Decision 016/2011 Mr Graham McLeod and Fife Council

Personal data in public petition

Reference No: 201001631
Decision Date: 24 January 2011

Summary

Mr McLeod requested from Fife Council (the Council) a copy of the public petition complaining about disruptions at Leslie Community Council meetings.The Council responded by disclosing the petition, subject to redaction of the names, addresses and signatures of the petitioners.The Council withheld this information in terms of section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA) on the basis that it was the personal data of third parties, the release of which would breach the first data protection principle.Following a review, Mr McLeod remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Council had dealt with Mr McLeod's request for information in accordance with Part 1 of FOISA.He agreed that the information was personal data and that the disclosure of the data would breach the first data protection principle.He did not require the Council to take any action.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6)(General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions) and 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles - the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 14 June 2010, Mr McLeod wrote to the Council requesting "a copy of the public petition complaining about the disruptions caused at Leslie Community Council meetings".Mr McLeod referred to a newspaper article which had mentioned this petition.

2.The Council responded on 29 June 2010 and provided the information requested, but redacted the names, addresses and signatures of the petitioners as information exempt from release in terms of section 38(1)(b) of FOISA.The Council stated that this redacted information was the personal data of third parties and to release the information would breach the data protection principles set out in the DPA.

3.On 5 July 2010, Mr McLeod wrote to the Council requesting a review of its decision.He drew the Council's attention to the number of (redacted) names on the petition and commented that public attendance at the Leslie Community Council meetings averaged between three and five persons, and only rarely reached ten or more, yet on the petition supplied by the Council there were thirty-six signatories.Mr McLeod therefore believed the petition was "orchestrated? rather than it representing any true local opinions".Mr McLeod accepted the redaction of signatures, but was concerned with the redaction of the other personal data.

4.The Council notified Mr McLeod of the outcome of its review on 3 August 2010 and upheld its decision.It confirmed that the information withheld was personal data in terms of section 1(1) of the DPA, on the basis that the addresses and signatures related to persons identifiable by name and their appearance on the petition revealed the opinion of each signatory that a named Community Councillor did not represent the views of their community.The Council stated that disclosure would contravene the first data protection principle (the requirement to process personal data fairly and lawfully).Furthermore, the Council stated that it had not found any of the conditions in Schedule 2 (which permits the processing of personal data in certain circumstances) of the DPA to be applicable in this case.

5.On 11 August 2010 Mr McLeod wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr McLeod had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 18 August 2010, the Council was notified in writing that an application had been received from Mr McLeod and was asked to provide the Commissioner with any information withheld from him.The Council responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information withheld, with particular reference to the requirements of section 38(1)(b).

9.Mr McLeod had stated that there were already similar personal data on the Council's website: for example, names and addresses of people (including himself) who had either submitted individual letters or signed petitions were contained on the Council's Planning Department web pages.The Council advised Mr McLeod that Planning Authorities had a legal duty to make available certain details relating to planning applications, and regulations allowed for this information to be made publicly available on the internet.While it was satisfied that it had published this information in accordance with the relevant legislation and guidance, it would investigate any case where he believed it had failed to do so in relation to his own personal data.

10.As explained to Mr McLeod, the Commissioner cannot address any concerns about his personal data appearing on the Council's website.Such concerns must be addressed to the Council and then, if necessary, to the (UK) Information Commissioner, who has responsibility for the DPA.

11.Mr McLeod accepted the Council's withholding of the signatures in the petition and accordingly this decision will not consider that information.

12.The relevant submissions received from the Council and Mr McLeod will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

13.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr McLeod and the Council and is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) of FOISA

14.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles laid down in Schedule 1 to the DPA.

15.This particular exemption is an absolute exemption, and so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.

16.The Council withheld the names and addresses of the signatories to the public petition, which expressed the view that a named Community Councillor did not represent the views of a particular community.The Council withheld the names and addresses on the grounds that they were personal data which, if disclosed, would breach the first data protection principle in Schedule 1 to the DPA and therefore were exempt from disclosure in terms of section 38(1)(b) of FOISA.

