|
Decision 012/2011 Mr Paul Hutcheon and the Scottish Environment Protection Agency
Staff names and job titles
Reference No: 201001271
Decision Date: 19 January 2011 |
Summary
Mr Hutcheon requested from the Scottish Environment Protection Agency (SEPA) the names of employees with their job titles.SEPA responded by refusing to disclose this information, on the grounds that it constituted personal data which was exempt from disclosure under section 38(1)(b) of FOISA. Following a review, Mr Hutcheon remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that SEPA had partially failed to deal with Mr Hutcheon's request for information in accordance with Part 1 of FOISA by withholding certain of the information requested by Mr Hutcheon. He did not accept that the disclosure of this information would breach any of the data protection principles and required its disclosure.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions) and 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: The principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
Background
1.On 13 April 2010, Mr Hutcheon wrote to SEPA requesting the names of all SEPA employees, next to their job titles.
2.SEPA responded on 13 May 2010 to the effect that it was withholding the names and job titles of staff other than senior managers, which it already published, citing the exemption in section 38(1)(b) of FOISA (which relates to personal data).
3.On 1 June 2010, Mr Hutcheon wrote to SEPA requesting a review of its decision.He highlighted his view that, in principle, public bodies should publish the names of all employees next to their job titles as this would serve the interests of transparency and provide accountability to taxpayers.
4.SEPA notified Mr Hutcheon of the outcome of its review on 17 June 2010, upholding (with reasons) its initial decision to withhold the information under section 38(1)(b) of FOISA.
5.On 22 June 2010, Mr Hutcheon wrote to the Commissioner's Office, stating that he was dissatisfied with the outcome of SEPA's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Hutcheon had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 7 July 2010, SEPA was notified in writing that an application had been received from Mr Hutcheon and was asked to provide the Commissioner with any information withheld from him. SEPA responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted SEPA, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.SEPA was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested, with particular reference to the requirements of section 38(1)(b).
9.SEPA provided submissions, setting out its reasons for withholding the information under section 38(1)(b) of FOISA.These will be considered fully in the Commissioner's analysis and findings below, along with the comments obtained from Mr Hutcheon on his legitimate interest in obtaining the information.SEPA also advised that it was in the process of restructuring at the time it received Mr Hutcheon's request: however, as Mr Hutcheon is aware, the request could only cover any relevant information held by SEPA at the time it received the request (and in any event, the request specified names and job titles "as of 13/4/2010").
Commissioner's analysis and findings
10.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Hutcheon and SEPA and is satisfied that no matter of relevance has been overlooked.
Consideration of section 38(1)(b) (Personal information)
11.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)), exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure would contravene any of the data protection principles set out in Schedule 1 to the DPA.This exemption is absolute in that it is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
12.SEPA relied on the exemption in section 38(1)(b) of FOISA for withholding the list of names and job titles requested by Mr Hutcheon, on the basis that the information was the personal data of the staff concerned.SEPA argued that disclosure of the withheld information would contravene the first data protection principle on fair and lawful processing.
Is the information personal data?
13."Personal data" is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
14.In this case, the Commissioner is satisfied that the withheld information is the personal data of SEPA staff.It consists of data (both names and job titles) from which those staff can be identified.The information is biographical of the staff and focuses on them.Consequently, the Commissioner is satisfied that it relates to the staff covered by Mr Hutcheon's request.
15.The Commissioner must now go on to consider whether disclosure would breach any of the data protection principles contained in Schedule 1 to the DPA.As noted above, SEPA argued that disclosure would breach the first data protection principle.
Would disclosure contravene the first data protection principle?
16.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
17.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and he is satisfied that the personal data under consideration in this case do not fall into any of the categories set out in that definition.It is therefore not necessary to consider the conditions in Schedule 3 to the DPA in this case.
18.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
19.When considering the conditions in Schedule 2 of the DPA, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner 2008 UKHL 47[1] (the Collie judgement) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
20.In line with SEPA's submissions on this point, the Commissioner considers condition 6 to be the only condition in Schedule 2 which might permit disclosure in this case.Condition 6 permits personal data to be processed if the processing (which in this case would be by disclosure into the public domain in response to Mr Hutcheon's information request) is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights, freedoms or legitimate interests of the data subject(s) (the individual(s) to whom the personal data relate, in this case the staff covered by the request).It is clear from the wording of this condition that each case will turn on its own facts and circumstances.
21.There are, therefore, a number of different tests which must be considered before condition 6 can be met. These are:
a)Does Mr Hutcheon have a legitimate interest in obtaining the withheld personal data?
b)If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the individuals in question?
c)Even if the processing is necessary for Mr Hutcheon's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the individuals concerned?As noted by Lord Hope in the Collie judgement, there is no presumption in favour of the disclosure of personal data under the general obligation laid down in FOISA.Accordingly, the legitimate interests of Mr Hutcheon must outweigh the rights, freedoms or legitimate interests of the individual before condition 6(1) will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that SEPA was correct to refuse to disclose the personal data to Mr Hutcheon.
Does Mr Hutcheon have a legitimate interest?
22.Mr Hutcheon indicated that his legitimate interest was in acquiring the requested information on behalf of the readers of his newspaper, the Sunday Herald.In the interests of accountability, he believed taxpayers should have a right to know who was employed by the public bodies they paid for, and for what purpose: in his view, there should be a public register of this information.
