Decision 028/2010 | Scottish Information Commissioner

Home Decisions

Decision 028/2010

Decision 028/2010 Mr Ivind Thoresen and Tayside Health Board

Report on audit of Audiology Service

Reference No: 200900347
Decision Date: 24 February 2010

Summary

Mr Thoresen requested from Tayside NHS Board (NHS Tayside) a copy of an audit report for the Audiology section at Ninewells Hospital.NHS Tayside responded by withholding this report and relying on the exemptions in sections 30(b)(i) and (ii) and section 38(1)(b) of FOISA for doing so. Following a review, Mr Thoresen remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that NHS Tayside had partially failed to deal with Mr Thoresen's request for information in accordance with Part 1 of FOISA.The Commissioner was satisfied that NHS Tayside had been correct to rely on the exemptions in sections 30(b)(i), 30(b)(ii) and 38(1)(b) for withholding certain information from Mr Thoresen.However, he also found that NHS Tayside was wrong to rely on the exemptions in sections 30(b)(i), 30(b)(ii), 30(c) and 35(1)(g) (read in conjunction with section 35(2)(j)) of FOISA for withholding other information.The Commissioner requires NHS Tayside to release the information detailed in the decision section to Mr Thoresen.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 15 (Duty to provide advice and assistance); 30(b) and (c) (Prejudice to the effective conduct of public affairs); 35(1)(g) and (2)(j) (Law enforcement); 38(1)(b), (2)(a)(i), (2)(b) and (5) (Personal information).

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions ? definition of personal data) and 2(e) (Sensitive personal data); Schedules 1 (The data protection principles: the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? condition 6).

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data: recital 26.

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Information Commissioner's Data Protection Technical Guidance Determining what is personal data

http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/personal_data_flowchart_v1_with_preface001.pdf

Background

1.On 20 December 2008, Mr Thoresen wrote to NHS Tayside to request a copy of the report prepared for NHS Tayside by a named individual, following an audit that individual carried out within Audiology Tayside.

2.NHS Tayside responded on 22 January 2009.It refused to release the report to Mr Thoresen and relied on the exemptions in sections 30(b) and 38(1)(b) of FOISA for doing so.NHS Tayside did explain that the findings from the report had been used to compile an Audiology Service Action Plan, which it intended to make available to all members of staff in the Audiology Service prior to a meeting on 30 January 2009.NHS Tayside believed the imminent provision of the Service Plan would address Mr Thoresen's request.

3.Mr Thoresen wrote to NHS Tayside on 23 January 2009 requesting a review of its decision.In particular, Mr Thoresen drew NHS Tayside's attention to the content of the Commissioner's briefing on the application of the exemption in section 38 of FOISA, giving an indication of the kinds of information likely to be considered personal data and asking to be provided with a copy of the report with all personal details removed of any individual mentioned by name.In his request for a review, Mr Thoresen also quoted the content of the Commissioner's briefing on the exemptions in section 30(b) of FOISA, suggesting that the public interest in disclosure of the report outweighed the need to withhold the information.

4.NHS Tayside responded to Mr Thoresen's request for review on 19 February 2009.It continued to rely on the exemptions in sections 30 and 38 for withholding the report.NHS Tayside also advised that it considered the public interest was best served by ensuring that adequate health services were provided to the population of TaysideIt contended that it must maintain the ability to gather and assess information in support of service review or investigations, this information being fundamental to the development of recommendations and service improvement plans.

5.On 20 February 2009 Mr Thoresen wrote to the Commissioner, stating that he was dissatisfied with the outcome of NHS Tayside's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr Thoresen had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 3 March 2009, NHS Tayside was notified in writing that an application had been received from Mr Thoresen and asked to provide the Commissioner with any information withheld from him. NHS Tayside responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted NHS Tayside, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, NHS Tayside was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.

9.A full response was received from NHS Tayside, in which it explained its reliance on the exemptions claimed earlier.The investigating officer had noted that there remained a considerable amount of information in the report for which no exemption appeared to have been claimed, in response to which NHS Tayside argued that the provision of this remaining information would result in a meaningless text with little context or relevance in isolation from the circumstances.

10.NHS Tayside referred to contextual information provided to the applicant, noting in particular its provision to both Mr Thoresen and other personnel within the Audiology Service of relevant information as to the outcome of the report (given in context and within a clear framework of action to be taken).It believed the substantial amount of information provided in this context to be adequate to address Mr Thoresen's concerns.

11.Further submissions were received from NHS Tayside during the course of the investigation, in which it explained that it was also seeking to rely on the exemptions in sections 30(c) and 35(1)(g) (read with section 35(2)(j)) for certain withheld information.Submissions on certain aspects of the case were also obtained from Mr Thoresen.

12.The arguments of both parties will be considered in the Commissioner's analysis and findings section below.

Commissioner's analysis and findings

13.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Thoresen and NHS Tayside and is satisfied that no matter of relevance has been overlooked.

Withheld information

14.The information that has been withheld is that contained in a report following an external review of the Audiology Service at Ninewells Hospital.NHS Tayside has relied on the exemptions referred to above for withholding certain parts of this report.However, the whole report was withheld, NHS Tayside arguing that the release of the remainder in isolation would be meaningless.Its arguments in respect of all of the withheld information will be considered below.

