Decision 019/2016: Ms Laura Twaddell and South Ayrshire Council Referees for grants Reference No: 201501656 Decision Date: 1 February 2016 Summary On 14 May 2015, Ms Twaddell asked South Ayrshire Council (the Council) for monitoring and evaluation information relating to an Ambition for Social Enterprise Strategic Development Grant made to a specific Community Interest Company. The Council disclosed some information, told Ms Twaddell it did not hold other information and withheld personal information and bank statements. Following a review, Ms Twaddell remained dissatisfied and applied to the Commissioner for a decision. The Commissioner accepted that the Council was entitled to withhold the personal data but found that it should have provided other information to Ms Twaddell (which it did during the investigation). The Commissioner accepted that the Council identified all information that fell within Ms Twaddell's request in respect of the references and referees associated with the grant application. The Commissioner did not require the Council to take any action.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 14 May 2015, Ms Twaddell made a request[1] for information to the Council. She asked for all monitoring and evaluation information relating to a specific Ambition for Social Enterprise Strategic Development Grant made to a specific Community Interest Company (CIC). Ms Twaddell also asked for the business plan submitted by the CIC in support of this grant.

2. The Council responded on 12 June 2015 and disclosed some information including an application form, volunteering policy, Annual Report, two operational statements (2014 and 2015) and a copy Funding Statement. The Council explained that the application form contained the information that would normally be in a business plan, but that it did not hold a business plan as such. It withheld personal information in the application form, considering that disclosure would amount to unfair processing of personal data, in contravention of the first data protection principle of the DPA (and therefore exempt under section 38(1)(b) of FOISA). The Council also withheld bank statements, supplied to support the application, under section 36(2) of FOISA, arguing that disclosure of this information would constitute an actionable breach of confidence.

3. On 13 June 2015, Ms Twaddell wrote to the Council requesting a review of its decision because she believed that it should hold a business plan. Ms Twaddell cited a previous FOI response from the Council, which seemed to show a business plan had been received on 22 January 2014.

4. Ms Twaddell also said that none of the information provided to her by the Council contained anything related to monitoring and evaluation. She supplied a document that referred to a monitoring procedure for the grant. Given that monitoring was a condition of the grant, she believed monitoring information should be held by the Council. Similarly, an evaluation report was stated as a condition of the grant. Ms Twaddell also asked if details of two referees were supplied by the applicant (as requested in the application form), and whether references were checked and evaluated.

5. On 15 June 2015, the Council acknowledged receipt of Ms Twaddell's review. It summarised her reasons for dissatisfaction and the information she sought.

6. The Council notified Ms Twaddell of the outcome of its review on 10 July 2015. On the question of whether the Council held a business plan, the Council confirmed that the information supplied within the application form constituted all the information that would normally be in a business plan for this type of enterprise, with the exception of the volunteer policy. It acknowledged that the standard checklist it used for applications may have caused some confusion about the information it held, and confirmed that it did not hold a business plan.

7. The Council said it had examined the evaluation process for the funding provided. The Council explained it had agreed with the applicant that the monitoring and evaluation would be in the form of an Annual Report. The discussions and agreement were verbal and the evaluation paper work referred to in the Checklist was not issued and therefore not received. The Annual Report had been disclosed to Ms Twaddell previously. The Council was satisfied that the only monitoring and evaluation information held by the Council was the Annual Report, which has been supplied.

8. Ms Twaddell had clarified that she also wanted information that showed how the CIC had managed, recruited, trained and assessed its staff, not information that showed how the CIC intended or planned to do this. Ms Twaddell said that the money was given by the Council to the CIC to employ staff and recruit and train volunteers, and she therefore asked what information the Council held to show that the grant money was spent correctly.

9. Ms Twaddell had also asked for invoices (and accounts) held by the Council from the CIC that showed any monitoring of the spending of the Grant funds awarded. In respect of these points, the Council responded that this information was not required by the Council beyond the information supplied in the CIC's Annual Report and gave notice, in terms of section 17 of FOISA, that it did not hold the information.