23.SEPA acknowledged the validity of the legitimate interest stated by Mr Hutcheon in relation to its senior managers, but considered that the argument became less valid where the staff concerned did not hold senior posts or did not have a clearly public-facing role within the organisation.Consequently, it took the view that there was a legitimate interest in the disclosure of the names and job titles of those members of staff whose decision making impacted on its customers (and on this basis provided names and job titles for 47 senior managers).In relation to the remainder of its staff, however, it submitted that the legitimate interest was in what was being done with public money, rather than who was doing it: it believed that this could be addressed by the release of aggregated data on posts (post title and number of post holders for each, grouped by salary band), as proposed in its submissions to the Commissioner.This proposal was put to Mr Hutcheon, but he did not consider it to go far enough.
24.There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.In his published guidance on section 38 of FOISA[2], the Commissioner states:
"In some cases, the legitimate interest might be personal to the applicant ? e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as scrutiny of the actions of public bodies or public safety."
25.The Commissioner recognises that Mr Hutcheon, as a journalist, has a legitimate interest in scrutinising the way in which public authorities operate using funds allocated from the public purse, and in bringing issues of significance arising from such scrutiny to the attention of the public.He accepts, as SEPA has acknowledged, that this legitimate interest would extend to being able to identify the holders of posts charged with making key decisions on behalf of the organisation: these, however, appear to be the posts in respect of which Mr Hutcheon has already been provided with the information he requested (and in respect of which, in their current form, the relevant information is published on SEPA's website).
26.In relation to the remaining posts in SEPA's organisational structure, however, the Commissioner is inclined to accept SEPA's position that the legitimate interest in disclosure relates to what is done rather than who is responsible for doing it.Clearly, it is important that public authorities have staff in particular posts with the appropriate skills and experience for those posts.However, this does not (in the Commissioner's view) mean that there is a legitimate interest in being able to identify the holders of all of those posts, as opposed to one in being satisfied that adequate and relevant personnel policies and procedures are in place.
27.There may be a legitimate interest in knowing which member of staff is dealing with a specific matter (particularly one of public, or potentially more limited, concern) or in specific issues relating to the conduct or performance of a specific employee (particularly if they have wider ramifications), but the Commissioner does not believe that it follows that there is a more speculative legitimate interest in being able to identify each individual member of the workforce.
28.In all the circumstances, therefore, the Commissioner is satisfied that Mr Hutcheon's legitimate interest in disclosure of the information he has requested has been met in part by SEPA'S disclosure of names and job titles in respect of its senior managers, with its response of 13 May 2005.In respect of the remaining names, he is not satisfied that Mr Hutcheon has demonstrated a legitimate interest which would allow condition 6 in Schedule 2 to the DPA to be met in this case.For that reason, he is not satisfied that disclosure of these names would be fair or, in the absence of a condition permitting disclosure, lawful.Consequently, he accepts that disclosure of these names would contravene the first data protection principle and that, to that extent, SEPA was correct to withhold the information requested under section 38(1)(b) of FOISA.
29.As indicated above, the Commissioner has accepted that Mr Hutcheon has a legitimate interest in obtaining information about the job titles of SEPA's remaining staff, in the form (post title and number of post holders for each, grouped by salary band) offered by SEPA in the course of the investigation.SEPA has indicated that it is willing to disclose this information and thus has presented no arguments in support of it being withheld.It was clearly information held by SEPA when it received Mr Hutcheon's request and the Commissioner is satisfied that it fell within the scope of that request.He will now consider briefly whether SEPA was correct to withhold it (when responding to Mr Hutcheon's request or information and his requirement for review) under section 38(1)(b) of FOISA.
30.Firstly, the Commissioner finds that the information on job titles remains the personal data of the individuals occupying the posts in question, even in the absence of names, taken with other information in the possession of SEPA as data controller.As indicated above, the Commissioner is satisfied that Mr Hutcheon has a legitimate interest in disclosure and, in the circumstances, that this interest could not reasonably be met in any way which would be less intrusive on the data subjects' privacy than that disclosure: consequently, he is satisfied that disclosure of the withheld information is necessary to meet Mr Hutcheon's legitimate interests.
31.Finally, the Commissioner has considered the rights, freedoms and legitimate interests of the data subjects.Except to the extent that names have been made available by SEPA already, he does not consider that disclosure would carry with it a substantial risk of identification of the individuals to whom the information relates, particularly in the case of those more junior members of staff whose reasonable expectations of privacy are likely to be higher.Given the nature of the information, he is satisfied that any infringement on the data subjects' rights, freedoms or legitimate interests would be insignificant.Having balanced the respective interests, he is satisfied in this case that disclosure would not be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.He is aware of no reason why disclosure should be unfair or unlawful (and none has been drawn to his attention) and therefore has concluded that SEPA was not entitled to withhold this information under section 38(1)(b) of FOISA.In any event, he notes SEPA's willingness to disclose the information now.
DECISION
The Commissioner finds that the Scottish Environment Protection Agency (SEPA) partially failed to comply with Part 1 (and in particular section 1(1)) of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Hutcheon, by incorrectly withholding certain information (post title and number of post holders for each, grouped by salary band, in respect of all posts in respect of which full information was not disclosed) from Mr Hutcheon.However, he also finds that SEPA was correct to withhold the names of post holders (other than the senior managers in respect of whom full disclosure was made) under section 38(1)(b) of FOISA.
The Commissioner therefore requires SEPA to release the information described in the previous paragraph, by 7 March 2011.
Appeal
Should either Mr Hutcheon or SEPA wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
19 January 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(4)The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
...
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=3085&sID=133