Section 30(b) ? Prejudice to the effective conduct of public affairs

15.Information is exempt under section 30(b) of FOISA if its disclosure would, or would be likely to, inhibit substantially the free and frank provision of advice (section 30(b)(i)) or the free and frank exchange of views for the purposes of deliberation (section 30(b)(ii)) respectively.

16.As the Commissioner has noted in previous decisions, e.g. Decision 089/2007 Mr James Cannell and Historic Scotland or Decision 105/2008 Mr Rob Edwards and the Scottish Ministers, the standard to be met in applying these tests is high.The chief consideration is not whether the information constitutes advice or opinion, but whether release of the information would, or would be likely to, have the effect of inhibiting substantially the free and frank provision of advice or exchange of views.The Ministers' own guidance to their staff on the application of section 30(b) points out that the word "inhibit" suggests a suppressive effect, so that communication would be less likely, more reticent or less inclusive.In this connection, the Commissioner looks for authorities demonstrating a real risk or likelihood that actual inhibition will occur at some time in the near (certainly foreseeable) future, not simply that inhibition is a remote possibility.The inhibition must be substantial and therefore of real and demonstrable significance.

17.When considering the application of these exemptions, each request should be considered on a case by case basis, taking into account the effects anticipated from the release of the particular information involved.It should not be presumed that substantial inhibition will follow from the release of information simply because it falls within a particular category.Relevant considerations will include:

the nature of the information

the subject matter of the advice or exchange of views

the manner in which the advice or exchange of views are expressed, and

whether the timing of disclosure would have any bearing: releasing advice or views whilst a decision was being considered, and for which further views were still being sought, is likely to be more substantially inhibiting than once advice has been taken.

18.NHS Tayside has relied on the exemptions in both sections 30(b)(i) and (ii) for certain of the withheld information.In particular, this relates to observations made by persons contributing to the review, the reviewer's observations and views on the service provision and capability of staff within the Audiology Service, and recommendations as to areas of improvement within the Audiology Service.

19.In its submissions, NHS Tayside explained that the assessment of its services was an essential function of the organisation, with a view to allowing the organisation to discharge its duty of ensuring the provision of adequate and safe healthcare.It went on to contend that such assessment must allow critical evaluation to support development of both services and personnel.In addition, investigations must take place to identify and subsequently resolve any concerns raised in connection with the provision of services.NHS Tayside considered it essential to ensure that such assessments and investigations addressed all issues impacting on a service or personnel, and that there must be an environment where all concerned could freely contribute to assessments, reviews or investigations.

20.NHS Tayside also submitted that comments and opinions relating to the efficiency and effectiveness of the services being provided had been given on the understanding (based on a verbal assurance by the reviewer) that they would not be made public.Noting the sensitivity of the withheld information, it submitted that the report raised issues which if not addressed might have an impact on the ongoing provision of the service in question.It believed that the identification of these issues, along with any subsequent action to address them, would at least have been delayed (if not left undiscovered) if the people involved had not been given the opportunity to contributed in the manner they had.

21.Referring in particular to the recording of clinical practice observed during the review, NHS Tayside contended that this was crucial both in assessing where immediate action was required and in longer term planning for the redesign of the service.It took the view that such observation would be undertaken in a professional manner, the reviewer appraising or assessing the performance of colleagues in an honest and objective manner and giving an honest explanation of their concerns to an appropriate person: this, it believed, had happened in this case and therefore further disclosure of the relevant information to the public was not appropriate.Disclosure would, it argued, expose the reviewer's professional assessments to inappropriate public scrutiny and their professional and ethical approach to questioning by other professionals and colleagues.It considered personal and professional damage to the individuals involved to be at least possible, with a consequential influence on the behaviour of those undertaking or taking part in any future review where the findings could be published.

22.Having considered NHS Tayside's submissions, together with the withheld information, the Commissioner accepts that the information constitutes both the provision of advice and the exchange of views in respect of service provision and capabilities within the Audiology Service.He also accepts that this information was provided to or created by the reviewer for the purpose of the investigation, and that the advice and views have been expressed frankly.The Commissioner is also satisfied that the observations about individual employee's clinical practice are specific to those individuals and their abilities.

23.Where a review or investigation of this type is being carried out of any service, the Commissioner accepts that those carrying out the review or investigation will seek the maximum co-operation and contribution of those working within the service.Those contributing to the review or investigation should feel able to comment frankly and honestly, without inhibition, on the operation of the service and the personnel within it.The Commissioner acknowledges that in many cases such co-operation will be more (and may only) be forthcoming if those providing their views can do so in the expectation that certain comments will be not placed in the public domain, at least for some time after the review or investigation is completed.

24.Having read the withheld information, the Commissioner acknowledges that much of it is of such sensitivity that its disclosure would, or would be likely to, inhibit substantially the free and frank provision of advice or the free and frank exchange of views for the purposes of deliberation.He accepts that a future reviewer would be unlikely to receive the level of co-operation described in paragraph 23 above if that information had been disclosed in response to Mr Thoresen's information request or his request for review.In this context, he notes (as highly relevant, if not conclusive) the verbal assurance given to staff that their contribution would only be used for the purpose of the review and would not be made public.

