Decision 028/2009 Mr Robert Pillans and East Lothian Council

Reports relating to job evaluation process

Reference No: 200801079
Decision Date: 06 March 2009

Summary

Mr Pillans asked East Lothian Council (the Council) to provide copies of "Question Trace" and "Elimination Question Trace" reports relating to the single status job evaluations for three posts within the Council. The Council initially decided to withhold all the information under several exemptions in the Freedom of Information (Scotland) Act 2002 (FOISA). Following a review, Mr Pillans remained dissatisfied and applied to the Commissioner for a decision.

During the investigation of Mr Pillans' case, the Council provided him with the question trace report relating to his own post.The Council withheld the other question trace reports under section 38(1)(b) of FOISA (personal information).During the investigation it was established that the Council did not hold the information represented by Mr Pillans' request for "Elimination Question Trace" reports.

Following an investigation, the Commissioner found that the Council had failed to deal with Mr Pillans' request for information in accordance with Part 1 of FOISA by wrongly withholding some information under section 38(1)(b) and failing to advise Mr Pillans in terms of section 17(1) that other information was not held by the Council. He also found that the Council failed to comply with the timescales specified in sections 10(1) and 21(1) of FOISA.The Commissioner required the Council to provide Mr Pillans with copies of the other Question Trace reports included within the terms of his request.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 10(1) (Time for compliance) 17(1) (Information not held); 21(1) (Review by Scottish public authority); 38(1)(b), (2)(a)(i) and (b) (Personal information)

Data Protection Act 1998 (DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data: condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 8 May 2008, Mr Pillans wrote to the Council with the following request:

In relation to the evaluations carried out on the post of Departmental Health and Safety Implementation Officer, the post of Corporate Health and Safety Officer and the post of Corporate Health and Safety Advisor, please provide copies of the following standard reports as produced by the Pilat Gauge system.

1.The Question Trace
2. The Elimination Question Trace

2.The Council responded on 13 June 2008. It withheld the information requested under several exemptions in FOISA.

3.On 15 June 2008, Mr Pillans wrote to the Council requesting a review of its decision, and disputing that the exemptions cited by the Council were applicable to the information he had requested.

4.The Council notified Mr Pillans of the outcome of its review on 16 July 2007. The Council withdrew its reliance on all exemptions except for section 30(c) of FOISA.The Council provided detailed reasons for its reliance on this exemption, and advised that "the question trace and the elimination question trace are both so inter-connected that they cannot be released separately".

5.On 21 July 2008, Mr Pillans wrote to the Commissioner's Office, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.Mr Pillans also expressed dissatisfaction with the length of time the Council had taken to respond to his request and request for review.

6.The application was validated by establishing that Mr Pillans had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 23 July 2008, the Council was notified in writing that an application had been received from Mr Pillans and was asked to provide the Commissioner with any information withheld from the applicant.

8.After some further correspondence, the Council responded with copies of the Question Trace reports for two of the posts.The Council advised that the third Question Trace report had not been finalised.

9.In relation to the other reports requested by Mr Pillans, the Council advised that the Eliminations Trace Reports were not reports held by the Council in terms of FOISA, but formed part of the 'Gauge' software made available for use by Scottish Councils under a contract between the software owners, Pilat, and the Convention of Scottish Local Authorities (COSLA).(This component of the software was variously referred to as the Elimination Trace Report and the Eliminations Report.)The Council advised that the Elimination Trace Report could not be provided by the Council without breaching the terms of the contract and user licence.The Council considered that the Elimination Trace Report was held by COSLA, and attached draft guidance from COSLA on disclosure of information relating to job evaluation results.

10.It should be noted that throughout the correspondence connected with Mr Pillans' request, there has been some variation in the terminology used in relation to the second part of his request (the Elimination Question Trace reports).This had some bearing on the way in which his request was dealt with by the Council (discussed later in this Decision Notice), so the terminology used by the Council or Mr Pillans has been adopted where it is relevant to this point.However, the reports in question will otherwise be referred to as "the Elimination Question Trace reports".

11.The case was allocated to an investigating officer who contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was asked for further information to support its view that the Elimination Trace Reports were held on behalf of COSLA, and for confirmation of the exemptions it wished to rely upon in relation to the information withheld under FOISA.

12.On 22 September 2008, Mr Pillans advised the investigating officer that the Council had sent him a Question Trace report for one of the posts covered by his request (his own post).

