Decision 027/2011 Mr David Robertson and the City of Edinburgh Council Personal data and other information relating to investigation of complaint Reference No: 201001455 Decision Date: 14 February 2011

Summary

Mr Robertson requested from the City of Edinburgh Council (the Council) the names of certain employees referred to in the report on the investigation of a complaint, and evidence used by an employee to justify altering a pre-inspection report sent to Her Majesty's Inspectorate of Education (HMIE).The Council responded by withholding the information requested as the personal data of the individuals concerned, the disclosure of which would contravene the data protection principles.A review upheld the initial response, claiming in addition that one officer's name should be withheld as its disclosure would substantially inhibit the free and frank exchange of views.It also confirmed that the information on the pre-inspection report was not held.Following the review, Mr Robertson remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Council had been correct to withhold information under section 30(b)(ii) of FOISA (which relates to substantial inhibition to the free and frank exchange of views) and as personal data the disclosure of which would contravene the first data protection principle (section 38(1)(b)), and also in claiming that it did not hold other information.Consequently, he did not require the Council to take any action.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 30(b)(ii) (Prejudice to effective conduct of public affairs) and 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles - the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.

Background

1.On 27 May 2010, Mr Robertson wrote to the Council requesting the following information, with reference to the report on the investigation of a complaint:

the name of the "Head of Service" mentioned in paragraph 8 who regularly made changes to pre-inspection reports before sending them on to HMIE (request 1);

the name of the current member of staff who advised the investigating officer of this practice (request 2); and

the additional evidence that was used by the "Head of Service" to justify altering the pre-inspection report.

2.The Council responded on 8 June 2010 and explained that it was not its normal practice to release the names of officers, or their views or opinions, in response to a request of this kind.It submitted that the individuals in question would have a legitimate expectation that their views and opinions would be treated in confidence.The Council referred to sections 1(1) and 7(4) of the DPA and stated that it was not required to release personal data to a third party without the consent of the individuals involved.It did not believe there to be any lack of transparency or openness in the process involved in the preparation of the report and therefore saw no public interest in releasing information that could compromise the integrity of the Council's position on enforcing compliance with the DPA across all its functions.

3.On 11 June 2010, Mr Robertson wrote to the Council requesting a review of its decision.He drew the Council's attention to a discrepancy in the two copies of the pre-inspection report for a named primary school, stating that he believed it important in the circumstances to establish the identities of the members of staff referred to in his requests.He did not believe it acceptable under FOISA for senior Council officials to have anonymity in such matters, or for anecdotal information from an unidentified employee to be used to support the conclusions of an independent investigation.

4.The Council notified Mr Robertson of the outcome of its review on 13 July 2010.Confirming that it held the names of the individuals referred to in requests 1 and 2, it advised him that it considered this information to be exempt from release under section 38(2)(a)(i) of FOISA: it considered the information to be personal data, the release of which would contravene principles 1, 2 and 6 of the DPA.The Council considered it crucial that, when required to participate in an investigation of this kind, individuals were confident that their legitimate expectation of personal anonymity would be safeguarded.Therefore, the Council also relied on section 30(b)(ii) of FOISA to withhold the name referred to in request 2, on the basis that disclosure would be likely to inhibit future exchanges of views in similar circumstances.The Council considered sufficient transparency to have been provided, as Mr Robertson was aware of the process followed and the senior position of the individual to whom request 1 related.

5.The Council also acknowledged that request 3 had not been adequately addressed in its initial response.It explained that the vetting and finalising of the pre-inspection report had been informed by the experiential knowledge of the official responsible for ensuring the accuracy and correctness of the report, and whilst there might have been documentation that informed this process, the individual had left the employment of the Council some years ago and there was now no known information held in recorded form that fell within the scope of the request

6.On 19 July 2010, Mr Robertson wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

7.The application was validated by establishing that Mr Robertson had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.The case was then allocated to an investigating officer.

Investigation

8.On 22 July 2010, the Council was notified in writing that an application had been received from Mr Robertson, as required by section 49(3)(a) of FOISA.Also, in terms of section 49(3)(a), theinvestigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application and asking it to respond to specific questions. In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.It was also asked to provide details of the steps it had taken to establish that it did not hold the information referred to in request 3.