25.On the other hand, the Commissioner has not arrived at the same conclusion in relation to certain of the views expressed and advice given by the person carrying out the review.Where a person is responsible for carrying out an investigation into the provision of a service within a particular organisation, then the Commissioner would expect (and considers that others would expect) a full and thorough investigation to be carried out and an honest and comprehensive report to be produced at the end.It is the Commissioner's view that the investigator or reviewer would be acting in a manner contrary to the purposes for which they were employed if they failed to do this.It appears to the Commissioner that this applies particularly to the general risk assessment on page 31, to which the considerations set out in the following paragraphs do not appear to apply.

26.The Commissioner does accept, however, that certain of the reviewer's views and observations (in particular, their observations of individual clinicians' work) are of some sensitivity and that its release would be likely to have the impact claimed by NHS Tayside.

27.The Commissioner accepts the submission of NHS Tayside that where an observation of clinical practice takes place as part of an assessment then any concerns would be brought to the attention of the appropriate person, which has been done in this case.The Commissioner agrees that release of the information into the public domain would not be appropriate in this case, given the mechanisms in place to attend to deficiencies in a particular individual's work.Further, the Commissioner agrees that this information is of such sensitivity that its release would be expected to cause a breakdown in trust between NHS Tayside and the personnel involved.He accepts that release of this information would, or would be likely to, inhibit substantially those personnel who have been observed from taking part in future reviews of this kind.

28.On the foregoing analysis, the Commissioner is satisfied that the information on pages 18 to 29 (inclusive) of the report, all of which relates to observations of clinicians' work, is exempt under section 30(b)(i) and (ii) of FOISA.He also accepts that the information on pages 4 to 17 inclusive, excluding the introduction on page 4 (which simply sets the report in context), represent free and frank contributions to the review which are exempt under section 30(b)(i) and (ii), given their nature and the likely impact of disclosure.

29.As the Commissioner is not satisfied that the introduction on page 4 of the report or the information on page 31 are exempt under section 30(b), and as no other exemption has been claimed in respect of that information, he requires NHS Tayside to release it to Mr Thoresen.

30.The Commissioner must go on to consider the application of the public interest test in section 2(1)(b) of FOISA to the information he has found to be exempt under section 30(b)(i) and (ii).

Public interest test

31.In its submissions to the Commissioner, NHS Tayside reiterated its view that the public interest was best served by ensuring that adequate and safe health services were provided to the population of Tayside.It considered the assessment, review or investigation of the provision of all services to be fundamental to its ability to ensure that those services were adequate and safe.In the circumstances, NHS Tayside believed it to be in the public interest for something to be done to address the issues raised in the report.On the other hand, it did not consider it to be in the public interest for the personnel who had contributed their opinions to the information gathering exercise to be exposed to such a high degree of public scrutiny.In this connection, it considered itself to have a duty of care and obligations to act to maintain the health and well-being of its employees, which would not be met by such exposure.

32.In his submissions to the Commissioner, Mr Thoresen identified a public interest in disclosing the withheld information to protect the population of Tayside and ensure the provision and effective management of safe, adequate health care by the Audiology department.He has also argued that this is morally justified on the grounds of providing health care with integrity and social justice, patients having a right to expect the highest level of management and care with suitably qualified clinicians with the correct experience and expertise to carry out their duties in as safe a manner as possible.

33.Having considered the arguments advanced by both NHS Tayside and Mr Thoresen regarding the public interest, the Commissioner accepts that there is a clear public interest in ensuring that the health service offered and provided to patients is safe and adequate.He also accepts that disclosure of the majority of the information in the report which he considers to be exempt under sections 30(b)(i) and (ii) might go some way towards addressing this.He does not believe this to be the case, however, in relation to the information contained in the fifth and sixth paragraphs of page 9 of the report

34.However, the Commissioner is mindful of the fact that certain of this information comprises comments made about the practice of individual Audiologists, and while there is a public interest in ensuring that the clinicians who deliver medical care to patients are suitably trained, qualified and able to perform the requisite procedures, there is also a public interest in action being taken to remedy deficiencies or concerns found in their practice as a matter of urgency once they are identified.In this case, the Commissioner notes that the views expressed on individual clinicians' competency were reported to the appropriate people to allow any matters of concern to be addressed.In the Commissioner's view, the efficacy of the remedial action found necessary which was still ongoingat the time of Mr Thoresen's request and request for a review, would be adversely affected by disclosure and this would not be in the public interest.He also accepts NHS Tayside's arguments in relation to its duty of care towards its staff, and that in commenting frankly and candidly about their own practice and that of their colleagues they should not be subject to the high degree of public scrutiny which would be likely to follow from release of this information, with consequent detrimental impact on their wellbeing.

35.On balance, therefore, the Commissioner is satisfied, for the reasons given above, that the public interest in disclosing the information he has found to be exempt under sections 30(b)(i) and (ii) of FOISA is outweighed in the circumstances of this particular case by that in maintaining these exemptions.Later in this decision, he will also consider the application of section 38(1)(b) of FOISA to elements of this information.

Information within the report initially considered to be in the public domain

36.In its original submissions to the Commissioner, NHS Tayside explained that the information within the report which had been highlighted yellow (the majority of the information on pages 32 to 38) was information which had already been placed in the public domain as a result of the disclosure of information to the applicant and other members of the Audiology Service.Further investigation established, however, that this information had been disclosed only in a summarised form and then not until after NHS Tayside had carried out its review in relation to Mr Thoresen's request.