10. Finally, in respect of information on the checks and evaluations that were undertaken for the referees that supported the initial grant application, the Council explained that references were sought and were found to be satisfactory. As noted, the information was withheld under section 38(1)(b) of FOISA. The Council commented that, at the same time references were sought, the Council was also "talking about the project with elected members and community councillors who had received positive feedback and support for the idea from many quarters". The Council stated that these were verbal discussions.

11. On 6 September 2015, Ms Twaddell applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Ms Twaddell stated that she was dissatisfied with the outcome of the Council's review because she had previously received information about referees from the Council and she did not think such information was exempt.

Investigation

12. The application was accepted as valid. The Commissioner confirmed that Ms Twaddell made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

13. On 7 October 2015, the Council was notified in writing that Ms Twaddell had made a valid application. The Council was asked to send the Commissioner the information withheld from her. The Council provided the information and the case was allocated to an investigating officer.

14. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

15. During the investigation (on 17 November 2015) the Council provided Ms Twaddell with information from internal emails about the referees, but continued to withhold their names and contact details under section 38(1)(b) of FOISA. The Council explained to Ms Twaddell that although the referees were contacted by the Council, there was no written record of the contact, nor were written references provided by the referees.

16. Ms Twaddell acknowledged receipt of this information, but stated that she would like to Commissioner to continue with her investigation. Ms Twaddell also commented that she thought it unlikely or unusual that there would be no recording of these referees having been contacted by the Council and found to be satisfactory. She thought that the Council "normally has robust processes for these things". Ms Twaddell thought it in the public interest to know who, or which organisations, provided references to ensure that the referees did not benefit directly or indirectly from the grant funding awarded.

Commissioner's analysis and findings

17. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Ms Twaddell and the Council. She is satisfied that no matter of relevance has been overlooked.

18. Ms Twaddell requested all monitoring and evaluation information relating to a specific grant. At review, Ms Twaddell asked if the information showing the two referees requested in the application form were supplied by the applicant and that they were checked and evaluated.

19. The Commissioner is of the view that any information held by the Council about the referees would fall within Ms Twaddell's request in relation to monitoring and evaluation information for the grant.

Information held by the Council

20. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received. This is subject to qualifications, but these are not applicable in this case. If no such information is held by the authority, section 17(1) of FOISA requires it to give the requester notice in writing to that effect.

21. The Council explained that both referees were contacted by the Council to provide verbal references, both of which were deemed to be satisfactory by the Council. The Council stated that it does not hold a written note of the verbal reference, nor were written references provided to the Council. The Council acknowledged that this was not fully clarified to Ms Twaddell in its review response; it contacted her on 17 November 2015 to put this right.

22. The Council was asked by the investigating officer if there was any record of telephone calls being made to referees (e.g. a note that a call was made to each referee). The Council confirmed that it does not hold such telephone notes. It commented that the Council staff who administer the AMBITION Grants deal with a range of community groups on a range of issues across South Ayrshire, but they do not routinely log or take detailed notes of all telephone calls or verbal references.

23. The Council submitted that it had made considerable efforts to locate the information requested by Ms Twaddell, including searches covering emails, paper copies, scoring sheets and application forms. The Council provided a list of the key words it had used in these searches. It had made enquiries which established that references were obtained through telephone calls.

24. The Council was asked if there was any legal or good practice requirement on it to hold recorded information that verified the references. The Council commented that "proceeding with verbal references is reasonable where contracts are of low value" and stated that Ms Twaddell was correct in assuming that the Council has robust processes to ensure accountability for its actions. The Council commented that if Ms Twaddell is concerned about its processes for scrutinising grant awards there is a complaints procedure through which she can express her concerns.

25. The Commissioner has noted the searches undertaken by the Council and its staff and is satisfied that they were reasonable and proportionate and likely to have identified any information which the Council held and which was covered by the terms of the request.

26. Having considered all the above submissions, the Commissioner is satisfied that the Council does not hold any recorded information in respect of the two referees, or other information falling within the scope of Ms Twaddell's request, other than the information supplied to her on 17 November 2015 and the information withheld under section 38(1)(b) of FOISA (which the Commissioner will consider fully below).

27. The Commissioner accepts that the Council gave Ms Twaddell notice that it did not hold some information which she expected to be covered by her request. In doing so, it complied with section 17(1) of FOISA.

