fully understand the source of the complaint or to engage in discussion with the complainant.
30. In all the circumstances of this case, the Commissioner can identify no viable means of meeting Mr Irving's legitimate interests which would interfere less with the privacy of the relevant data subject than the provision of the withheld personal data. In the circumstances, she is satisfied that disclosure of the personal data is necessary to meet the legitimate interests in question.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subject?
31. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr Irving's legitimate interests, she is now required to consider whether that disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Mr Irving and the data subject in question. Only if the legitimate interests of Mr Irving outweigh those of the data subject in question can the information be disclosed without breaching the first data protection principle.
32. In the Commissioner's briefing on personal information[3], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
? the potential harm or distress that may be caused by disclosure
? whether the individual objected to the disclosure
? the reasonable expectations of the individual as to whether the information should be disclosed.
33. In its submissions, the Council stated that it had contacted the data subject and asked whether they would be willing to consent to the disclosure of their personal data. The data subject had refused consent for disclosure. The Council also explained that the data subject had been informed by the Council that their name would be kept confidential. As such, there was an expectation on the part of the data subject that their name would not be disclosed. The Council also considered that there was a potential for distress to be caused to the data subject as a consequence of the disclosure of their personal data.
34. In his submissions to the Commissioner, Mr Irving explained that he had been informed that the complaint had been made by a neighbour. Mr Irving stated that this had caused much distress among his other neighbours and he had been encouraged by the other neighbours to seek clarity on the matter. In his view, the request was made not just for himself, but also to provide clarity to remove suspicion from friends and neighbours.
35. The Commissioner has considered all of the submissions made by the Council and Mr Irving when considering the balancing test in this case. The Commissioner recognises that Mr Irving wishes to know the identity of the complainant in order to be able to contact them and clarify the matter of concern to them, and to correct any misunderstandings.
36. However, she also recognises that the individual concerned chose to raise their concerns with the Council rather than with Mr Irving and to ask it, as the relevant authority, to consider and respond to their complaint. She recognises that direct contact from Mr Irving might be perceived as unwelcome or problematical by the individual concerned.
37. The Commissioner is of the view that the data subject would not have any reasonable expectation that their identity would be publicly disclosed in the context of the information requested by Mr Irving, which is the effect of the disclosure of information under the EIRs. She accepts that the information pertains to the data subject's personal rather than public life and that there is the potential for distress to be caused to them by disclosure, should they be contacted directly by Mr Irving.
38. On balance, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfil Mr Irving's legitimate interests, she does not agree that this outweighs the prejudice that would be caused to the data subject's rights, freedoms and legitimate interests. She considers that such prejudice would be unwarranted in this case. The Commissioner is therefore satisfied that condition 6 of Schedule 2 is not met in this case.
39. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject, the Commissioner must also conclude that disclosure would be unfair. As condition 6 cannot be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was properly withheld under regulation 11(2) of the EIRs.
DECISION
The Commissioner finds that Argyll and Bute Council complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr Irving.
Appeal
Should either Mr Irving or Argyll and Bute Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
28 January 2014
Appendix
Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
?
(b) is subject to regulations 6 to 12.
?
10 Exceptions from duty to make environmental information available
?
(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.
?
11 Personal data
?
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.
(3) The first condition is-
(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-
(i) any of the data protection principles;
?
(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - the principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1]
[2] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.asp?lID=3085&sID=133
[3]