37.Following a request for further submissions, NHS Tayside explained that it had considered the information again and was seeking to rely on the exemptions in sections 30(c) and 35(1)(g) (read in conjunction with section 35(2)(j)) of FOISA in withholding this information.It also confirmed that it was relying on these exemptions in respect of certain information in the Executive Summary of the report (in respect of which it had not claimed any exemptions previously).The Commissioner will firstly consider NHS Tayside's reliance on section 30(c) in respect of both sets of information.

Section 30(c) ? Effective conduct of public affairs

38.As mentioned above, section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs".The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b).This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by release of the information, and how that harm would be expected to follow from release.

39.Section 30(c) applies where the harm caused, or likely to be caused, by disclosure is at the level of substantial prejudice.There is no definition in FOISA of what is deemed to be substantial prejudice, but the Commissioner considers the harm in question would require to be of real and demonstrable significance.The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur and therefore needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.

40.In its submissions, NHS Tayside explained that this report had been commissioned from an external consultant with regard to the clinical work carried out by the Audiology Service and its management and that the objectives of this report were to examine the basic clinical work of the service and to confirm and raise any concerns around the provision of Audiology services.Its purpose was to rectify and avoid in the future any shortcomings identified and to ensure that patient safety standards were met in the delivery of the Audiology services.

41.NHS Tayside submitted that it was essential that such investigations and reports, which were clearly intended to present views, opinions and advice as a basis for decision making, were undertaken in a manner that allowed relevant information to be gathered and made available for the full investigation of patient safety concerns and the subsequent necessary action of the organisation.It noted the sensitivity of the subject matter, on which patients and others would wish to be assured of the safety and reliability of the service.

42.NHS Tayside argued that if the report were to be disclosed in full, then this would significantly discourage people from making full and candid contributions to the process of investigating such concerns: it believed that the level of contribution afforded by this process had in fact resulted in significant issues being raised through the recommendations and conclusions made in the report.It is NHS Tayside's view that if it were not able to commission such reports to allow it to understand, discuss and take appropriate action in such circumstances, as it believed this would be a consequence of disclosure in this case, then this would damage its ability to carry out its duty.

43.NHS Tayside submitted that the conclusions and recommendations in the report (pages 32 to 38 inclusive) were generally presented in a "factual", instructional manner, which might be acceptable as a basis for further discussion but in isolation could be read, misleadingly, as being a clear statement of fact.The conclusions and recommendations included matters, according to NHS Tayside, which had been challenged, in some cases addressed and in others continued to be discussed and further reviewed.In NHS Tayside's view, disclosure of the information at this stage would likely have an adverse effect on its ability to address outstanding matters.It argued that efforts towards improvement of the service would be adversely affected by disclosure, as the service would be judged on the basis of the information in the report, without knowledge of the circumstances and steps subsequently taken.

44.NHS Tayside argued that it had considered the impact of disclosure on both its own employees and the patients who utilised the Audiology services, setting out in further detail the prejudicial impact it believed disclosure would have on each group.

45.Having considered the information which has been withheld in pages 32 to 38 of the report, which concern conclusions and recommendations, the Commissioner is not satisfied that release of this information would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

46.The Commissioner accepts that the information presented here as conclusions and recommendations relates to the views of the author of the report on the outcomes of the audit, and what actions, if any, should be taken as a consequence of it.The Commissioner also accepts that where steps require to be taken to address issues raised within the report, NHS Tayside should be allowed to consider and (as required) implement these actions without concern that it will disclosed into the public domain before this can be done.

47.However, it is also clear that the final report was produced in October 2008 and that a Service Action Plan, highlighting the areas to be addressed by NHS Tayside as a consequence, was finalised and distributed in January 2009.This was prior to Mr Thoresen's request for a review being responded to by NHS Tayside.Furthermore, it was clear at that time that timescales had been set for completion of each area of the Service Action Plan and that some of the actions had already been completed.Therefore, the Commissioner cannot accept that matters raised in the conclusions and recommendations sections were still subject to consideration at the time of Mr Thoresen's request for a review.He does not accept that disclosure in this context would have any significant adverse impact on the future commissioning of such audits.

48.The Commissioner also does not accept NHS Tayside's argument that release of the withheld information in pages 32 to 38 would lead to this information being read in isolation and potentially being misleading.Certain of the information to which no exemption has been applied could help to put this information into context, and in any event it is always open to a Scottish public authority to provide contextual information to explain or clarify information released under FOISA.

49.The Commissioner has also considered the information withheld from Mr Thoresen in the Executive Summary.Certain of this information concerns the conclusions and recommendations made following the audit.As the Commissioner does not accept (as detailed immediately above) that any substantial prejudice would result from the release of this information from the main body of the report, he cannot accept that a summary of these conclusions and recommendations would be exempt under section 30(c).The remainder of the information withheld from the Executive Summary sets out the background to the audit and the reasons for it being carried out.Other than the general arguments advanced for withholding the information on pages 32 to 38, NHS Tayside has not provided any specific arguments as to why release of this background information would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.The Commissioner can identify no obvious link between these arguments and this background information and no such link has been brought to his attention.In the circumstances, he can see no basis for harm to the effective conduct of public affairs resulting from disclosure of this information.

50.The Commissioner is therefore not satisfied that NHS Tayside was correct to withhold any of the withheld information under the exemption in section 30(c) of FOISA.

51.As the Commissioner is not satisfied that the withheld information in the Executive Summary and on pages 32 to 38 was correctly withheld under section 30(c) of FOISA, he is not required to go on to consider the application of the public interest test in section 2(1)(b).

