|
Decision 030/2016: Millar and Bryce Limited and Aberdeenshire Council
List of properties
Reference No: 201502163 and 201502164
Decision Date: 10 February 2016
Summary
On 19 May 2015, Millar and Bryce Limited (Millar and Bryce) asked Aberdeenshire Council (the Council) for lists of properties that do not pay for water and wastewater services in their Council Tax bill.
The Council withheld the information under section 38(1)(b) of FOISA, as disclosure would breach the first data protection principle.
Following an investigation, the Commissioner found that the Council was not entitled to withhold the information under section 38(1)(b) of FOISA. She required the Council to disclose the information.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 19 May 2016, Millar and Bryce made two requests for information to the Council. The information requested was:
a) a list of properties that do not pay for water services in their Council Tax bill; and
b) a list of properties that do not pay for wastewater services in their Council Tax bill.
2. The Council responded on 11 June 2015 to both Millar and Bryce's requests. The Council informed Millar and Bryce that it considered the information to be exempt in terms of section 38(1)(b) of FOISA as disclosure would breach the first data protection principle. It further stated that it did not consider any condition of schedule 2 could be met.
3. On 23 July 2015, Millar and Bryce wrote to the Council, requiring a review of each decision on the basis that it had not requested personal data, merely a list of properties.
4. The Council notified Millar and Bryce of the outcomes of its reviews on 18 August 2015. The Council upheld the original decisions without modification.
5. On 13 November 2015, Millar and Bryce wrote to the Commissioner. Millar and Bryce applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Millar and Bryce stated it was dissatisfied with the outcome of the Council's reviews because it did not accept that section 38(1)(b) of FOISA applied.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Millar and Bryce made requests for information to a Scottish public authority and asked the authority to review its response to those requests before applying to her for a decision.
7. On 7 December 2015, the Council was notified in writing that Millar and Bryce had made a valid application regarding both requests. The Council was asked to send the Commissioner the information withheld from Millar and Bryce. The Council provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions, focusing on the Council's application of section 38(1)(b) of FOISA.
9. The Council responded, explaining why it adhered to its application of section 38(1)(b).
10. Millar and Bryce provided submissions as to why they did not agree that the first data protection principle would be breached by disclosure.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Millar and Bryce and the Council. She is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal Information
12. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
13. The Council submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first protection principle. It therefore argued that the information was exempt under section 38(1)(b) of FOISA.
14. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data, as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle, as claimed.
15. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
16. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."
17. The Council submitted that the information requested was the personal data of the owners and/or occupiers of the properties in question, as the persons liable to pay the relevant water/wastewater charges within their Council Tax bills.
18. The Council submitted that if the lists were disclosed, it would be possible to identify individuals from that information. In support of this, the Council referred to the UK Information Commissioner's Guidance, "Determining what is personal data[1]" (the ICO Guidance), which it stated establishes a principle that, even without a name, data can still be personal data. The individual concerned may still be identifiable without a name.
19. The Council confirmed that the premises listed were all domestic dwellings and the information held would relate to the owner/occupiers of such premises. It concluded that the registered owner, if not necessarily the occupier, could readily be identified from the information.
20. Millar and Bryce, on the other hand, disputed that it was seeking personal data as the information would relate to the property and disclosure would not determine what an owner/occupier would be charged for any water consumption, etc. They submitted that the information related to the property, regardless who the owner/occupier might be.
21. Whilst accepting that the information requested relates to "objects", i.e. the properties in question, the Commissioner accepts that it also relates to the owner/occupiers of the properties, in confirming that they are not liable to pay for water and/or wastewater services within their Council Tax bills.
22. The Commissioner acknowledges a reasonable risk that the owners of the properties in question could be identified if the lists of properties were to be disclosed, by cross-reference with other information available to the public. In any event, as the Council has noted with reference to the ICO Guidance, there is an equal risk of occupiers being identified using the withheld information, even if their names were not known, at least by neighbours and others in the vicinity of the properties in question. To the extent that it confirmed that they were not liable to pay for the services in question via their Council Tax bills, the information could be said to say something about the financial interests of the persons liable, and thus to relate to them.
23. Taking account of all of the circumstances, the Commissioner accepts that the requested information is, in this case, the personal data of the individuals concerned, as defined by section 1(1) of the DPA.
The first data protection principle
24. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain, in response to Millar and Bryce's requests. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (the full text of the principle is set out in the Appendix). If the personal data are also sensitive personal data, at least one of the conditions in Schedule 3 must be met in addition: the Commissioner has considered the definition of sensitive personal data in section 2 of the DPA and is satisfied that this does not apply to the withheld information.
25. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.
26. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
27. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Millar and Bryce. In any event, neither Millar and Bryce nor the Council has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
28. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a. Is Millar and Bryce pursuing a legitimate interest or interests?
b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject(s)?
c. Even if the processing is necessary for Millar and Bryce's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
29. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Millar and Bryce must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Millar and Bryce.
Is the applicant pursuing a legitimate interest or interests?
30. Millar and Bryce submitted that it provides a Property Enquiry Certificate service to the public, which would include the information under consideration here. It highlighted the importance of an accurate and up-to-date service.
31. The Council submitted that it had no doubt Millar and Bryce would believe it had a legitimate interest in obtaining the information, but submitted that this was a commercial interest which might not coincide with the public interest. It made no submissions as to why it would not be in the public interest, other than the arguments as to unwarranted prejudice as considered below.
32. Having considered all relevant submissions she has received on this point, along with the withheld personal data, the Commissioner accepts that Millar and Bryce, as a commercial enterprise offering a commercial service to the public, is pursuing a legitimate interest in seeking the information requested.
Is the processing necessary for the purposes of these interests?
33. When considering this, the Commissioner must consider whether the interests she has identified might reasonably be met by any alternative means, which would interfere less with the privacy of the individual whose personal data has been withheld.
34. The Council accepted that if Millar and Bryce were deemed to have a legitimate interest, then disclosure would be necessary for the purposes of those interests: they could not be met in some other way.
35. Millar and Bryce also highlighted the Council's status as the only source of the information.
36. The Commissioner is not aware of any other viable means of meeting Millar and Bryce's legitimate interests which would interfere less with the privacy of the data subject than providing the information requested. For this reason, and having considered all relevant submissions, she is satisfied that disclosure of the information is necessary for the purposes of Millar and Bryce's legitimate interests.
Would disclosure be unwarranted by reason of prejudice to the legitimate interests of the data subject(s)?
37. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Millar and Bryce's legitimate interests, she must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Millar and Bryce and those of the data subjects. Only if the legitimate interests of Millar and Bryce outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.
38. In the Commissioner's briefing on personal information[2], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
(i) the potential harm or distress that might be caused by disclosure
(ii) whether the individual objected to the disclosure
(iii) the reasonable expectations of the individual as to whether the information should be disclosed.
39. In their submissions, the Council stated that information about an individual's private life will deserve more protection than information about them acting in an official or work capacity. It believed there might be particular distress caused by the disclosure of private information about family life. Some disclosures, it argued (e.g. addresses), could pose a security risk. The Council stated that this type of disclosure was unlikely to be warranted, as the individuals concerned would not have a reasonable expectation that their information would be disclosed.
40. Millar and Bryce submitted that the disclosure of the requested information would not cause any unwarranted prejudice to the rights and freedoms or legitimate interests of the owners/occupiers of the property. It argued that the information said nothing about the affairs of individuals concerned, other than that they were not liable for the relevant charges. The Council Tax band applicable to a particular property was in the public domain, while the fact that a particular property had a private water supply would generally be known in the area.
41. The Commissioner notes that the submissions by the Council are somewhat general in nature. They fail to identify what specific prejudice would be caused by the disclosure. The "security risk" referred to by the Council is not explained, except by way of a passing reference to addresses: it appears to the Commissioner that information on where a particular individual lives might be obtained just as readily, if not more so, by other means.
42. In relation to the reasonable expectations of the data subject, the Commissioner notes that Council Tax Bands are routinely published and searchable by postcode and address on the Scottish Assessors Association (SAA) website[3]. This shows which tax band, A to H, each property falls within.
43. She notes that the SAA website states:
The Council Tax Valuation List is a public document and contains the addresses and Council Tax bands of all domestic properties in the valuation area. It can be inspected at the local Assessor's office. You can check the Council Tax Valuation List entry for any domestic property in Scotland by using the search facility on the SAA or individual Assessor's Home Page on this site.
44. The Commissioner further notes that Aberdeenshire Council (along with other Councils in Scotland) publishes the Council tax payable for each tax band. The published information also includes the specific charges levied for water and sewerage within each tax band.
45. Taking account of what is already published regarding the liability of individual owner/occupiers of properties in relation to Council tax and (where applicable) water and sewerage charges, the Commissioner does not accept that the individuals under consideration here would have any reasonable expectation that such information would not be disclosed. All the information says is that whoever is liable in respect of each property does not have to pay water and/or wastewater charges (as appropriate) to the Council. It says nothing about what they might be required to pay someone else for a private water supply, or what charges they might incur (for example) in relation to a septic tank: in any event, Scottish Water's charges for emptying septic tanks are published on its website[4] and the Commissioner sees no reason why private contractors offering an equivalent service would wish to keep their rates a secret.
46. Based on the submissions received from the Council, the Commissioner has failed to identify any substantiated prejudice to the rights and freedoms of the data subjects in this case.
47. In all the circumstances, therefore, having considered the arguments provided by both Millar and Bryce and the Council, and having weighed Millar and Bryce's legitimate interests against the legitimate interests, rights and freedoms of the owner/occupiers of the premises in question, the Commissioner has concluded that those of Millar and Bryce outweigh those of the data subjects. As a result, she has determined that disclosure would not be unwarranted in this case.
48. Having drawn these conclusions, the Commissioner finds that condition 6 in Schedule 2 (to the DPA) can be met in this case in relation to disclosure of the withheld personal data.
49. As the Commissioner has not accepted that disclosure of the personal data would lead to unwarranted prejudice to the rights, freedoms or legitimate interests of the data subjects, the Commissioner also concludes, for the same reasons, that disclosure of the withheld information would be fair.
50. In the absence of any reason for finding disclosure to be unlawful other than a breach of condition 6 (and none has been put forward by the Council), and given that she is satisfied that condition 6 can be met, the Commissioner must find that disclosure would be lawful in this case. The Commissioner therefore finds that disclosure of the withheld information would not breach the first data protection principle, and so the Council was not entitled to withhold this information under the exemption in section 38(1)(b) of FOISA.
|
Decision
The Commissioner finds that Aberdeenshire Council (the Council) failed to comply with Part 1 (and in particular section 1(1)) of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Millar and Bryce Limited. She finds that the Council was not entitled to withhold the information requested under section 38(1)(b) of FOISA.
The Commissioner therefore requires the Council to disclose the information withheld by 28 March 2016.
|
Appeal
Should either Millar and Bryce Limited or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.
Margaret Keyse
Head of Enforcement
10 February 2016
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6 (1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
[1]
[2]
[3]
[4]
