Decision 021/2017: Mr X and the Scottish Legal Aid Board Communications concerning legal aid applications Reference No: 201600759 Decision Date: 10 February 2017 Summary The Scottish Legal Aid Board was asked for communications objecting to or enquiring about legal aid applications made by a named person. The Commissioner found that SLAB's initial interpretation of the request was too narrow. However, she was satisfied that, by the end of the investigation, SLAB had identified all of the information falling within the scope of the request and, with the exception of one name, had disclosed all of the information it was required to disclose.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 15(1) (Duty to provide advice and assistance); 38(1)(b), (2)(a)(i) and (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 6 January 2016, Mr X made a request for information to the Scottish Legal Aid Board (SLAB). The information requested was:

All and any information held relative to general or specific letters, emails, or other logged communications objecting to or enquiring about any applications on my behalf for legal aid (including advice & assistance), other than formal objections by parties which have already been disclosed, such communications having been logged, accessed electronically or responded to since 1 January 2014.

2. SLAB responded on 8 February 2016. It provided Mr X with information about representations made about his civil legal aid applications. SLAB told Mr X that it did not hold any relevant information regarding his advice and assistance applications. It explained this was because details of advice and assistance applications were not intimated to opponents, so SLAB did not receive any representations, etc. about these applications.

3. On 16 March 2016, Mr X wrote to SLAB requesting a review of its decision. He believed SLAB had interpreted his request too narrowly: his request was wider than objections from opponents and included any communications, whether about a specific case or about the generality of availability of legal aid (including advice and assistance) to him. This would include communications and enquiries from third parties such as journalists and elected representatives.

4. Mr X was also unhappy that SLAB had omitted to inform him of his rights to apply to the Commissioner and to appeal to the Court of Session.

5. SLAB notified Mr X of the outcome of its review on 11 April 2016. It told Mr X it had not received representations about any of his applications for civil legal aid or advice and assistance from any of the third parties identified in his requirement for review. It had, however, received enquiries from journalists about costs incurred in respect of his grants of legal assistance. SLAB provided Mr X with a table summarising this information.

6. SLAB also apologised for not informing Mr X of his appeal rights when responding to his initial request.

7. On 27 April 2016, Mr X wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr X was dissatisfied with the outcome of SLAB's review response. He believed SLAB:

(i) had provided him with misleading information about the nature of the communications it had received. In doing this, it had failed to provide him with advice and assistance under section 15 of FOISA.

(ii) had withheld information falling within the scope of his request, without applying an exemption under FOISA.

Investigation

8. The application was accepted as valid. The Commissioner confirmed that Mr X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

9. On 27 May 2016, SLAB was notified in writing that Mr X had made a valid application and the case was then allocated to an investigating officer.

10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. SLAB was invited to comment on this application, in particular on how it had interpreted the request and on the searches it had carried out in order to identify and locate the information it held.

11. SLAB was informed that the Commissioner considered that enquiries from journalists (of the type described in the table disclosed to Mr X) would fall within the scope of Mr X' request.

12. SLAB provided additional information about the enquiries from journalists to the Commissioner. The Commissioner asked SLAB to consider whether it would be willing to disclose this information (in full, rather than in summary) to Mr X. SLAB subsequently disclosed the information to Mr X, with some personal data redacted under section 38(1)(b) of FOISA.

13. SLAB was also invited to comment on points raised by Mr X concerning the information provided to him. It was asked to carry out further searches, to confirm that all information falling within the scope of the request had been located.

14. On receipt of the redacted communications from SLAB, Mr X stated that he did not agree that the personal data redactions were justified. Both SLAB and Mr X provided comments on the application of section 38(1)(b) of FOISA and these are addressed below.

Commissioner's analysis and findings

15. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr X and SLAB. She is satisfied that no matter of relevance has been overlooked.

Information falling within the scope of the request

16. During the Commissioner's investigation, SLAB explained that it had interpreted Mr X' request as covering only enquiries sent to it during the course of his applications for legal aid and advice and assistance (as opposed to any received after a decision had been made and communicated). Therefore, when responding to his request, SLAB had only considered enquiries or representations made from "interested parties". SLAB did not interpret the request as covering enquiries from, for example, journalists or MPs, or about costs involved in Mr X' applications, or any FOI requests made about the subject, because the enquiries were "neither an objection nor an enquiry about his application".

17. During the investigation, SLAB accepted that the scope of Mr X' request was wider and carried out further searches to ascertain whether it held any additional information. SLAB subsequently provided Mr X with a copy of the information it held in respect of the wider interpretation of his request, again with some personal data redacted.