Section 35(1)(g) ? Law enforcement

52.Section 35(1)(g) of FOISA exempts information if its disclosure would, or would be likely to, prejudice substantially its ability (or that of another public authority, subject to either FOISA or the Freedom of Information Act 2000) to carry out its functions for any of the purposes listed in section 35(2).The exemption is subject to the public interest test in section 2(1)(b) of FOISA.

53.With this in mind, in considering the use of section 35(1)(g), the Commissioner must consider three fundamental points as follows:

a.Does NHS Tayside have a statutory function in relation to one or more of the purposes listed in section 35(2)?

b.If so, would disclosure of the information prejudice substantially, or be likely to prejudice substantially, NHS Tayside's ability to carry out one or more of the functions listed in section 35(1)(g)?

c. Even if this is the case, does the public interest in maintaining the exemption outweigh the public interest in disclosure of the information?

NHS Tayside's statutory functions

54.NHS Tayside explained that it was established under the terms of the National Health Service (Scotland) Act 1978.It referred to section 12H of that Act (Duty of Quality), under which it stated that it was required to "put and keep in place arrangements for the purpose of monitoring and improving the quality of Health Care which it provides to individuals".It considered the commissioning of external reviews to be a part of the arrangements it required to carry out to discharge that duty, as well as being a means of addressing its duty to promote health improvement under section 9(2) of the National Health Service Reform (Scotland) Act 2004.

55.NHS Tayside also argued that it exercised the functions described in paragraph 60 above for the purposes set out in section 35(2)(j) of FOISA, that is "to protect persons, other than persons at work, against risk to health or safety where the risk arises out of, or in connection with, the actions of persons at work".

56.Having considered these submissions, the Commissioner accepts that the duties described in paragraph 60 above are statutory functions of NHS Tayside, exercised for the purposes described in section 35(2)(j) of FOISA.Therefore, he accepts that the withheld information on pages 32 to 38 of the report and in the Executive Summary falls within the scope of the exemption in section 35(1)(g) of FOISA.

57.The exemption in section 35(1)(g) will only be engaged, however, where the disclosure would, or would be likely to, prejudice substantially the relevant public body's exercise of the function in question.

Substantial prejudice

58.In claiming substantial prejudice to the exercise of the functions described above, NHS Tayside has relied on the same arguments as it advanced in justification of its reliance on the exemption in section 30(c) of FOISA (see above).

59.For the reasons given above in relation to NHS Tayside's application of section 30(c) of FOISA, the Commissioner does not accept that release of the same information would, or would be likely to, prejudice substantially NHS Tayside's ability to exercise its function to protect persons, other than persons at work, against the risk to health or safety where that risk arises out of, or in connection with, the actions of persons at work.

60.As the Commissioner is not satisfied that release of this information would be exempt under section 35(1)(g) (read in conjunction with section 35(2)(j)) he is not required to go on to consider the application of the public interest test in section 2(1)(b) of FOISA.

61.Although NHS Tayside has not applied any other exemption(s) to certain information in paragraph 2 on pages 34 and 35 (that is, from immediately after the words "staff deployment:" in the tenth line, to the end of the third full sentence on page 35), which he has not found to be exempt under sections 30(c) or 35(1)(g), the Commissioner considers that this information may be covered by the exemption in section 38(1)(b) and will consider it accordingly below.

Section 38(1)(b) ? Personal information

62.As mentioned above, NHS Tayside has relied on the exemption in section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i), for withholding certain of the information in the report.

63.The exemption in section 38(1)(b) (read with section 38(2)(a)(i) or, as appropriate, section 38(2)(b)) of FOISA exempts personal data from disclosure, if the disclosure of the information otherwise than under FOISA would contravene any of the data protection principles contained in the Data Protection Act 1998 (the DPA). This particular exemption is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.

64.In order to rely on this exemption, therefore, NHS Tayside must show firstly that the information being withheld is personal data for the purposes of the DPA, and secondly that disclosure of the information into the public domain (which is the effect of a disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.

65.In considering the application of the exemption, the Commissioner will therefore first consider whether the information that has been withheld is personal data as defined in section 1(1) of the DPA.

Is the information personal data?

66.Section 1(1) of the DPA defines personal data as data which relate to a living individual who can be identified (a) from those data or (b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

67.The information withheld from Mr Thoresen under section 38(1)(b) all concerns particular named individuals, generally opinions and views expressed by particular personnel and relating to the work, capabilities and qualifications of other personnel.

68.NHS Tayside deemed this information to be personal because it related to living individuals who could be identified from the data, the expressions of opinion being about those individuals who were clearly the focus of the opinions.

69.Having considered the information withheld from Mr Thoresen under section 38(1)(b) of FOISA, together with the submissions from NHS Tayside, the Commissioner is satisfied that living individuals, can be identified from the information, either by itself or with other information which is in the possession of, or is likely to come in to the possession of, the data controller.The information focuses on those individuals and is biographical of them in a significant sense, and consequently it relates to them.Therefore, the Commissioner is satisfied that this information is the personal data of those individuals as defined in section 1(1) of the DPA.In addition, as indicated in paragraph 61 above, he has found it necessary to consider as potentially personal data part of paragraph 2 on pages 34 and 35 of the report: for the reasons set out earlier in this paragraph, he accepts that this information also falls within the definition of personal data contained in section 1(1) of the DPA.