9.It was Mr Robertson's view that a senior officer of the Council should reasonably expect that their involvement in an important part of the school inspection process would be in the public domain and that they should be able to provide evidence for any alterations they had made to a pre-inspection report.He also believed there to be to be a public interest in establishing why the pre-inspection report had been altered in the case he was interested in and who knew about it.

10.The submissions received from both Mr Robertson and the Council, insofar as relevant, will be considered full in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

11.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by both Mr Robertson and the Council and is satisfied that no matter of relevance has been overlooked.

Section 30(b)(ii) ? prejudice to effective conduct of public affairs

12.With regard to Mr Robertson's request 2, the Council sought to rely on section 30(b)(ii) of FOISA to withhold the identity of the current member of staff who had advised the investigating officer of the practice of changing pre-inspection reports.To rely on this exemption, a Scottish public authority must show that the disclosure of the information would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation.

13.In applying this exemption, the Commissioner expects authorities to demonstrate a real risk or likelihood that actual inhibition will occur at some time in the near (certainly foreseeable) future, not simply that inhibition is a remote or hypothetical possibility.The word "inhibit" suggests a suppressive effect, so that communication would be less likely, more reticent or less inclusive.The inhibition must be substantial and therefore of real and demonstrable significance.

14.The Council submitted that interviewees asked to assist with internal investigations would be substantially inhibited by disclosure.It explained that the identity of the Head of Service as the person most likely to be responsible for altering the pre-inspection Report had only been established by the investigating officer interviewing Council employees.

15.The Council argued that the open and helpful attitude of its staff in these circumstances was fostered by confidence that the Council would protect their wellbeing, and this included preserving their anonymity where considered by the Council to be necessary or appropriate.If it became known that the Council was unable to protect its employees' anonymity when their identity was requested by third parties in certain circumstances, employees would be less likely to volunteer views or to speculate upon issues not recorded: this was not, in the Council's view, to suggest that they would be less than honest, but rather that they might be discouraged from being as forthcoming as they were currently.There was generally no obligation to cooperate in internal investigations, and the loss of a culture of cooperation would inhibit future investigations of this nature.

16.As the Commissioner has said in previous decisions, it his view that the standard to be met in applying the test contained in section 30(b)(ii) is high and the chief consideration is not whether the information constitutes opinion, but whether the disclosure of the information would, or would be likely to, inhibit substantially the exchange of views. In this instance the disclosure would not be of a view, but of the fact that a view can be attributed to a named individual.

17.Each request should be considered on a case-by-case basis, taking into account the effects anticipated from the release of the particular information involved.The content of the withheld information will require to be considered, taking into account factors such as its nature, subject matter, manner of expression and whether the timing of disclosure would have any bearing: releasing advice or views whilst a decision was being considered, and for which further views were still being sought, for example, is likely to be more substantially inhibiting than once advice has been taken.In this instance, the view comprises speculation by an employee about the identity of another member of staff most likely to have made changes to a pre-inspection report.This speculation was made in the context of an investigation initiated by the Council following a complaint.

18.Although the Commissioner acknowledges Mr Robertson's arguments about seniority of position being relevant to the prospect inhibition, and that more senior persons in an organisation may (depending on the circumstances) be less likely to be inhibited, the Commissioner considers it apparent, given the nature of the view expressed and the context of the investigation in the course of which it was expressed, that it was given in the expectation that the identity of the individual expressing it would not be disclosed into the public domain.

19.The Commissioner accepts in this instance that disclosure of the information covered by request 2 would make it less likely that Council officials would engage in discussions of this type in future with the same degree of frankness and candour.He consequently accepts that disclosure of this information would, or would be likely to, inhibit the free and frank exchange of views for the purposes of deliberation.The Commissioner is of the view that the Council was entitled to consider this information exempt under section 30(b)(ii) of FOISA.

The public interest test

20.The exemption in section 30(b)(ii) of FOISA is subject to the public interest test in section 2(1)(b).Therefore, having found that the withheld information is exempt under section 30(b)(ii), the Commissioner is required to go on to consider whether the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.

21.The Council stated that it did not consider that the public interest was served by the release of the information in this case.It was of the view that Mr Robertson does not wish to challenge the methodology employed by the Council in the investigation, but only the details which did not accord with his perception of the matter.It considered the public interest to lie in protecting the identities of those it believed required anonymity.