Searches carried out by SLAB

18. Initially, SLAB carried out searches of its shared drive using Mr X' full name. A member of staff's email account was also searched using the terms "FOI" and Mr X' surname.

19. The Commissioner was concerned that these searches might not be sufficient to identify the information falling within the scope of the request and asked SLAB to carry out further searches.

20. SLAB's Information Systems Department subsequently carried out searches of all of the network drives for files containing Mr X' name. All of the applications records for Mr X held on SLAB's case management system for civil legal aid and advice and assistance were also searched.

21. Full email searches were also carried out using Mr X' surname in the emails of all staff dealing with civil legal aid applications, advice and assistance applications, media enquiries, complaints about applications and correspondence from parliamentarians.

22. SLAB submitted that no information, other than the information already disclosed, was found relating to any communications about objections/enquiries about his legal aid applications and/or advice and assistance applications.

23. Having considered all relevant submissions and the terms of the request, the Commissioner accepts that by the close of the investigation SLAB had carried out adequate, proportionate searches to ascertain whether it held any relevant information. She is satisfied that these searches were focused on a proper interpretation of the request and that all of the information located falling within the scope of the request, other than that redacted under section 38(1)(b) of FOISA, had been provided to Mr X by the end of the investigation.

24. In the circumstances, the Commissioner must find that SLAB breached the requirements of section 1(1) of FOISA in responding to Mr X' request, by failing to disclose all the information it held and which fell within the scope of the request until after her investigation had begun. It is disappointing that it took an investigation by the Commissioner to prompt SLAB into making full and adequate searches.

25. When the communications were disclosed to Mr X, SLAB redacted some personal data from the communications. The Commissioner will now consider whether SLAB was correct to do this.

Section 38(1)(b) of FOISA - personal data

26. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

27. In order to rely on this exemption, SLAB must show, firstly, that any such information is personal data for the purposes of the DPA and, secondly, that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1. In this case, SLAB submitted that disclosure would breach the first data protection principle.

Is the information personal data?

28. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

29. SLAB stated that the withheld information, which consisted of the names and contact details of junior members of its staff and of third party individuals/journalists, related to living individuals who could be identified from it.

30. Having considered the information in question, the Commissioner accepts that it concerns named individuals and the information sought is of such a nature that it must relate to them. Individuals can clearly be identified from the information. The withheld information is therefore personal data.

Redaction error

31. The Commissioner notes that SLAB redacted the name of a journalist in one of the emails disclosed to Mr X, apparently in error. The journalist's name, where redacted, is likely to be clear to Mr X from other information available to him as the name appears unredacted in several other places. For the avoidance of doubt, the Commissioner requires SLAB to disclose to Mr X a further copy of the email in question with the name of the journalist reinstated: specifically, the email dated 17 September 2015 [15:17].

Would disclosure contravene the first data protection principle?

32. SLAB submitted that disclosure of the withheld information would contravene the first data protection principle.

33. The first data protection principle states that personal data shall be processed fairly and lawfully. ("Processing" here means disclosing personal data into the public domain in response to Mr X' request.) The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, as defined in section 2 of the DPA, at least one of the conditions in schedule 3 to the DPA must also be met. Having considered the content of the information, the Commissioner agrees with SLAB that it does not fall into any of the categories of sensitive personal data in section 2 of the DPA.

34. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the requested information to be disclosed. If any of these conditions could be met, she must then consider whether such disclosure would be fair and lawful.

35. There are three separate aspects to the first data protection principle:

(i) fairness

(ii) lawfulness and

(iii) the conditions in the schedules.

36. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits disclosure, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

37. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the information. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (the individuals to whom the data relate).

38. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr X pursuing a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for Mr X' legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

39. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr X must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit disclosure. If the two are evenly balanced, the Commissioner must find that SLAB would be able to refuse to disclose the requested information to Mr X.

Is Mr X pursuing a legitimate interest or interests?

40. SLAB took the view that Mr X did not have a legitimate interest in the information as it would not materially add anything to the information already disclosed to him.

41. Mr X submitted that, what he assumed to be the "interests and purposes" of a particular journalist's enquiry, had been redacted from one of the emails. He felt that such information should be disclosed. He also commented that SLAB had, in the course of its correspondence with him, already erroneously disclosed the email address of a particular journalist.

42. He stated that there appeared to be an air of informality in the exchanges between SLAB and one of the journalists, along with a quickness of responding on the part of SLAB to the journalist.

43. Mr X submitted that, to the extent that SLAB was a data controller for the purposes of the DPA, he was entitled to know about the manner in which it was processing his personal data. He submitted that he had an interest in knowing in what manner junior or other SLAB employees were processing his personal data, to the extent that there could be an issue with an individual employee acting outwith SLAB's policy.