28. As stated in previous decisions, the Commissioner has no remit in terms of FOISA to decide what recorded information should be held by an authority (in this case, references relating to the grant application). However, there may be occasions where it is relevant for the Commissioner as part of her investigation to enquire as to what information should, or would normally, be held by a public authority (and, where applicable, why it is not held). This may be a reasonable line of enquiry in establishing whether the authority has proved, to the standard of on the balance of probabilities, that it did not hold any relevant recorded information at the time of the request.

Section 38(1)(b) of FOISA - Personal data

29. The Council withheld the names, addresses and other contact details of two referees under the exemption in section 38(1)(b) of FOISA.

Is the information personal data?

30. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

31. The Commissioner is satisfied that the withheld information is personal data. The respective names and addresses would allow identification of the referees (the data subjects) and the information clearly relates to them.

Would disclosure contravene the first data protection principle?

32. The Council submitted that disclosure would breach the first data protection principle and that it has a duty, under the DPA, to ensure that it processes the personal data it holds in a fair and lawful manner. This includes not using data in ways that would have an adverse effect on the individuals concerned and using their personal data only in ways that the individuals would reasonably expect.

33. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The Commissioner is satisfied that the withheld information does not fall into any of the categories of sensitive personal data in section 2 of the DPA.

34. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject. The processing under consideration in this case would be the disclosure of the personal data into the public domain, in response to Ms Twaddell's information request.

35. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits disclosure, it is likely that disclosure will also be fair and lawful.

36. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the requested information to be disclosed. If any of these conditions can be met, she must then consider whether such disclosure would be fair and lawful.

Can any of the conditions in Schedule 2 be met?

37. Condition 1 applies when the data subject (i.e. the individual to whom the data relate) has consented to the release of the information. The Council explained that it had considered contacting the referees to seek their consent for their personal data to be disclosed, but had concerns about doing this.

38. The Commissioner accepts that consent has not been given by the data subjects in this case, and had not been given at the time of the request or the Council's review, and therefore condition 1 in Schedule 2 cannot be met.

39. The Commissioner's view is that condition 6 in Schedule 2 is the only one which might permit disclosure to Ms Twaddell's request. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

40. There are a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Does Ms Twaddell have a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Ms Twaddell's legitimate interests, is the processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

41. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Ms Twaddell must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit disclosure. If the two are evenly balanced, the Commissioner must find that the Council would be able to refuse to disclose the information to Ms Twaddell.

42. Ms Twaddell supplied information to the Commissioner that she had obtained from the Council's response to a previous request, which had indicated the position or role held by a referee (e.g. office holder or member of a Community Council). Ms Twaddell suggested that this disclosure would suggest that the information at issue in the present application should also be disclosed, or the position of the Council would be inconsistent.

43. The Council commented that it responds to information requests according to the facts and circumstances and that it does not adopt a uniform response for requests that may on the face of it appear to be similar in nature. The Council did not comment further on Ms Twaddell's point.

44. The Commissioner agrees that each case has to be considered on its own merits. She also notes that the information disclosed in the previous response is not the same as the information being withheld in this case. The information previously disclosed came from an application form which asked for more information about the referees: for example, their job title (if applicable) and how they knew about the organisation applying for the grant. None of the recorded information covered by Ms Twaddell's present application indicates the referees' occupation, position, role or membership of a group. The withheld information is simply the name, address and other contact details of each referee.

Is Ms Twaddell pursuing a legitimate interest or interests?

45. Ms Twaddell submitted that disclosure of the information was in the public interest for reasons of transparency and accountability, and in particular to ensure that referees did not benefit directly or indirectly from the grant funding awarded.

46. The Council argued that Ms Twaddell has no legitimate interest in the information. It believes it has already met the public interest in regard to the integrity of those references by satisfying itself with the information supplied by the referees. It believed Ms Twaddell was proposing to cross check these references "to establish whether they meet her own standard of integrity". The Council did not consider that disclosing the information for this purpose would serve the public interest, "not least because Ms Twaddell is not better placed to look behind these references to determine an absence of good faith".