13.On 29 September 2008, the Council provided the investigating officer with a detailed submission on its position.The Council explained that following discussions with COSLA it had understood Mr Pillans' second request to refer to the Eliminations Report which was part of the design functionality of the Gauge software.The Council now understood his request to refer to one of the reports (the Eliminations Trace Report) which could be produced using the Gauge software.However, the Council advised that the Eliminations Trace Report functionality was not included in the version of the Gauge software COSLA had commissioned from Pilat, and accordingly the reports requested by Mr Pillans (in the second part of his request) did not exist.

14.In relation to the two Question Trace Reports which had been withheld, the Council advised that the information was considered to be personal data exempt under sections 38(1)(b) and 38(2)(a)(i) of FOISA, and that it no longer wished to rely upon any of the other exemptions previously cited.

15.The investigating officer advised Mr Pillans that the Council's position had changed since it had reviewed its response to his request, and asked whether he accepted that his request for Elimination Question Trace reports should be taken to refer to Eliminations Trace Reports, as the Council had assumed.

16.Mr Pillans advised (email 23 October 2008) that he did not accept the Council's assumption on this point.He referred to the response to his request and the review response: in his view the terms of the response showed that the person dealing with his request understood exactly what information he was looking for; and he noted that the review response stated that the two types of report were so inter-connected that they could not be released separately.He commented that, this being so, it seemed strange that one component allegedly did not exist.He believed it was clear from the terms of the Council's correspondence that the Elimination Question Trace reports did exist at the time of his request.

17.Mr Pillans did not accept that the Question Trace reports constituted personal data or should be withheld under section 38(1)(b) of FOISA.

18.In a phone call of 4 November 2008, Mr Pillans explained what information he expected to be contained in the Elimination Question Trace reports specified in his request.He explained that the Gauge software presents the employee with a series of questions, and the answer chosen by the employee at each stage determines which question is next presented.The Question Trace report lists all the options chosen by the employee, and Mr Pillans believed the Elimination Question Trace report would list the options not chosen; in other words, the questions which had not been made available to the employee as a result of his or her choices.

19.Mr Pillans provided the investigating officer with a booklet on the Gauge software which listed "Elimination Question Trace" as one of the standard reports available from the software.The booklet described the Elimination Question Trace report as a variation on the Question Trace, showing the levels eliminated in place of the job overview statements.

20.The draft guidance provided to the Council by COSLA referred to "the COSLA Gauge Question Library, also referred to as the Eliminations Report", and described this as "one of the design tools of the software" and "not used for evaluating jobs".The COSLA guidance also stated that the Eliminations Report does not form part of the 'Evaluator' or 'Administrator' modules which public authorities in the COSLA Job Evaluation Consortium were licensed to use.

21.The investigating officer met with representatives from the Council on 20 November 2008, in order to clarify terminology relating to the reports, and to establish what information was represented (in the Council's view) by the term "Elimination Question Trace report".During this meeting it became clear that the information sought by Mr Pillans in his request for the Elimination Question Trace relating to three posts was not identical to the Eliminations Report referred to by the Council and in the guidance received from COSLA.The Council showed the investigating officer a folder with the title "Question Library", which contained the complete list of questions held on the Gauge software.It was clear that this was the information described as "the COSLA Gauge Question Library, also referred to as the Eliminations Report" in the COSLA guidance referred to above.The Council confirmed that it understood this information to be the Eliminations Report.

22.The Council was advised that this was not the information that Mr Pillans sought, as he was looking for reports specific to the three posts listed in his request.The Council then demonstrated the reporting capabilities of the Gauge software provided on licence through COSLA.The type of report Mr Pillans had requested from the reporting options available on the Gauge software could not be produced during this demonstration. Confirmation was later received from COSLA that the version of the software available to the Council was not capable of producing an 'Eliminations Question Trace' report, as this was not specified as one of the standard reports available to users of COSLA Gauge.

23.The Council was also asked whether the eliminated questions for individual posts were considered during the quality assurance process for job evaluation, and what information was generated during this process.The Council explained that eliminated questions were considered in relation to some stages of the evaluation, for some posts, but this was decided on a case by case basis and a complete list of eliminated questions was not produced as a result.

24.In relation to the Question Trace reports, the Council was asked why it had decided to provide Mr Pillans with a copy of the report relating to his own post, while withholding the other two reports requested.The Council confirmed in further correspondence (12 December 2008) that this information had been provided under the DPA rather than FOISA.