70.However, this is not the end of the matter.Mr Thoresen indicated in his request for review that he wanted a copy of the report sent to him with all personal details removed of any individual mentioned by name.In responding to his request for a review, NHS Tayside does not appear to have addressed this request of Mr Thoresen's.

71.Submissions were sought from NHS Tayside as to why this matter had not been addressed in response to Mr Thoresen's request for a review.In its response, NHS Tayside explained that this had been an oversight.At this point, however, it argued that Mr Thoresen's knowledge of the Audiology Service and its personnel would enable him to identify the individuals in question even if their personal details were to be redacted.

72.In the case of the Common Services Agency v Scottish Information Commissioner[1] (the Collie judgement), the House of Lords considered a request for information relating to childhood leukaemia statistics in the Dumfries and Galloway postal area.In that case, the Lords concluded that the definition of "personal data" in the DPA had to be taken to permit the disclosure of information which had been rendered fully anonymous in such a way that individuals were no longer identifiable from it, without having to apply the data protection principles.If individuals cannot be identified from the actual information requested, then the information is not personal data and cannot, therefore, be exempt under section 38(1)(b) of FOISA.

73.Although Mr Thoresen indicated that he wanted to receive a copy of the report with the personal details removed of any individual mentioned by name, the personal data which has been withheld in this report is far more than simply the mention of individuals' names.In considering questions of identifiability, the Commissioner must also bear in mind the reference in recital 26 to EU Directive 95/46/EC (reproduced in the Appendix below) to "all the means likely reasonably to be used either by the controller or by any other person to identify the said person", which is the subject of further discussion in the Information Commissioner's Data Protection Technical Guidance Determining what is personal data.In this context, the Commissioner notes that the even if the names of the individuals were to be removed the individuals to whom the data relates would be readily identifiable by NHS Tayside (and potentially others), and consequently a considerable amount of personal data would remain.

74.The Commissioner has been provided with a copy of the edited report which was presented to the Audiology staff.The Commissioner appreciates that from his own knowledge about the personnel within the department and their duties, Mr Thoresen feels he is able to identify individuals from the information in the edited report.It is clear, however, from reading the edited report and comparing it with the withheld information in the full version, that most of the personal data does not feature in the edited report.

75.Having considered the information which has been withheld in this case, together with what is in, or is likely to come into, NHS Tayside's possession, and having considered all relevant submissions and other materials, the Commissioner accepts that the information described in paragraph 69 above does constitute personal data for the purposes of section 1(1) of the DPA and that it is not possible in the circumstances to fully anonymise that personal data by redacting the names and other identifiers of individuals mentioned in the report.This would, in the Commissioner's opinion, require the redaction of most of the information identified in paragraph 69, leaving no information that would be in any sense meaningful in isolation.The Commissioner must now, therefore, go on to consider whether disclosure of any of that information would breach any of the data protection principles contained in the DPA.As noted above, NHS Tayside has argued that disclosure of the withheld information would breach the first data protection principle.

Would disclosure breach the first data protection principle?

76.The first data protection principle requires personal data to be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met, and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (to the DPA) is also met.

77.The conditions in Schedule 3 are very restrictive and it therefore makes sense before going on to consider whether the conditions in Schedule 2 of the DPA would permit the information to be disclosed, to look at whether the information falls into the definition of sensitive personal data.

78.Having considered the categories of sensitive personal data set out in Section 2 of the DPA, the Commissioner is satisfied that the majority of the withheld information is not sensitive personal data.The information in Appendix B to the report, however, is personal data relating to the assessment and treatment of individual patients and the Commissioner therefore considers it to fall within the category of sensitive personal data set out in section 2(e), in that it relates to the physical or mental health or condition of those individuals.Having considered the conditions in Schedule 3 in relation to these data, the Commissioner can identify none which would permit its processing (by disclosure) in the circumstances of this particular case.Consequently, he must accept that the information in Appendix B was properly withheld under section 38(1)(b) of FOISA.

79.In relation to the remainder of the withheld personal data, which is not sensitive personal data, the Commissioner need only consider whether any of the conditions in Schedule 2 can be met.

80.Part II of Schedule 1 to the DPA provides assistance in defining "fairness" for the purposes of the first data protection principle.As Lord Hope notes in the Collie judgement, "fairness" is concerned essentially with the method by which data is obtained, and in particular with whether the person from whom the data was obtained was deceived or misled as to the purpose or purposes for which the data are to be processed.

81.As Lord Hope also noted in the Collie judgement, the concept of lawfulness cannot sensibly be addressed without considering the conditions set out in Schedule 2 (and Schedule 3 also, where it is applicable), because any disclosure which fails to meet at least one of the necessary conditions would be contrary to section 4(4) of the DPA (which provides that it shall be the duty of the data controller to comply with the data protection principles).There may also be other reasons as to why the disclosure of information is unlawful, for example because disclosure of the information would be a breach of confidence or because there is a specific law forbidding disclosure.In this case, NHS Tayside has not put forward any arguments as to why the disclosure of the personal data would be unlawful otherwise than as a result of breaching the first data protection principle.

82.When considering the conditions in Schedule 2, the Commissioner has also noted Lord Hope's comment in the Collie judgement that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.

