Decision 018/2010 Ms Y and East Ayrshire Council
Name of complainant
Reference No: 200901769
Decision Date: 5 February 2010
Summary
Ms Y wrote to East Ayrshire Council (the Council) requesting the name of the person who made allegations against her.The Council withheld the information under sections 30(c) and 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA).The Council upheld its decision upon review.Ms Y remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the requested information was personal data, disclosure of which would breach the first data protection principle in the Data Protection Act 1998 (the DPA).He therefore found that the Council had dealt with Ms Y's request in accordance with Part 1 of FOISA by withholding the information under section 38(1)(b) of FOISA.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b) and (2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 (DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data: condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 20 June 2009, Ms Y wrote to the Council requesting the name of the person (the complainant) who made allegations against her in January 2009.
2.The Council responded on 25 June 2009.It advised Ms Y that the information she had requested was exempt from disclosure under sections 30(c) and 38(1)(b) of FOISA.
3.On 23 July 2009, Ms Y wrote to the Council requesting a review of its decision.She maintained the allegations made against her and that she had a right to know the identity of the complainant.
4.The Council replied on 26 August 2009, upholding its original decision without amendment.
5.In a letter dated September 2009, but received on 12 October 2009, Ms Y stated that she was dissatisfied with the outcome of the Council's review and applied for a decision in terms of section 47(1) of FOISA.She reiterated the reasons stated in her request for review as to why the complainant's name should be disclosed and went on to comment that it was unfair that her rights were given less protection than the person making the complaint.
6.The application was validated by establishing that Ms Y had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 10 November 2009, the Council was notified in writing that an application had been received from Ms Y and was asked to provide the Commissioner with any information withheld from her.The Council responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
9.During the course of the investigation, the investigating officer also invited and obtained Ms Y's comments on the public interest in disclosure of the information and her own legitimate interests in disclosure to assist the Commissioner's consideration of the exemptions in section 30(c) and 38(1)(b) of FOISA respectively.
Commissioner's analysis and findings
10.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Ms Y and the Council and is satisfied that no matter of relevance has been overlooked.
Personal data ? section 38(1)(b) of FOISA
11.The Council has withheld the complainant's name under section 38(1)(b) of FOISA, arguing that it is personal data which, if disclosed, would contravene the first data protection principle.
12.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, (b)) exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
Is the information personal data?
13.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
14.The Commissioner accepts that the name of the complainant enables identification of a living individual, and relates to that individual, by confirming their involvement in the complaint.He is therefore satisfied that this information is the complainant's personal data.
15.The Commissioner must consider whether disclosure of this personal data would contravene the first data protection principle, as argued by the Council.
Would disclosure contravene the first data protection principle?
16.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
17.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and he is satisfied that the personal data in this case does not fall into this category.It is therefore not necessary to consider the conditions in Schedule 3 of the DPA in this case.
18.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked.For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
19.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of the complainant's name would be fair and lawful.
Can any of the conditions in Schedule 2 of the DPA be met?
20.The Commissioner considers that only condition 6(1) of Schedule 2 of the DPA might be considered to apply in this case.Condition 6(1) allows personal data to be processed (in this case, disclosed into the public domain in response to Ms Y's information request) if disclosure of the data is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
21.The Council submitted that condition 6(1) of Schedule 2 of the DPA could not be met in this case.It argued that, although Ms Y may have a legitimate interest in the information, the release of the information would be unwarranted as it would prejudice the rights of the data subject to privacy.
22.There are a number of tests which must be met before condition 6(1) can apply:
Does Ms Y have a legitimate interest in being given this personal data?
If so, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject (in this case, the complainant)?
Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?This will involve a balancing exercise between the legitimate interests of Ms Y and those of the complainant.Only if the legitimate interests of Ms Y outweigh those of the complainant can the personal data be disclosed.
Is there a legitimate interest?
23.Ms Y was invited to provide her reasons for requiring the information to inform the Commissioner's consideration of condition 6(1).Ms Y maintained that she had the right to know whom was making unsubstantiated malicious allegations about her to the Council, especially as those allegations resulted in her house and herself being kept under surveillance and did not result in any of those allegations being substantiated by the Council.
24.The Commissioner accepts that Ms Y's personal interest in the information is sufficient to show she has a "legitimate interest" in obtaining it, given that the information relates to a complaint made about Ms Y.
Is disclosure of the information necessary to achieve those legitimate interests?
25.The Commissioner has also considered whether disclosure of the information was necessary to achieve Ms Y's legitimate aims, and concluded that it is.Ms Y's interest could not be met through any means other than by access to the name of the complainant.,
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subject?
26.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject (the complainant).As noted above, this involves a balancing exercise between the legitimate interests of Ms Y and the individual in question.Only if the legitimate interests of Ms Y outweigh those of the individual in question can the information be disclosed without breaching the first data protection principle.
27.In the Commissioner's briefing on section 38 of FOISA[1], the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise.These include:
a.whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances).
b.the potential harm or distress that may be caused by the disclosure.
c.whether the individual has objected to the disclosure
d.the reasonable expectations of the individuals as to whether the information would be disclosed.
28.As stated above the Council concluded that disclosure of the information would be unwarranted as it would prejudice the rights of the data subject to privacy.
29.The Council has noted that the complainer did not complain directly to Ms Y, but chose instead to complain directly to the Council and submitted that disclosing the name would cause unnecessary distress to the complainant.Should their identity be released, the Council suggested that the complainant might fear violence, abuse, bullying or intimidation. The Council also referred to previous decisions issued by the Commissioner, in particular Decision 090/2009 Mr K Stahly and Fife Council and Decision 088/2008 Mr W H Mullin and the Fisheries Research Service in which the Commissioner upheld the authority's decision to withhold information regarding the identities of complainants.
30.The Commissioner has noted the fact that the complainant did not speak directly to Ms Y and instead reported the matter directly to the Council.As commented in previous decisions the Commissioner accepts that a person submitting a complaint of this nature to the Council would do so with the expectation that it would be treated confidentially.He also accepts that disclosure of the complainant's name into the public domain (which would be the effect of a disclosure under FOISA) would constitute an intrusion into the private life of that person.
31.Having read Ms Y's submissions the Commissioner considers it likely that if the complainant's name was disclosed then Ms Y would make unwanted contact with the complainant on the subject of their complaint.
32.Having balanced the legitimate interests of the data subject against the legitimate interests identified by Ms Y, and taking account of the complainant's expectation of privacy, the Commissioner has found that disclosure would be unwarranted in this case.Accordingly, the Commissioner is satisfied that condition 6 of Schedule 2 of the DPA is not met in relation to the information under consideration in this case.
33.For the same reasons, the Commissioner has concluded that disclosure would be unfair and, in breaching the first data protection principle, unlawful.Accordingly, the Commissioner finds that the Council was correct to withhold the information requested under section 38(1)(b) of FOISA.
34.As the Commissioner has upheld the withholding of the complainant's name under section 38(1)(b) he is not required to go onto consider whether section 30(c) additionally cited by the Council should be upheld.
DECISION
The Commissioner finds that East Ayrshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 by withholding the name of the complainer requested by Ms Y under section 38(1)(b) of FOISA.
Appeal
Should either Ms Y or the Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
05 February 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
(?)
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b)in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=3085&sID=133