44. Having considered the submissions from both parties, along with the redacted information, the Commissioner is satisfied that Mr X has a legitimate interest in seeking to establish whether SLAB has been processing his personal data appropriately and whether SLAB is, as Mr X has suggested, "applying an undisclosed policy in its treatment of civil applications" made on his behalf.

Is disclosure of the information necessary for Mr X' legitimate interests?

45. Having established that Mr X does have a legitimate interest in the information, the Commissioner must now go on to consider whether disclosure is necessary for the purposes of that legitimate interest. She must consider whether disclosure is proportionate as a means and fairly balanced as to ends, or whether these legitimate aims could be achieved by alternative means which would interfere less with the privacy of the individual(s) in question.

46. The Commissioner is not satisfied that the disclosure of the following information is necessary for the purposes of Mr X' legitimate interest, given the information which has already been disclosed to him (this includes the names and contact details of senior employees of SLAB and the names of the journalists):

(i) the direct telephone and email contact details of the individuals concerned (i.e. the journalists and junior employees of SLAB)

(ii) the information which Mr X incorrectly assumes refers to the "interests and purposes" of the journalist in question.

47. However, the Commissioner considers that disclosure of the names of junior SLAB staff (as opposed to their direct contact details) is necessary for the purposes of Mr X' legitimate interests, as disclosure would help ascertain whether the information provided to journalists came from employees who were potentially acting outwith SLAB policy.

Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

48. The Commissioner will now consider whether disclosure of the names of SLAB staff would nevertheless cause unwarranted prejudice to their rights and freedoms or legitimate interests. This involves a balancing exercise between the legitimate interests of Mr X and those of the individuals concerned. Only if the legitimate interests of Mr X outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

49. In the Commissioner's briefing on personal information[1], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

(i) whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

(ii) the potential harm or distress that may be caused by disclosure

(iii) whether the individual objected to the disclosure

(iv) the reasonable expectations of the individual as to whether the information should be disclosed.

50. SLAB commented that its junior employees expect it to protect their privacy. It had not contacted its staff members to ask if they would consent to disclosure, because they were satisfied that disclosure would cause fear and distress.

51. The Commissioner notes that the staff in question are junior members of staff who would not expect their names to normally be disclosed into the public domain in this way. She is satisfied, in the circumstances, that disclosure of the information is likely to cause distress to these data subjects.

52. Having considered the competing interests in this particular case, the Commissioner finds that Mr X' legitimate interests are outweighed by the prejudice to the rights, freedoms and legitimate interests of the individuals concerned that would result from disclosure of the information. On balance, therefore, she must find that the requirements of condition 6 cannot be met in relation to this information.

53. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit the personal data to be disclosed. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the personal data would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.

Section 15(1) of FOISA - advice and assistance

54. Section 15(1) of FOISA requires a public authority, so far as it is reasonable to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

55. Mr X considered that SLAB had provided him with misleading information about the nature of the communications it had received and, in doing this, had failed to provide him with reasonable advice and assistance under section 15 of FOISA.

56. The Commissioner must conclude that SLAB was, in the first instance, incorrect to assume that the scope of the request only covered interested parties attempting to influence SLAB's decisions on legal aid. Although there is nothing to suggest that there was any ill intent behind SLAB's interpretation, it is difficult to understand why, on the basis of the submissions made, this approach was taken.

57. It was Mr X' belief that that this amounted to a breach of section 15(1) of FOISA. However, as this was rectified in SLAB's review response to Mr X, the Commissioner cannot find a breach of FOISA in this respect.

58. The Commissioner strongly encourages SLAB to review its procedures to ensure appropriate care is taken to interpret information requests objectively and that officers are adequately trained to apply these procedures, enabling SLAB to respond properly to requests.

Decision The Commissioner finds that the Scottish Legal Aid Board (SLAB) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr X. She finds that SLAB initially interpreted Mr X' request too narrowly. This led to SLAB failing to disclose all of the (non-exempt) information it held until after the Commissioner's investigation had begun and to SLAB breaching section 1(1) of FOISA. The Commissioner finds that SLAB was, with the exception of one name, correct to withhold personal data under section 38(1)(b) of FOISA. The Commissioner requires SLAB to disclose a copy of the email from which the name was redacted (see paragraph 31), with the name reinstated.

Appeal

Should either Mr X or SLAB wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner

10 February 2017

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

15 Duty to provide advice and assistance

(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for the purposes of the first principle: processing of any personal data

…

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---