83.NHS Tayside advised that it had considered the six conditions for processing contained in Schedule 2 to the DPA and was of the view that no Schedule 2 condition could be met by disclosure of the withheld information.It advised that no consent had been obtained from any of the data subjects to allow disclosure of the information.NHS Tayside explained that none of the data subjects had been approached to obtain their consent, because the initial provision of information to the reviewer was in confidence and there was an expectation that the information would not be disclosed outside the review process.

84.The Commissioner considers condition 6 to be the only condition in Schedule 2 which might permit disclosure in this case.Condition 6 permits personal data to be processed if the processing (which in this case would be by disclosure in response to Mr Thoresen's information request) is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights, freedoms or legitimate interests of the data subjects (in this case, personnel within the Audiology Service).It is clear from the wording of this condition that each case will turn on its own facts and circumstances.

85.There are, therefore a number of different tests which must be considered before condition 6 can be met.These are;

a.Does Mr Thoresen have a legitimate interest in obtaining the personal data?

b.If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the candidates in question?

c.Even if the processing is necessary for Mr Thoresen's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects.As noted by Lord Hope in the Collie judgement, there is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Thoresen must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6(1) will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that NHS Tayside was correct to refuse to disclose the personal data to Mr Thoresen.

Legitimate interests

86.In his submission to the Commissioner, Mr Thoresen has set out what he considers to be his legitimate interests in receiving the personal data in the report.

87.Mr Thoresen has provided some background as to his understanding of the reasons why the external review was carried out and the report prepared.In particular, he believes access to the full report will enable him to ascertain whether proposed changes to his working practices are indeed a consequence of the recommendations made in the report.

88.It is also Mr Thoresen's view that release of this information is necessary to protect the population of Tayside, and to ensure safe, adequate health care is provided and effectively managed by the Audiology Service.He believes this to be morally justified on the grounds of providing health care with integrity and social justice, arguing that that Audiological patients, or indeed any NHS patients, have the right to expect the highest level of management and care with suitably qualified clinicians with the correct experience and expertise to carry out their duties in as safe a manner as possible.

89.The Commissioner accepts that where concerns have been raised about the practice of a particular service, in terms of the way in which duties are carried out and by whom, particularly where this has resulted in an external review of the performance of that service, then those who have raised concerns should be entitled to see the outcome of that review.The Commissioner takes this view as he believes that those individual(s) should be entitled to see the report to ensure that all matters raised have been thoroughly investigated.The Commissioner considers that Mr Thoresen's concern as to the safety, adequacy and overall quality of the Audiology Service in Tayside also reflects a wider public interest.

90.For the reasons given above, the Commissioner therefore accepts that Mr Thoresen would have a legitimate interest in receiving the personal data in the report.

Is disclosure necessary to achieve these legitimate aims?

91.The Commissioner must now go on to consider whether disclosure of the personal data in the report is necessary to achieve Mr Thoresen's legitimate aims.

92.In its submissions to the Commissioner, NHS Tayside has explained that it has provided both Mr Thoresen and the other personnel within the Audiology department with relevant information as to the outcome of the report.NHS Tayside considers that this substantial information which has been provided in context and within a clear framework of action to be taken is adequate to address Mr Thoresen's concerns.It is NHS Tayside's view that to disclose the information withheld under the exemptions would add nothing to the ongoing development of the service under review, and rather it would result in disruption to the service and detriment to the individuals involved in its operation.

93.Having considered the withheld information, together with Mr Thoresen's legitimate interests, the Commissioner considers that while the edited version of the report provided to Mr Thoresen sets out the recommendations of the reviewer and the action points that should be taken forward, disclosure of the full version of the report would inform Mr Thoresen more fully as to the inspections that were carried out, the interviews that took place and how far reaching these were.Sight of the full report would also allow Mr Thoresen to understand whether a full investigation was undertaken of the concerns raised.In the circumstances, the Commissioner cannot identify a means of meeting those legitimate interests which would be less intrusive than the disclosure of the withheld personal data.

94.As the Commissioner is satisfied that disclosure of the withheld information would be necessary to achieve at least some of Mr Thoresen's legitimate interests, he is required to go on to consider whether it would nevertheless cause unwarranted prejudice to the rights, freedoms or legitimate interests of the data subjects whose data is included in the report.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the individual's whose personal data is in the report?

95.As indicated above, the personal data included in the report is that of persons interviewed by the reviewer and individuals whose work was commented on by the reviewer.

96.In its submissions to the Commissioner as to whether release of the withheld information would cause unwarranted prejudice, NHS Tayside has advised that disclosure of information relating to individuals who contributed to the review would not be fair as the individuals concerned were not told that it would be disclosed and had no expectation that their contributions would be made public.

97.NHS Tayside has also argued that disclosure would have a direct impact on both the person expressing the opinion and the person who was the focus of the opinion with regard to their privacy.It is NHS Tayside's view that should this personal information be made public then that would cause distress to those individuals and would have a potentially damaging impact, both personally and professionally, on the individuals concerned.

98.As mentioned above, NHS Tayside did not approach any of the data subjects to obtain their consent to the disclosure of the information, as the initial provision of information to the reviewer was in confidence and it considered there was an expectation that the information would not be disclosed outside of the review process.As indicated above in relation to section 30(b), NHS Tayside advised that a verbal assurance had been given to staff involved in the review process that the information they provided would be for the purposes of the review only and would not be made public.