22.In contrast, Mr Robertson believed it was in the public interest to establish why a pre-inspection report had been altered and who knew about it.He understood the person concerned to have been senior member of the Council's staff, who had known that the practice in question was commonplace.He submitted that a senior officer who knew about the altering of the pre-inspection report should reasonably expect that their identity and involvement in an administrative aspect of the inspection process would be in the public domain, noting that transparency was a key principle of the school inspection process.

23.The Commissioner has considered the submissions of both parties, and recognises that there is a genuine public interest in allowing scrutiny of the Council's actions in relation to pre-inspection reports, as part of the wider school inspection process.The Commissioner accepts that there is generally a public interest in ensuring that a public authority is adequately discharging its functions while subject to a regulatory process, and that disclosure of the information under consideration would serve the public interest by allowing scrutiny of the Council's actions in a particular case.He also accepts a public interest in transparency in relation to the conduct of the investigation to which Mr Robertson's request more directly relates.

24.However, the Commissioner also accepts the Council's submission that there is a strong public interest in cases of this kind favouring the withholding of the information.Having accepted the substantial inhibition that would, or would be likely to, result from disclosure, he acknowledges the importance of full co-operation in internal investigations of this kind and the consequent importance of protecting the anonymity of interviewees as a corollary to securing that co-operation.He also notes that Mr Robertson has been fully informed as to the findings of the investigation, albeit without identifying the individual to whom request 2 relates, even if the wider public have not.

25.Having considered all the circumstances of the case, therefore, the Commissioner has concluded that the public interest in maintaining the exemption outweighs the public interest in disclosing the information.He considers there to be greater benefit to the public interest in avoiding harm to the effectiveness of the Council's arrangements for securing its ability to investigate complaints.

26.The Commissioner therefore concludes with respect to request 2 that the Council acted in accordance with Part 1 of FOISA in withholding the information under section 30(b)(ii) of FOISA.Having reached that conclusion, the Commissioner does not find it necessary to (and therefore will not) go on to consider whether the Council was correct to withhold that information in terms of section 38(1)(b) of FOISA.

Section 38(1)(b) ? personal information

27.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)) exempts information from disclosure if it is personal data, as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

Is the information personal data?

28.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

29.Paragraph 8 of the investigation report refers to a Head of Service within the Council (who had since retired) as the officer responsible for vetting pre-inspection reports and then sending them to HMIE.The investigating officer had been advised by a current member of council staff (see request 2) that this Head of Service regularly made changes to pre-inspection reports before sending them to HMIE, to reflect their knowledge of schools and the standards applied by HMIE.Mr Robertson's request 1 was for the name of the Head of Service mentioned in paragraph 8.

30.The Commissioner is satisfied that this information is the personal data of the individual concerned: from their name they could clearly be identified, while in the context in which the information is held by the Council the Commissioner accepts that it relates to that individual.

Would disclosure breach the first data protection principle?

31.The Council has argued that the release of the information would breach the first data protection principle.

32.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing in this case would be by disclosure in response to Mr Robertson's information request.

33.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the withheld information does not fall into any of the relevant categories.It is therefore not necessary to consider the conditions in Schedule 3 in this case.

34.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

35.The Commissioner will consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.

Can any of the conditions in Schedule 2 to the DPA be met?

36.The Council submitted that it had considered the conditions in schedule 2 and did not believe that any of them were met.The Council provided more detailed comments in relation to condition 6.

37.In the circumstances, condition 6 would appear to the Commissioner to be the only condition which might permit disclosure to Mr Robertson.The Commissioner accepts that none of the other conditions in Schedule 2 would allow disclosure in this case.

38.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual to whom the data relate).

39.There are a number of different tests which must be satisfied before condition 6 can be met. These are:

Does Mr Robertson have a legitimate interest in obtaining the personal data?

If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?

Even if the processing is necessary for Mr Robertson's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Robertson must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Robertson.

Does the applicant have a legitimate interest?

40.As indicated above, Mr Robertson believed it was reasonable for him to know the identity of the Head of Service in question.He noted his personal interest in the HMIE inspectionand referred to what he understood to be HMIE's concerns in relation to the production of the pre-inspection report.He highlighted the importance of ensuring the integrity of the inspection process, of which the pre-inspection report was an integral part, and argued that a senior officer of the Council should reasonably expect their involvement in an important part of the inspection process to be in the public domain.

41.The Council submitted that Mr Robertson did not have a legitimate interest in obtaining the requested information, noting that in its view any interest he had was based on a belief which had no foundation.

42.In this case, the Commissioner has taken into account all of Mr Robertson's reasons for requiring the information.He accepts that Mr Robertson has a legitimate interest (as indeed do the wider public) in the integrity of the school inspection process.The withheld personal data relate to the Head of Service's involvement in that process and, to that extent at least, the Commissioner accepts that Mr Robertson has a legitimate interest in their disclosure.

Is disclosure of the information necessary to achieve those legitimate interests?

43.The Commissioner must now consider whether disclosure is necessary for Mr Robertson's legitimate interests.

44.In this case, while the Commissioner has acknowledged Mr Robertson's legitimate interest in the integrity of the inspection process (including that part to which the withheld personal data relate), he cannot identify how that interest might legitimately be advanced to any appreciable extent by disclosure of the withheld personal data.It is simply the name of an individual who held the relevant post at a particular time and who has since retired from the Council's employment.He accepts (see below) that no information is held by the Council as to the evidence used by that individual to justify the changes made to the pre-inspection report.

45.In any event, the Commissioner notes that in his request for a review Mr Robertson acknowledged that the individual in question had been identified to him at a meeting with the investigating officer.On any reasonable interpretation of the request, the Commissioner is of the view that the information to which request 1 applies is the name of the individual the investigating officer was referring to in paragraph 8 of his report (i.e. the person who was believed to have made the changes to the report, on the basis of the evidence obtained by the investigating officer).As indicated above, this is a Head of Service identified by reference to specific responsibilities and in the circumstances the Commissioner finds it difficult to see how there could be any scope for the Council holding different information on this point from that conveyed by the investigating officer.He would also be surprised if Mr Robertson, given his background, was not independently aware of the identity of the individual in question.

46.In all the circumstances, therefore, the Commissioner is not persuaded that disclosure of the withheld information is necessary for the purposes of Mr Robertson's legitimate interests.Consequently, condition 6 of Schedule 2 to the DPA cannot be met and it is not necessary for him to consider the rights, freedoms or legitimate interests of the data subject.As disclosure is not necessary, the Commissioner finds that it would not be fair and, in the absence of any condition permitting disclosure, he must also find that it would not be lawful.Therefore, the Commissioner must conclude that disclosure would contravene the first data protection principle and that the Council was correct to withhold the name of the Head of Service under section 38(1)(b) of FOISA.

Section 17? information not held

47.Subject to exceptions which are not relevant in this case, the information to be given by a Scottish public authority in response to a request under section 1(1) of FOISA is that held by it at the time the request is received (section 1(4)).Where an authority receives a request for information which it does not hold, it must (in accordance with section 17(1) of FOISA) give the applicant notice in writing that it does not hold the information.

48.Request 3 was for "the additional evidence that was used by the Head of Service to justify altering the pre-inspection report".On review and in its submissions to the Commissioner, the Council argued that it did not hold this information.The question for the Commissioner, therefore, is whether at the time it received request 3 the Council held any information which fell within the scope of that request.

49.As indicated above, the Council explained in the review notice that the vetting and finalising of the pre-inspection report was based on the experiential knowledge of the official who carried it out. While acknowledging that there might have been documentation which had informed the vetting, the Council explained that the individual in question had left the employment of the Council some years ago and there was now no known information held in recorded form that fell within the scope of request 3.

50.In correspondence with the investigating officer, the Council further explained that there was nothing held on the Council's database and nothing in hard copy.It advised that its staff had been interviewed and had speculated upon the reasoning, but ultimately they did not know.

51.Having considered the submissions he has received, in this case the Commissioner is satisfied that adequate steps were taken by the Council to determine whether it held the information in question.The Commissioner is therefore satisfied that the information sought in Mr Robertson's request 3 was not held by the Council at the time it received his information request.He is therefore satisfied that the Council was correct to give Mr Robertson notice in respect of this request in terms of section 17(1) of FOISA.

DECISION

The Commissioner finds that the City of Edinburgh Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Robertson.

Appeal

Should either Mr Robertson or the City of Edinburgh Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
14 February 2011

Appendix

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

?

(b) would, or would be likely to, inhibit substantially-

?

(ii) the free and frank exchange of views for the purposes of deliberation; or

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act; ?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?