47. The Council distinguished between the public interest and the specific interest of a member of the public who is looking to further a personal agenda. It noted that Ms Twaddell has alluded to the possibility of malfeasance, but had not provided any evidence in support of this. The Council thought it reasonable to conclude not only that Ms Twaddell has no legitimate interest in obtaining the personal data, but that disclosure of the information was likely to prejudice the rights and freedoms of the referees.

48. The Commissioner takes a different view, and considers that Ms Twaddell (and the public) does have a legitimate interest in the identities of the referees supporting a bid for public funding, particularly if this information would reveal a referee's relationship with the organisation bidding for the money. Such information increases transparency and accountability in relation to public spending. Ms Twaddell has shown that she has a personal interest, as someone who has views about the putting green and in raising concerns about the grant process.

Is the processing necessary for the purposes of these interests?

49. Again the Council questioned this. The Council's arguments were similar to those outlined above: i.e. that there was no evidence of malfeasance that required further scrutiny and that Ms Twaddell would not be able to provide greater scrutiny if she received information identifying the referees.

50. The Commissioner can identify no other viable means of meeting Ms Twaddell's legitimate interests which would interfere less with the privacy of the data subjects than providing the information requested. The withheld information is limited to the referees' names and personal contact details: no information about their status or relationship to the CIC was recorded. Therefore the only way for Ms Twaddell to satisfy herself that references were obtained, or to establish whether the referees had any relationship or connection with the CIC, is for the Council to provide the personal details of the referees. It may be that Ms Twaddell's standards in assessing this would not be exactly the same as the Council. That does not matter. The information would allow Ms Twaddell (and the public at large) to be reassured that a robust process has been followed by a public authority in relation to public spending.

51. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Ms Twaddell's legitimate interests.

Would disclosure be unwarranted by reason of prejudice to the legitimate interests of the data subjects?

52. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Ms Twaddell's legitimate interests, she must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Ms Twaddell and those of the data subjects. Only if the legitimate interests of Ms Twaddell outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

53. In the Commissioner's briefing on personal information[3], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

(ii) the potential harm or distress that may be caused by disclosure

(iii) whether the individual objected to the disclosure

(iv) the reasonable expectations of the individual as to whether the information should be disclosed.

54. The Council submitted that the data subjects would have no reasonable expectation that their personal data, supplied for the purposes of a reference, would be disclosed. The referees had accepted scrutiny to the level demanded by the Council and had not agreed to be presented to the wider public for additional scrutiny of their honesty and integrity. The Council highlighted that the personal data belongs to members of relatively small community.

55. The Council had concerns that disclosure may make others reluctant to supply references or act as referees in support of local community organisations where those organisations are engaged in activities that are not approved of by other members of the community.

56. The Commissioner accepts that the data subjects would not expect their names and contact details to be disclosed to the public unless it had previously been made clear that this was a possibility when they agreed to provide references for the CIC. The email seeking the referees' details (which has been supplied to Ms Twaddell in redacted form) shows clearly that such information was intended for Council use only, creating an expectation against disclosure outwith the Council.

57. In the circumstances, the Commissioner accepts that disclosure would have the potential to cause distress. That is, she accepts that there may be the potential for disfavour from some members of a local community towards those giving references.

58. Having considered the competing interests in this particular case, the Commissioner finds that Ms Twaddell's legitimate interests are outweighed by the prejudice to the rights and freedoms of the data subjects (i.e. the referees) that would result from disclosure. While disclosure would increase transparency and public accountability in relation to the grant awarding process, the information of itself does not reveal anything about the referees' relationship to the CIC. On balance, the Commissioner finds that the requirements of condition 6 cannot be met here.

59. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) by the Council under section 38(1)(b) of FOISA.

Decision The Commissioner finds that South Ayrshire Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Ms Twaddell. The Commissioner finds that the Council was entitled to withhold personal data under section 38(1)(b) FOISA. However, the Council failed to comply with Part 1 (and, in particular, with section 1(1)) by withholding the information which it disclosed during the Commissioner's investigation. Given that Ms Twaddell has received the information, the Commissioner does not require the Council to take any further action in respect of this failure in response to Ms Twaddell's application.

Appeal

Should either Ms Twaddell or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

1 February 2016

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

 

1. The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---

[1] https://www.whatdotheyknow.com/request/monitoring_and_evaluation_for_am#incoming-664112

[2]

[3]