17.The Commissioner has considered in previous decision notices whether the identities of signatories to a petition should be disclosed under FOISA, for example in Decision 064/2009 Mr Robert Henderson and the University of Edinburgh [1], and under the Environmental Information (Scotland) Regulations 2004 in Decision 024/2010 Mr N and the Scottish Ministers[2].While in both these cases the Commissioner accepted that the petitioners' identities should not be disclosed, he would stress that each case must be considered on its own merits, although the reasoning in one decision may be relevant to another decision.

Is the information personal data?

18.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (see the Appendix for the full definition).

19.The Council submitted that the information withheld was personal data in terms of section 1(1) of the DPA, that is the names and addresses related to identifiable persons and appearance on the petition revealed the opinion of each signatory that the subject of the complaint did not represent the views of their community.

20.The Commissioner accepts that disclosure of the names and addresses would make it possible for Mr McLeod, or any other person receiving this information, to identify the named individuals and be aware that they had been involved in the petition.In the circumstances, he accepts that the information focuses on, and is biographical of, those individuals, and therefore that it relates to them.The Commissioner therefore accepts that the information requested by Mr McLeod is the personal data of the petitioners.

Would disclosure of the information breach the first data protection principle?

21.The Council argued that disclosure of the information would breach the first data protection principle.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met, and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.In this case, processing would be by disclosure in response to Mr McLeod's information request.

22.The Commissioner is satisfied that the withheld information does not fall into any of the categories of sensitive personal data listed in section 2 of the DPA, and consequently it is not necessary in this case to consider any of the conditions in Schedule 3.

23.The Council was asked whether consent to disclosure of the information had been sought or received from the data subjects (the petitioners), since consent would mean that condition 1 of Schedule 2 could be met.The Council did not think this condition applied, and replied that, although the petition contained no indication of the level of confidentiality the signatories might have expected, it had concluded from the nature of the information that it was likely to have been submitted in confidence.

24.As far as the Council was aware, the details of the signatories within the petition had not been made public (although the existence of the petition had and it considered the name of the subject of the complaint to have entered the public domain).Further, the Council was of the opinion that the petition was more likely to have been submitted in confidence because it was against a person and not a general cause and did not form part of a formal process of objection (like a planning application).While this does not address fully the applicability of condition 1, since consent to disclosure was neither sought not given, the Commissioner would not expect it to have been actively sought in the circumstances and accepts that condition 1 is not applicable in this case.

25.The Commissioner therefore takes the view that only condition 6 could potentially be applicable in this case.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. It is clear from the wording of this condition that each case will turn on its own facts and circumstances.

26.When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[3] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.

27.There are, therefore, a number of different tests which must be satisfied before condition 6(1) can be met.These are:

Does Mr McLeod have a legitimate interest in obtaining these personal data?

If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects (in this case, the petitioners)?

Even if the processing is necessary for the legitimate purposes of Mr McLeod, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?This will involve a balancing exercise between the legitimate interests of Mr McLeod and those of the data subjects.Only if (or to the extent that) the legitimate interests of the Mr McLeod outweigh those of the data subjects can the personal data be disclosed: there is no presumption in favour of disclosure.

Does Mr McLeod have a legitimate interest in obtaining these personal data?

28.Mr McLeod acknowledged that the petition was not aimed at him, but considered that "in the interests of democracy" disclosure of the names and addresses would confirm that the petition was what he described as an "untrue" document, in the sense that there were more names on the petition than the average attendance at meetings of this particular Community Council. Accordingly, in Mr McLeod's view, the majority of the signatories signed the petition "under false pretences", because they had neither attended a meeting of the Community Council nor had any intention of attending one in the future.Mr McLeod believed that the Council had used this petition as part of a disciplinary hearing against the Community Councillor it was aimed at, without checking the validity of the petition or whether there was any "agenda" behind it.

29.The Council did not consider Mr McLeod to have any legitimate interest in receiving the withheld information, which did not relate to him.It acknowledged, however, that the petition formed part of a process of dealing with complaints against a Community Councillor under its Scheme for the Establishment of Community Councils[4], a copy of which it provided.