99.In his submissions to the Commissioner, Mr Thoresen argued that the edited version of the report, provided to all members of staff within the Audiology Service, identified a number of his colleagues within the service.Consequently, he was of the view that NHS Tayside could not rely on section 38 of FOISA for the withheld information in the full version of the report.As indicated above, however, the withheld personal data contains considerably more information about the individuals in question than what has been released to Mr Thoresen.

100.Having considered the withheld personal data, the Commissioner accepts NHS Tayside's arguments as to the detrimental effect release of the withheld personal data in the report would have on the personal and professional lives of those individuals expressing an opinion in the course of the review and those about whom an opinion is given.It is apparent from reading this information that the opinions given are expressed frankly regarding individuals' work and abilities and that those involved in the review provided full co-operation to the reviewer on the understanding that their contributions would be used only for the purposes of the review and would not be made available more widely.While not conclusive in all respects, the Commissioner must acknowledge the particular relevance of the data subject's reasonable expectations in the context of the processing of their personal data.

101.While accepting that disclosure of the withheld personal data would meet Mr Thoresen's legitimate interests, he must balance this against the rights, freedoms or legitimate interests of both the individuals who contributed to the review and those about whom opinions have been expressed in the course of carrying out that review.Having done this, the Commissioner finds that the legitimate interests served by release of this report to Mr Thoresen would not outweigh the unwarranted prejudice that would be caused to the rights, freedoms or legitimate interests of the data subjects.The Commissioner is therefore satisfied that condition 6 in Schedule 2 (to the DPA) is not met in this case.

102.Having accepted that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interest of the data subjects as described above, the Commissioner must also conclude that disclosure would be unfair.As condition 6 is not met, he would also regard disclosure as unlawful.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure and therefore that the withheld personal data was properly withheld under section 38(1)(b) of FOISA.

Withheld information for which NHS Tayside has not relied on any exemption(s) in FOISA

103.Within the full version of the report, NHS Tayside withheld a considerable amount of information but did not rely on any exemption(s) in FOISA for doing so.

104.Explaining this to the Commissioner, NHS Tayside submitted that to provide the sections of the report not marked as exempt would result in meaningless text with little context or relevance in isolation from the circumstances.It advised that this text had not been provided to the applicant in view of this and the fact that the applicant was in receipt of relevant and contextual information.

105.NHS Tayside stated that it had provided both Mr Thoresen and the other personnel within the department with relevant information as an outcome of the report.It was of the view that this information had been given in context and within a clear framework of action to be taken.It concluded that the substantial amount of information provided to the applicant was adequate in addressing their concerns.

106.Having considered the withheld information to which NHS Tayside has not applied any exemption, the Commissioner is not persuaded by the arguments put forward for withholding this information.As in the case of Decision 105/2007 Paul Hutcheon and the Scottish Executive, he cannot accept as reasonable the argument that the information would be meaningless if released on its own following redaction.As in that earlier decision, the Commissioner considers this text to be quite capable of being read and understood in isolation.He can find no justification in FOISA for the approach taken by NHS Tayside to this information and therefore finds that it should be disclosed to Mr Thoresen.

107.The Commissioner would also note that release of much of this information would, given the release of certain withheld information as required by this decision, provide a context for that other information and a fuller understanding of the nature and breadth of the investigation that was undertaken.

DECISION

The Commissioner finds that NHS Tayside partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Thoresen.

The Commissioner finds that by relying on the exemptions in sections 30(b)(i), 30(b)(ii) and 38(1)(b) (read in conjunction with section 38(2)(a)(i)) NHS Tayside was correct to withhold certain information in the report from Mr Thoresen.

However, by relying on the exemptions in sections 30(b)(i), 30(b)(ii), 30(c), 35(1)(g) and 35(2)(j), the Commissioner finds that NHS Tayside was wrong to withhold other information from Mr Thoresen.

Further, the Commissioner finds that he cannot accept NHS Tayside's decision to withhold information from the report in respect of which no exemption has been claimed.

The Commissioner therefore requires NHS Tayside to disclose the following information to Mr Thoresen:

all of the information in the Executive Summary;

the information in the first paragraph (the introduction) on page 4;

all of the information shaded blue on page 31;

all of the information on pages 32 to 38 inclusive (apart from that information in paragraph 2 on pages 34 and 35, more particularly described in paragraph 61 above);

all of the remaining information in respect of which no exemption has been claimed, that is all of the information on pages 30, 39, 40, 41, 58, 59, 60, 61, 62, 63, 64, 65, 66 and 67.

This information should be disclosed to Mr Thoresen by 12 April 2010.

Appeal

Should either Mr Thoresen or Tayside NHS Board wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
24 February 2010

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

(e) in subsection (1) of section 38 ?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

(b) would, or would be likely to, inhibit substantially-

(i) the free and frank provision of advice; or

(ii) the free and frank exchange of views for the purposes of deliberation; or

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

35 Law enforcement

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially-

(g) the exercise by any public authority (within the meaning of the Freedom of Information Act 2000 (c.36)) or Scottish public authority of its functions for any of the purposes mentioned in subsection (2);

(2) The purposes are-

(j) to protect persons, other than persons at work, against risk to health or safety where that risk arises out of, or in connection with, the actions of persons at work.

38 Personal information

(1) Information is exempt information if it constitutes-

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(b)in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

Data Protection Act 1998

1 Basic interpretative provisions

In this Act, unless the context otherwise requires ?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

(e)his physical or mental health or condition,

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Recital 26

Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable ?

[1] [2008] UKHL 47: http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm