Decision 030/2009 Ms C Alexander and Ayrshire and Arran Health Board
Applicants for a particular post
Reference No: 200801714
Decision Date: 13 March 2009
Summary
Ms Alexander requested from Ayrshire and Arran NHS Board (NHS Ayrshire and Arran) information relating to applicants for the post of Sexual Health Nurse. NHS Ayrshire and Arran responded by providing some information to Ms Alexander, but relied on the exemption in section 38(1)(b) of FOISA for withholding other information relevant to her request.Following a review, Ms Alexander remained dissatisfied and applied to the Commissioner for a decision.
During the course of the investigation NHS Ayrshire and Arran released further information to Ms Alexander, but continued to rely on section 38(1)(b) for withholding the remainder.
Following an investigation, the Commissioner found that NHS Ayrshire and Arran had dealt with Ms Alexander's request for information in accordance with Part 1 of FOISA by relying on the exemption in section 38(1)(b) for withholding certain information.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and 1(6) (General entitlement); 2 (Effect of exemptions); 38(1)(b) and (2) (Personal Information).
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions - definition of personal data); Schedules 1 (The data protection principles: the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data - condition 6).
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data: recital 26
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 15 May 2008, Ms Alexander wrote to NHS Ayrshire and Arran requesting the following information:
i.How many applications were received for the post of Sexual Health Nurse?
ii.How many applicants for this post were short listed and invited for interview?
iii.How many of those applicants short listed and interviewed, held all of the essential qualifications required for the post i.e. 1st Level Nurse (adult branch); Sexual Health Certificate (FP and GU modules); Approved mentorship course?
iv.How many of those applicants short listed and interviewed, did not hold all of the essential qualifications for the post, as listed in Q.3 above?
v.How many of those applicants short listed and interviewed did not hold the genito-urinary component of the Sexual Health module?
vi.Did the person appointed to the post hold all of the essential qualifications as stated above and if not what essential qualification was not held by the applicant?
vii.When was the genito-urinary component introduced as part of the Sexual Health Certificate?
viii.Why is a holder of the Sexual Health Certificate, who completed the prescribed course before the introduction of the genito-urinary component, and who has a large number of years hands on practical experience, prejudiced in the consideration of that person's application for this post?
2.NHS Ayrshire and Arran responded to Ms Alexander on 21 May 2008.In its response, NHS Ayrshire and Arran explained that it was unable to disclose information in relation to the individual candidates applying for the posts and was relying on section 38(1)(b) of FOISA, read in conjunction with sections 38(2)(a)(i) and (ii), for withholding this information.It did, however, advise Ms Alexander that all of the candidates short listed for the post had attained all of the required qualifications and requested criteria.NHS Ayrshire and Arran provided a response to Ms Alexander's seventh question (advising that it did not hold the information in question), but noted that because her eighth question was not seeking recorded information it did not fall within the scope of FOISA.
3.Ms Alexander wrote to NHS Ayrshire and Arran on 27 May 2008 requesting a review of its decision. In particular, Ms Alexander submitted that NHS Ayrshire and Arran had wrongly interpreted the law applicable to her request, in that she was not seeking to identify any individual person and therefore did not believe the exemption in section 38(1)(b) to apply.
4.NHS Ayrshire and Arran notified Ms Alexander of the outcome of its review on 24 June 2008.In its response, NHS Ayrshire and Arran disclosed information in response to Ms Alexander's first, fourth, fifth, sixth and seventh questions, and in response to part of her third question. It adhered to its earlier reliance on section 38(1)(b) of FOISA for withholding information which would address her second question and the remainder of her third question.It also remained of the opinion that her eighth question did not fall within the scope of FOISA.
5.On 24 November 2008, Ms Alexander wrote to the Commissioner's Office, stating that she was dissatisfied with the outcome of NHS Ayrshire and Arran's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.Ms Alexander explained in her application to the Commissioner that she was dissatisfied with the responses NHS Ayrshire and Arran had made to her second, third, fourth, fifth and sixth questions.
6.The application was validated by establishing that Ms Alexander had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 16 December 2008, NHS Ayrshire and Arran was notified in writing that an application had been received from Ms Alexander and asked to provide the Commissioner with any information withheld from the applicant.NHS Ayrshire and Arran responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted NHS Ayrshire and Arran, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.NHS Ayrshire and Arran was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested, with particular reference to section 38(1)(b).
9.During the course of the investigation, NHS Ayrshire and Arran advised the Commissioner that it was willing to release certain information previously withheld from Ms Alexander.NHS Ayrshire and Arran explained that it was willing to provide information which would answer Ms Alexander's second and fifth questions and most of her third.As Ms Alexander has now received this information it will not be considered further in this decision notice.
10.NHS Ayrshire and Arran also noted that it had provided Ms Alexander with misleading information in response to her original request, and that it would advise her of this.It had advised Ms Alexander in earlier correspondence that attainment of a mentorship course qualification was a desirable criterion, when in fact it had been identified in the job description (apparently in error) as an essential one.An explanation of this was provided to Ms Alexander and will be commented upon later in this decision.
11.NHS Ayrshire and Arran continued to rely on the exemption in section 38(1)(b) (read in conjunction with section 38(2)(a)(i)) for withholding information which would address Ms Alexander's fourth and sixth questions and the remainder of her third question.They provided detailed arguments in support of this and submissions were also obtained from Ms Alexander in support of her position that the information should be released.The submissions of both parties will be considered in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Ms Alexander and NHS Ayrshire and Arran and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? Personal information
13.As mentioned previously NHS Ayrshire and Arran has relied on the exemption in section 38(1)(b) of FOISA (read in conjunction with section 38(2)(a)(i)) to withhold information which would answer part of Ms Alexander's third question and her fourth and sixth questions.
14.The exemption in section 38(1)(b) (read in conjunction with section 38(2)(a)(i) (or, as appropriate, section 38(2)(b)) of FOISA exempts personal data from disclosure (as a form of processing), where the disclosure would contravene any of the data protection principles contained in the Data Protection Act 1998 (the DPA).This particular exemption is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.As a result, the Commissioner has been unable to take account of any public interest arguments in coming to his decision, although (as noted below) he has been able to take account of the respective legitimate interests of the applicant and the person(s) to whom the data relate.
15.In order to rely on this exemption, NHS Ayrshire and Arran must show firstly that the information being withheld is personal data for the purposes of the DPA, and secondly that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
16.In its submissions to the Commissioner, NHS Ayrshire and Arran submitted that the withheld information was personal data and that its release in response to Ms Alexander's request would, in its view, contravene the first data protection principle.In particular, it argued that disclosure would be unfair and could not be justified by any of the conditions in Schedule 2 to the DPA, one of which would have to be met for disclosure to comply with the first principle.
17.In considering the application of the exemption, the Commissioner will therefore first consider whether the information which has been withheld is personal data as defined in section 1(1) of the DPA.
Is the information personal data?
18.Section 1(1) of the DPA defines personal data as data which relate to a living individual who can be identified (a) from those data or (b) from those data and any other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
19.The information withheld from Ms Alexander concerns how many of those candidates short listed and interviewed had attained an approved mentorship course qualification (third question), the number of candidates short listed and interviewed who did not hold all of the essential qualifications for the post (fourth question), and whether the candidate appointed to the post held all of the essential qualifications and, if not, what essential qualification(s) was/were not held (sixth question).
20.NHS Ayrshire and Arran submitted that the holding of the relevant qualification(s) was information relating directly to identifiable living individuals, as information affecting the privacy of those individuals.As such, NHS Ayrshire and Arran argued that the information was their personal data.It argued that given the small and precise numbers involved, identification of the individuals concerned was all the more likely.As the numbers were so small, it would be impossible to fully anonymise the data to protect the identities of those individuals and thus bring the data outwith the definition of personal data.
21.Having considered the information withheld from Ms Alexander along with NHS Ayrshire and Arran's submissions, it is clear that NHS Ayrshire and Arran has in its possession information from which, along with the withheld information, living individuals (i.e. the candidates short listed and interviewed for, and ultimately appointed to, the post in question) could be identified.The Commissioner is satisfied that this information, taken as a whole, is personal data as defined by section 1(1) of the DPA: the information focuses on those individuals and is biographical of them in a significant sense, and consequently it relates to them.
22.However, as indicated in the Commissioner's Decision 005/2009 Mr David Ewen of the Evening Express and Aberdeenshire Council, this is not the end of the matter.Ms Alexander did not ask for all of the information held about the candidates who applied for the post of Sexual Health Nurse, she did not ask for their names.She has also made it clear that she is not seeking to identify any individual and that in her view the information she is seeking can be provided without naming any individual.
23.In the case of the Common Services Agency v Scottish Information Commissioner[1], the House of Lords considered a request for information relating to childhood leukaemia statistics in the Dumfries and Galloway postal area.In that case, the Lords concluded that the definition of "personal data" in the DPA had to be taken to permit the disclosure of information which had been rendered fully anonymous in such a way that individuals were no longer identifiable from it, without having to apply the data protection principles.Therefore, if individuals cannot be identified from the actual information requested, then the information is not personal data and cannot, therefore, be exempt under section 38(1)(b) of FOISA.
24.Although Ms Alexander has indicated that she does not wish to identify any individual and believes the information she has requested can be provided to her without the need to name any individual, it is NHS Ayrshire and Arran's view that there is sufficient information available in what has been disclosed to her, together with the information which has been withheld, to allow her to identify the individual candidates concerned if the withheld information were to be disclosed.In considering questions of identifiability, the Commissioner must also bear in mind the reference in recital 26 to EU Directive 95/46/EC (reproduced in the Appendix below) to "all the means likely reasonably to be used either by the controller or by any other person to identify the said person", which is the subject of further discussion in the Information Commissioner's Data Protection Technical Guidance Determining what is personal data.In this context, the Commissioner notes that the number of posts being filled would have been clear from the advertisement, while the identities of the successful candidates would have been readily ascertainable within the organisation.
25.Having considered the information which has been withheld in this case, together with what has been disclosed or is otherwise accessible to Ms Alexander and what is in NHS Ayrshire and Arran's possession, therefore, and having considered all relevant submissions and other materials, the Commissioner accepts that the withheld information does constitute personal data for the purposes of section 1(1) of the DPA and that it is not possible in the circumstances to fully anonymise it so that it ceases to be personal data.The Commissioner must now go on to consider whether disclosure would breach any of the data protection principles contained in the DPA.As noted above, NHS Ayrshire and Arran has argued that disclosure of the withheld information would breach the first data protection principle.
Would disclosure breach the first data protection principle?
26.The first data protection principle requires personal data to be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met, and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (to the DPA) is also met.
27.The conditions in Schedule 3 are very restrictive and it therefore makes sense before going on to consider whether the conditions in Schedule 2 of the DPA would permit the information to be disclosed, to look at whether the information falls into the definition of sensitive personal data.
28.In its submissions to the Commissioner, NHS Ayrshire and Arran advised that it did not believe the withheld information to be sensitive personal data.Having considered the categories of sensitive personal data set out in section 2 of the DPA, the Commissioner agrees with NHS Ayrshire and Arran that the withheld information is not sensitive personal data. Consequently, he need only consider whether any of the conditions in Schedule 2 can be met.
29.Part II of Schedule 1 to the DPA provides assistance in defining "fairness" for the purposes of the first data protection principle.As Lord Hope notes in the case of Common Services Agency v Scottish Information Commissioner (the Collie judgement) "fairness" is concerned essentially with the method by which data is obtained, and in particular with whether the person from whom the data was obtained was deceived or misled as to the purpose or purposes for which the data are to be processed.
30.As Lord Hope also noted in the Collie judgement, the concept of lawfulness cannot sensibly be addressed without considering the conditions set out in Schedule 2 (and Schedule 3 also, where it is applicable), because any disclosure which fails to meet at least one of the necessary conditions would be contrary to section 4(4) of the DPA (which provides that it shall be the duty of the data controller to comply with the data protection principles).There may also be other reasons as to why the disclosure of information is unlawful, for example because disclosure of the information would be a breach of confidence or because there is a specific law forbidding disclosure.In this case, NHS Ayrshire and Arran has not put forward any arguments as to why the disclosure of the personal data would be unlawful otherwise than as a result of breaching the first data protection principle.
31.When considering the conditions in Schedule 2, the Commissioner has also noted Lord Hope's comment in the Collie judgement that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.
32.NHS Ayrshire and Arran advised that it had considered the six conditions for processing contained in Schedule 2 to the DPA and did not believe any of them to be met.It advised that it had contacted the three successful candidates for the post of Sexual Health Nurse and sought their consent to allow their personal data to be disclosed.It also advised that the three successful candidates had expressly refused consent to the release of their personal data.That being the case, the first condition in Schedule 2 (that the data subject has given consent to the processing) could not be met in this case.
33.The Commissioner considers condition 6 to be the only condition in Schedule 2 which might permit disclosure in this case.Condition 6 permits personal data to be processed if the processing (which in this case would be by disclosure in response to Ms Alexander's information request) is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights, freedoms or legitimate interests of the data subject (in this case, the candidates for the post of Sexual Health Nurse).It is clear from the wording of this condition that each case will turn on its own facts and circumstances.
34.There are, therefore, a number of different tests which must be considered before condition 6 can be met.These are:
Does Ms Alexander have a legitimate interest in obtaining the withheld personal data?
If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the candidates in question?
Even if the processing is necessary for Ms Alexander's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the candidates.As noted by Lord Hope in the Collie judgement, there is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Ms Alexander must outweigh rights and freedoms or legitimate interests of the candidates before condition 6(1) will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that NHS Ayrshire and Arran was correct to refuse to disclose the personal data to MsAlexander.
35.NHS Ayrshire and Arran stated that it was not aware of any legitimate interests of Ms Alexander which would merit consideration of condition 6, noting that it was for the Commissioner to make any decision as to Ms Alexander's claim to hold a legitimate interest.
Does Ms Alexander have a legitimate interest?
36.In her submissions to the Commissioner, Ms Alexander set out what she considered to be her legitimate interests in receiving the withheld information.She stated that she was seeking to access this information in an effort to understand whether the application and interview process for the post of Sexual Health Nurse had been transparent, open, fair and without bias.
37.Ms Alexander was concerned that the process was not truly open since she had ascertained that the GU Module of the Sexual Health Certificate Course was not introduced until 2003, thus putting her and other applicants who had obtained the certificate prior to that date at a great disadvantage.As a result, she wished to confirm whether all candidates interviewed held all the essential qualifications for the post, in order to understand why her own application had been rejected.She re-iterated that she was not seeking to know the names or identities of the other applicants.
38.The Commissioner accepts that as someone who applied for the post of Sexual Health Nurse, whose application was unsuccessful and who is dissatisfied with the feedback she has received from NHS Ayrshire and Arran, Ms Alexander has a legitimate interest in this information.The Commissioner is of this view as he accepts that applicants should be entitled to understand fully why they have not been successful in applying for posts.He also accepts that Ms Alexander's legitimate interest in seeking to ensure that the application and interview process was transparent, open, fair and without bias reflects the wider public interest in the manner in which recruitment processes are managed.
Is the disclosure necessary to achieve these legitimate aims?
39.The Commissioner must now go on to consider whether the disclosure of the withheld information is necessary to achieve Ms Alexander's legitimate aims.
40.In its submissions to the Commissioner on this point, NHS Ayrshire and Arran stated that, on the basis that Ms Alexander was concerned with the transparency and openness of its recruitment procedure, her legitimate interest had to a large extent been met by the information released to her.It submitted that she could also request a copy of its recruitment procedures to ensure that they have been adhered to, arguing that this might assist her in achieving her legitimate aims without the need to interfere with the privacy of the candidates.It did not believe the disclosure of the personal data withheld to be necessary to meet her legitimate interests.
41.Having considered the information withheld together with Ms Alexander's legitimate interests, the Commissioner accepts that this information would fulfil her legitimate interests in understanding whether all the short listed and interviewed candidates had all the essential qualifications for the post.In this connection, he notes that while the mentorship qualification may not in fact have been essential for the post, it was described as such to applicants.
42.While the Commissioner recognises the point made by NHS Ayrshire and Arran that Ms Alexander could seek to access its recruitment procedures, he does not accept that these would address Ms Alexander's query as to whether the candidates who were short listed and interviewed held the required qualifications to meet all of the essential criteria.Access to the procedures might help Ms Alexander to reach a view as to whether the process actually followed by NHS Ayrshire and Arran was in line with those procedures and to that extent to understand if it was fair and equitable, but it would not meet her legitimate interests in full.In the circumstances, the Commissioner cannot identify a means of meeting those legitimate interests which would be less intrusive than disclosure of the withheld personal data.
43.As the Commissioner is satisfied that disclosure of the withheld information would be necessary to achieve some of Ms Alexander's legitimate interests, he is required to go on to consider if it would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the candidates in question.
Would disclosure of information cause unwarranted prejudice to the rights and freedoms or legitimate interests of the candidates?
44.In its submission to the Commissioner on whether release of the withheld information would cause unwarranted prejudice, NHS Ayrshire and Arran explained that it had taken into consideration guidance produced by the Information Commissioner (who is responsible for the enforcement of the DPA across the whole of the UK) on access to information about public authorities' employees[2].It pointed out that this guidance stated more senior staff and those carrying out public functions should expect more information about them to be disclosed: it did not regard the post of Sexual Health Nurse as a senior post and argued that it would not have been reasonable for the short listed candidates to have expected this information would be released.Referring again to the Information Commissioner's guidance, it submitted that the role of Sexual Health Nurse was not so unique that information about the qualifications held by candidates for it should be disclosed.
45.NHS Ayrshire and Arran also explained that it had relied on the views expressed by the Commissioner in his decision 055/2007 Professor Ronald MacDonald and Highland Council, where he commented that "information that is included on an application form submitted to a specific organisation in response to a job advertisement, such as qualifications obtained, is normally supplied in the expectation that it will be seen by only those involved in the recruitment process.Applicants would not expect this information to appear subsequently in the public domain".
46.In NHS Ayrshire and Arran's view the candidates applying for a job vacancy would have the expectation and the right that their personal information would be kept confidential during and after the recruitment process.However, NHS Ayrshire and Arran also accepted that there might be times when there was a legitimate public interest to disclose clinical qualifications so that the public could have confidence in the medical staff carrying out their treatment and care.
47.In this case, NHS Ayrshire and Arran submitted that there had been no issues of concern about the level of confidence in the staff themselves but a doubt as to the robustness of the recruitment procedures of the organisation.As a consequence, it argued that there were other more legitimate means of ensuring that all procedures had been adhered to without disclosing personal data of the candidates.
48.NHS Ayrshire and Arran stated that it had already released the majority of the information sought by Ms Alexander which would allow her to assess that certain qualifications were deemed to be essential to be short listed for the post.It went on to submit that it was unfortunate that the mentorship course was listed as essential as this was clearly not the case (as in fact it had no bearing on the successful candidate's ability to practice), but argued that it would still be unfair to disclose any relevant personal data as this would not provide any further information on the recruitment procedures and whether they had been properly adhered to.
49.NHS Ayrshire and Arran restated (while appreciating that this was not decisive) that all three of the successful candidates had been contacted and asked to give their consent to the release of this information, but that each of them had explicitly refused to give consent.
50.The Commissioner accepts and agrees with the submission made by NHS Ayrshire and Arran that those submitting an application form for a job will generally have a legitimate expectation that the personal details contained in the form would be seen only by those involved in the recruitment process and would otherwise remain confidential.He accepts that such individuals would not usually expect personal information about their qualifications to be placed in the public domain.He also agrees that the post of Sexual Health Nurse is not of such seniority that the candidates would generally expect that their qualifications and personal data would be subject to scrutiny in the public domain.
51.The Commissioner recognises that NHS Ayrshire and Arran has disclosed information as to the clinical qualifications held by the short listed candidates.However, he agrees that release of details of the attainment or otherwise of a mentorship qualification (which essentially is what the withheld information would disclose), which by NHS Ayrshire and Arran's own admission is not essential to carrying out the duties of the post, would be unfair to the candidates and would be contrary to their legitimate interests and expectations.
52.On balance, therefore, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfil Ms Alexander's legitimate interests (at least in part), he does not agree that this outweighs the unwarranted prejudice that would be caused to the short listed candidates' rights, freedoms and legitimate interests.The Commissioner is therefore satisfied that condition 6 of Schedule 2 to the DPA is not met in this case.
53.Having accepted that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interestof the candidates as described above, the Commissioner must also conclude that disclosure would be unfair.As condition 6 is not met, he would also regard disclosure as unlawful.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure and therefore that the withheld information was properly withheld under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that Ayrshire and Arran NHS Board complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Ms Alexander.
Appeal
Should either Ms Alexander or Ayrshire and Arran NHS Board wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
13 March 2009
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a)at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Recital 26
Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable ?
[1] [2008] UKHL 47: http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] Data Protection Technical Guidance: Freedom of InformationAccess to information about public authorities' employees