25.During the meeting it emerged that two other Question Trace reports relating to the post of Departmental Health and Safety Implementation Officer were also in existence, as two other individuals besides Mr Pillans have this job title.The Council was advised that these reports also fell within the scope of Mr Pillans' information request and required to be considered.

Commissioner's analysis and findings

26.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Pillans and the Council and is satisfied that no matter of relevance has been overlooked.

The Elimination Question Trace Reports

27.The Commissioner is satisfied that the Eliminations Report which forms part of the Gauge software does not constitute the information Mr Pillans requested when he asked for the Elimination Question Trace for three named posts.Mr Pillans has made it clear that the reports he seeks provide information about the questions not seen by the post-holders as a result of the choices made while completing the online job evaluation questionnaire.

28.The Commissioner notes that the Council's review response (16 July 2008) is phrased in terms which seem to relate less to the Eliminations Report described in paragraph 21 above than to the type of post-specific report which was indicated by the terms of Mr Pillans' request and which he has confirmed to be the information that he has asked for.It seems to the Commissioner that, at the review stage, it was quite apparent to the Council what information was intended by the term "Elimination Question Trace" report.Mr Pillans had provided a very clear description of the information he sought in his request for review, stating: "The information requested is simply which questions were posed and which were eliminated."

29.It is not clear to the Commissioner why the Council then chose to interpret Mr Pillans' request as a request for the complete list of questions contained on the Gauge software, although this interpretation may have been influenced by the guidance provided to the Council by COSLA, which was framed in terms of the Eliminations Report or the complete list of questions.The Commissioner believes it should have been quite clear that Mr Pillans' request did not relate to the Eliminations Report, and consequently the Commissioner will not consider whether the Eliminations Report should have been provided to Mr Pillans.

30.The question for the Commissioner is whether the Council holds the information actually requested by Mr Pillans; that is, reports showing which questions were eliminated from the evaluation process through the choices made by employees using the Gauge job evaluation software.

31.The Commissioner notes that "Elimination Question Trace" is listed as a standard report in the Gauge software promotional material, and might be expected to be a reporting facility available to the Council.However, the Council uses a version of the Gauge software obtained under licence from COSLA.COSLA has confirmed that the Eliminations Question Trace report was not specified as one of the standard reports that would be available to users of "COSLA Gauge", and that the COSLA Gauge software is not capable of producing an Eliminations Question Trace report.

32.Taking all evidence into account, the Commissioner is satisfied that the Elimination Question Trace reports requested by Mr Pillans cannot be generated by the version of the Gauge software used by the Council.

33.The Commissioner is also satisfied, after investigation, that the quality assurance procedures used by the Council in relation to the job evaluation process would not generate information equivalent to the Elimination Question Trace reports.

34.The Commissioner therefore finds that the Council does not hold the information covered by the request for three Elimination Question Trace reports.

35.The Commissioner notes that the Council's initial response (13 June 2008) and review response (16 July 2008) indicated to Mr Pillans that it held information relating to the Elimination Question Trace reports but considered it to be exempt from disclosure.The Commissioner finds that the Council failed to comply with Part 1 of FOISA in failing to provide Mr Pillans with notice, in terms of section 17, that it did not hold the information he had requested.The Commissioner is concerned that the Council sought to apply exemptions to information without first establishing that the information was held and without being able to consider in detail the content of the reports requested.Clearly this is not good practice.

The Question Trace Reports

36.As noted previously, the Council supplied Mr Pillans with a copy of the Question Trace report relating to the post he holds, but withheld the other two reports he requested.During the investigation it emerged that an additional two Question Trace reports required to be considered: apart from Mr Pillans, the Council employs two other Departmental Health and Safety Implementation Officers, and the Question Trace reports relating to those posts are covered by the terms of Mr Pillans' request.

37.The Council's final position on this matter was that, when read in conjunction with grade and salary structure information already publicly available, disclosure of the reports would amount to a breach of the data protection principles in respect of third party personal information about an individual.The Council therefore considered the information to be exempt under section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i).

38.The exemption under section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), provides that information is exempt information if it constitutes personal data (as defined in section 1(1) of the DPA) and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in the DPA.This is an absolute exemption and therefore is not subject to the public interest test laid down by section 2(1)(b) of FOISA.

39.In order for a public authority to rely on this exemption, it must therefore show firstly that the information which has been requested is personal data for the purposes of the DPA, and secondly that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.

Is the information personal data?

40.The Commissioner first considered whether the reports constituted personal data as defined by the Data Protection Act 1998 (the DPA); that is, data which relate to a living individual who can be identified from those data or from those data and other information which is in the possession of, or likely to come into the possession of, the data controller.

41.The Commissioner found that the Question Trace reports provide information about the working conditions, skills, activities, responsibilities and knowledge requirements associated with the post.The Commissioner notes that the name of the post-holder is not included on the report, and that guidance from the Council to employees states "It is very definitely the post that that is objectively evaluated and not the individual post-holder or their personal performance."[1]

42.However, the first issue for the Commissioner to consider is whether an individual can be identified from the withheld data, or from the withheld data and other information in the possession of the Council (the data controller).The Commissioner notes guidance[2] from the (UK) Information Commissioner responsible for Data Protection matters, which advises:

"When considering identifiability it should be assumed that you are not looking just at the means reasonably likely to be used by the ordinary man in the street, but also the means that are likely to be used by a determined person with a particular reason to want to identify individuals."

43.The Commissioner accepts that it would generally be possible for a member of the public to identify individual Council officers from their job title, through enquiry to the Council or by other means.The Commissioner notes that the identity of the post-holders is, in any case, known to Mr Pillans.

44.The Commissioner is clear that the main focus of the Question Trace report is the skills, qualifications and experience required to carry out the job, and that the report does not provide any information about the performance of the post-holder.However, he notes that the reports include an indication of the professional qualifications and employment background required by the post-holder.The reports also contain some additional information, provided by the post-holder, which might be taken to represent the post-holder's own views and opinions about the post.As the Commissioner is satisfied that the individual post-holders could be identified through available information, he accepts that the Question Trace reports constitute the personal data of the post-holders even though the individuals concerned are not named on the reports.

Would disclosure of the information contravene the data protection principles?

45.The first data protection principle states that personal data shall be processed fairly and lawfully. It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA is also met. The Commissioner is satisfied that the information withheld is not sensitive personal data and so he is not required to consider whether any of the conditions in Schedule 3 to the DPA can be met.

46.The Commissioner considers that only condition 6(1) of Schedule 2 of the DPA might be considered to apply in this case. Condition 6(1) allows personal data to be processed (in this case, disclosed in response to Mr Pillans' information request) if disclosure of the data is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

47.There are a number of tests which must be met before condition 6(1) can apply:

? Does Mr Pillans have a legitimate interest in having this personal data?

? If so, is the disclosure necessary to achieve those legitimate aims? (In other words, is disclosure proportionate as a means and fairly balanced as to ends or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?)

? Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects? This will involve a balancing exercise between the legitimate interests of Mr Pillans and those of the data subjects. Only if the legitimate interests of Mr Pillans outweigh those of the data subjects can the personal data be disclosed.

48.Mr Pillans has explained that he is appealing the re-grading of his post by the Council.Although he would not be able to submit the Question Trace reports for other posts as evidence in the appeal, he believes they would help him to put forward as strong a case as possible at the appeal hearing in the limited time allocated for appellants to re-state their case.He believes the reports will also allow him to scrutinise and evaluate the appeal decision, once taken, by enabling him to see whether all the evidence submitted to the appeal has been considered in reaching the decision.In his application to the Commissioner Mr Pillans stated that in other cases where information had been released by the Council, the staff concerned were able to see where posts had been undervalued and subsequently were successful in having the job overview changed.

49.The Commissioner is satisfied that Mr Pillans has demonstrated a legitimate interest in the personal data withheld.

50.The second test is whether disclosure is necessary for those legitimate interests. In this case the Commissioner, in taking account of the specific information requested by Mr Pillans, is satisfied that disclosure is necessary and proportionate and that the aims of Mr Pillans cannot be achieved by any other means which would interfere less with the privacy of the post-holders in question.(The degree to which the privacy of the post-holders would be affected is discussed below.)

51.The Commissioner must finally consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the post-holders in relation to the information withheld. As noted above, this will involve a balancing exercise between the legitimate interests of Mr Pillans and those of the post-holders. Only if the legitimate interests of Mr Pillans outweigh those of the post-holders can the Question Trace reports relating to their jobs be disclosed without breaching the first data protection principle.

52.The Commissioner does not consider that disclosure would prejudice the rights, freedoms and legitimate interests of the post-holders to any significant extent.He takes the view that the information in the Question Trace reports relates primarily to the post, rather than the post-holder, and is not markedly different from the type of information which might be included in a recruitment pack to enable job applicants to check they can offer the relevant skill set, qualifications and experience.The information in the reports describes the post occupied by the post-holder, but does not include any assessment of their performance within that post.The Commissioner finds that the reports do not contain any genuinely personal or sensitive information, and accordingly the post-holders do not have a strong legitimate interest in keeping the information private.

53.The Commissioner therefore does not find that disclosure of the Question Trace reports would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the post-holders, which are outweighed by the legitimate interests of Mr Pillans (identified in paragraph 48).

54.Being satisfied that the three tests as set out at paragraph 47 above are fulfilled, the Commissioner finds that the processing is permitted by condition 6(1) of Schedule 2 to the DPA.

55.The Commissioner must, in addition, consider whether the disclosure is otherwise unfair or unlawful.

56.The (UK) Information Commissioner considers the question of fairness in his Freedom of Information Act Awareness Guidance No 1 ? Personal Data[3].The guidance distinguishes between information relating to an individual's private and public lives, suggesting that information about an individual acting in an official or work capacity is less likely to deserve protection.

57.Additional guidance is provided in the Information Commissioner's Data Protection Technical Guidance: Freedom of Information ? Access to information about public authorities' employees[4]. This includes the advice:

"Draw a distinction between professional information ? e.g. job titles or sectoral responsibilities, and genuinely personal or sensitive information ? e.g. reasons for sickness absence."

58.After considering the information withheld, the Commissioner is satisfied that disclosure would not be unfair, for the reasons outlined above in relation to condition 6(1). Given that the Council has not put forward any arguments as to why the disclosure of the information would be unlawful (other than in terms of a breach of the data protection principles), the Commissioner is satisfied that the disclosure of the data under FOISA would not breach the first data protection principle.

59.Having found that disclosure would not breach the first data protection principle and that condition 6(1) of Schedule 2 of the DPA can be met, the Commissioner does not accept that the information requested is exempt from disclosure under section 38(1)(b) of FOISA.

60.The Commissioner requires the Council to provide Mr Pillans with the Question Trace reports for the posts of Corporate Health and Safety Officer, Corporate Health and Safety Advisor, and the two other Departmental Health and Safety Implementation Officers (noting that Mr Pillans has already been provided with the Question Trace report relating to his own post).

Technical breaches - timescales

61.Mr Pillans also raised concerned with the time taken by the Council to respond to his request and request for a review.

62.Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days from receipt of the request to comply with a request for information, subject to certain exemptions which are not relevant in this case.

63.The Commissioner finds that the Council failed to respond to Mr Pillans' request for information of 8 May 2008, within the 20 working days allowed by section 10(1) of FOISA.

64.Section 21(1) of FOISA gives authorities a maximum of 20 working days from receipt of the requirement to comply with a requirement for review, again subject to exemptions which are not relevant in this case.

65.The Commissioner also finds that the failed to respond to Mr Pillans' requirement for review of 15 June 2008 within the 20 working days allowed under section 21(1) of FOISA.

66.Although the Commissioner has identified certain breaches of technical provisions of FOISA in the Council's handling of Mr Pillans' request, he has noted that these resulted in delays of only a few days beyond the required timescales.He does not consider it appropriate in the circumstances to require any action on these matters at this stage. He would urge the Council to note these breaches and consider what steps it can take to ensure appropriate and more timeous responses in future.

DECISION

The Commissioner finds that East Lothian Council failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Pillans.The Council wrongly withheld some information under section 38(1)(b) of FOISA, and failed to advise Mr Pillans that other information was not held (as required by section 17(1)).He also finds that the Council failed to comply with the timescales required by sections 10(1) and 21(1) of FOISA.

The Commissioner therefore requires the Council to provide Mr Pillans with the information specified in paragraph 60 above, by Monday 20 April 2009.

Appeal

Should either Mr Pillans or East Lothian Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
06 March 2009

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(?)

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

(?)

(e) in subsection (1) of section 38 ?

(?)

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

10 Time for compliance

(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-

(a) in a case other than that mentioned in paragraph (b), the receipt by the authority of the request; or

(b) in a case where section 1(3) applies, the receipt by it of the further information.

?

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

21 Review by Scottish public authority

(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.

38 Personal information

(1) Information is exempt information if it constitutes-

(?)

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(?)

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress); and

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(?)

Data Protection Act 1998

1 Basic interpretative provisions

In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

---