30.Having considered the submissions of both parties, the Commissioner accepts that Mr McLeod, as a local resident, has a legitimate interest (as indeed do the wider public) in being satisfied that the proceedings of a Community Council, and of the local authority in relation to that Community Council, are conducted properly and with regard only to relevant considerations.

Is disclosure of the information necessary to achieve these legitimate interests?

31.Mr McLeod did not comment on whether the information requested was necessary to pursue his legitimate interests effectively.The Council, on the other hand, did not believe disclosure of this information to be necessary for Mr McLeod's purposes.

32.In this case, Mr McLeod is seeking, for the purposes of assessing a petition, the identities of the petitioners.The Commissioner accepts that this is relevant to the legitimate interest he has identified above.In all the circumstances, the Commissioner can identify no viable means of meeting this particular legitimate interest which would interfere less with the privacy of the relevant data subjects than obtaining all of the information requested.Consequently, he accepts that disclosure of the information is necessary for the purposes of Mr McLeod's legitimate interests.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

33.As indicated above, the Council advised that the information in the petition was not provided by the signatories in the expectation that it would be released to the public.At the time of signature, the Council believed, the individuals who signed this document did so with an expectation of anonymity.As noted above, the Council was of the opinion that the petition was more likely to have been submitted in confidence because it was against a person and not a general cause, and the petition did not form part of a formal process of objection (for example, objections to a planning application).

34.The Council submitted that it was in the interests of the petitioners for the information to be withheld, as release might cause substantial harm or distress to those individuals were their names and addresses to be released.The Council did not explain exactly what this substantial harm or distress would consist of, but, as background, indicated that there had been significant tension surrounding events at Leslie Community Council.

35.The Commissioner has considered these arguments carefully. He has taken into account the guidance on this point in his own briefing[5] on the section 38 exemption, which identifies relevant factors as including:

a.whether the information relates to the individual's public or private life

b.the potential harm or distress that may be caused by disclosure

c.whether the individual has objected to disclosure

d.the reasonable expectations of the individual as to whether their information would be disclosed.

36.Firstly, the Commissioner notes that the petition is signed by individuals in a private capacity rather than, say, employees acting in work-related capacity or officials on behalf of an organisation (although it does relate to the business of a body with quasi-public functions).The Commissioner also notes that the Council has not sought consent from the signatories for their personal data to be released (in the circumstances, he would not expect them to do so) and that neither the petition nor the Scheme for the Establishment of Community Councils contains any explicit statements as to how the information would be held or used.The Council has been asked whether there is any evidence of the signatories' expectations, but has not provided any.

37.Although the Commissioner is of the view that the Council has failed to provide any detailed evidence as to the level of harm disclosure would cause, he does accept, given the tensions commented upon by the Council (and reported in the local media) in respect of this Community Council, that disclosure of the withheld information could result in some distress to the data subjects.

38.In the circumstances of this case, the Commissioner also accepts the Council's submission that the petitioners would have a reasonable expectation that the withheld information would not be put into the public domain.While he finds the respective interests of the applicants and the data subjects to be relatively finely balanced in this case, in the circumstances (and particularly given the data subjects' reasonable expectations as to disclosure), he must conclude that disclosure would be unwarranted by reason of prejudice to those data subjects' rights, freedoms and legitimate interests.

39.Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the signatories of the petition, the Commissioner must also conclude that disclosure would be unfair.As condition 6 cannot be met in this case, he would also regard disclosure as unlawful.In all the circumstances, therefore, he finds that disclosure would breach the first data protection principle and that the information was therefore properly withheld by the Council under section 38(1)(b) of FOISA.

DECISION

The Commissioner finds that Fife Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr McLeod.

Appeal

Should either Mr McLeod or Fife Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
24 January 2011

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

1.The data subject has given his consent to the processing

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

[1] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2009/200801777.aspx

[2] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2010/200900461.aspx

[3] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[4] http://www.fife.gov.uk/uploadfiles/publications/c64_RepCCSCHEMEREVISED27APRIL20062.doc

[5] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=3085&sID=133