Decision 031/2011 Ian Scott and the Scottish Prison Service Payment of recruitment and retention allowances Reference No: 201000579 and 201001393 Decision Date: 17 February 2011

Summary

Mr Ian Scott (Mr Scott), in two associated requests sought information from the Scottish Prison Service (the SPS) concerning the award of a recruitment and retention allowance (RRA) to posts within the SPS. The SPS responded by withholding the information requested under the exemption in section 38(1)(b) of FOISA (Personal information) although it did provide him with some generic background information. Following a review, Mr Scott remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the SPS had failed to deal with Mr Scott's requests for information fully in accordance with Part 1 of FOISA.While the SPS had correctly applied the exemption in section 38(1)(b) to some of the information under consideration, the Commissioner concluded that this exemption had been incorrectly applied to withhold much of the information requested by Mr Scott.

The Commissioner required the SPS to provide Mr Scott with all of the information he had requested, except for the names of the holders of posts in receipt of an award of RRA, the exact value of the allowance and other personal details of these post-holders contained in business cases supporting the award of RRA.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and 1(6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i)and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions); Schedule 1 (Data protection principles) (the first data protection principle); Schedule 2 (Conditions relevant for the purposes of the first principle: processing of any personal data) (condition 6(1))

Background

1.This case relates to two related information requests which will be referred to as the first request and the second request respectively in what follows.

2.On 15 December 2009, Mr Scott (an employee and union representative within the SPS) wrote to the SPS requesting the following information (the first request):

a.A list of all posts that attracted recruitment and retention allowance (RRA) at 30 June 2009, broken down to individual establishments including [SPS Headquarters] Calton House;

b.The date when RRA payments commenced for each post;

c.The business case presented as justification for RRA in relation to each post;

d.Information relating to any review of RRA payments for individual posts.

3.On 31 December 2009, Mr Scott wrote again to the SPS amending the first request to include the following additional information:

a.The names of staff who work for SPS who were in receipt of RRA at 30 June 2009;

b.The names of staff who work for SPS who were in receipt of RRA at 31 December 2009;

c.The monthly payment that each person received in relation to RRA.

4.The SPS responded on 1 February 2010 providing some general information regarding the total number of posts in receipt of RRA and the total annual value of RRA payments.However, it withheld the specific information requested by Mr Scott as it regarded it to be personal information exempt from disclosure under section 38(1)(b) of FOISA

5.On 9 February 2010, Mr Scott wrote to the SPS requesting a review of its decision as he did not consider the information requested to be exempt. In particular, Mr Scott informed SPS that he was not asking for information about individual salaries, only allowances. He indicated that he believed that the SPS could have provided much more supplementary information in areas where the section 38 exemption had been applied and also requested the following additional information (the second request):

a.The numbers of those receiving RRA broken down into establishment, function and pay band;

b.The range of dates RRA commenced, broken down into years;

c.How many business cases were presented in relation to each post;

d.How many reviews have taken place in relation to each post;

e.The current minimum, maximum and average RRA payments.

6.The SPS notified Mr Scott of the outcome of its review of its handling of the first request, and provided its response to the second request in an undated letter received by him on 11 March 2010. The outcome of the review with respect to the first request upheld the original decision to withhold the information requested under section 38(1)(b) of FOISA.

7.In relation to his second request, the SPS provided a partial breakdown of the posts in receipt of RRA by job function as well as information relating to the minimum, maximum, mean and median values of RRA payments. The SPS maintained its position that providing a breakdown of the award of RRA by establishment or by pay band could identify the recipients and was therefore exempt under section 38(1)(b) of FOISA. The SPS did not respond specifically to points b, c and d in the second request.

8.On 16 March 2010, Mr Scott wrote to the Commissioner, stating that he was dissatisfied with the outcome of SPS' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

9.The application in respect of his first request was validated by establishing that Mr Scott had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request. However as Mr Scott had not requested a review in relation to his second request, he was advised that the Commissioner could not consider his second request until he had done so.

10.On 16 April 2010 Mr Scott wrote to the SPS requesting a review of its decision in relation to points a, b, c and d of his second request. He commented with respect to point a, that he considered that a breakdown of the award of RRA by establishment only could have been provided. He also highlighted that he had not received a response to points b, c and d and indicated his belief that providing the information requested did not require the identification of particular individuals or posts.

11.The SPS notified Mr Scott of the outcome of its review of his second request on 24 May 2010. In relation to point a, the SPS indicated that even restricting the response to a breakdown by establishment would be likely to result in the identification of recipients due to small numbers of staff in receipt of RRA and would therefore disclose information which was exempt under section 38(1)(b) of FOISA. In relation to point b, the SPS provided some background to the introduction of RRA in 1994 and indicated that the longest-standing award of RRA dated from 1999 and the most recent from 2009. In relation to point c, the SPS indicated that some business cases covered a group of employees while others related to "singletons" and were considered on a case by case basis. In relation to point d, the SPS provided information indicating that the number of reviews would depend upon how long a particular RRA had been in payment.

12.On 4 July 2010, Mr Scott wrote to the Commissioner stating that he was dissatisfied with the outcome of SPS' review of his second request and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

13.The application in respect of his second request was validated by establishing that Mr Scott had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request. The Commissioner decided it was appropriate, given the relationship between Mr Scott's requests, to conjoin the applications and instructed the investigating officer to extend the investigation of the first request to include the second request.

Investigation

14.The SPS is an agency of the Scottish Ministers (the Ministers) and, in line with agreed procedures, the Ministers were notified in writing on 13 April 2010 that a valid application for decision (with respect to the first request) had been received from Mr Scott and were asked to provide the Commissioner with any information withheld from him. The Ministers responded with the information requested and the case was then allocated to an investigating officer.

15.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions.The Ministers were asked to justify their reliance on any provisions of FOISA considered applicable to the information requested by Mr Scott, and to provide details of business cases for the award of RRA (which had not been supplied in response to the previous request for withheld information). The Ministers responded by providing the information requested along with its justification for withholding the information that is discussed in detail below.

16.On 19 July 2010, the investigating officer notified the Ministers in writing that an application in respect of his second request had been received from Mr Scott and asked it to provide the Commissioner with any further information withheld from him that had not been provided in relation to his first request. The Ministers were also asked to provide comments on this application (again in line with section 49(3)(a) of FOISA) and to respond to particular requests from the investigating officer The Ministers responded with the information and comments requested.

17.Subsequent references to submissions from the SPS are references to submissions made by the Ministers' Freedom of Information Unit on behalf of the SPS.

18.Mr Scott was also invited to comment on the issues raised in these cases.

19.Comments received from both Mr Scott and the SPS are summarised, where relevant, below.

Commissioner's analysis and findings

20.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Scott and the SPS and is satisfied that no matter of relevance has been overlooked.

21.In dealing with both of Mr Scott's requests, the SPS's position has consistently been that it regarded the information requested to be exempt from disclosure under section 38(1)(b) of FOISA as the information was personal data (as defined within the Data Protection Act 1998 (the DPA)), disclosure of which would breach the first data protection principle. The SPS did provide some generic information relating to total cost and distribution of RRA.However, this information did not directly address the specific requests made by Mr Scott.

Consideration of section 38(1)(b) ? personal information

22.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (b), exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule1 to the DPA.

23.The SPS has maintained that the withheld information is personal data, disclosure of which would breach the first data protection principle.

Is the withheld information personal data?

24.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

25.The SPS has argued that all of the information withheld from Mr Scott is personal data.Although some of his requests sought information about the posts to which RRA had been awarded, it noted that the roles attracting RRA have either one or a small number of post-holders. It maintained that when considered in conjunction with information known to Mr Scott, it would be possible to identify all individuals in receipt of RRA if given post-specific information.

26.The Commissioner accepts that the information withheld from Mr Scott is personal data. Whether the categories of information sought by Mr Scott refer to named individuals or the posts they occupy, or statistical information relating to RRA awards, that information generally relates to payments that are made to individuals, and the reasons why those payments should (continue to) be made to those individuals.As such, the Commissioner considers that information to relate to living individuals, who can be identified from that information either alone or in conjunction with other information held by the SPS.

The First Data Protection Principle

27.As noted above, the SPS has claimed that disclosure of the personal data under consideration in this case would breach the first data protection principle.

28.The first data protection principle requires that personal data be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (to the DPA) is also met. In this case, processing would be by disclosing the information into the public domain in response to Mr Scott's requests for information.

29.There are therefore three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are inter-linked. If there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

30.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and he is satisfied that the personal data under consideration in this case do not fall into this category. Therefore, it is not necessary to consider the conditions in Schedule 3 to the DPA in this particular case.

31.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. If any of these conditions can be met, he will then go on to consider whether the disclosure of this personal data would otherwise be fair and lawful. If no conditions can be met, he must find that the disclosure would breach the first data protection principle.

Can any of the conditions in Schedule 2 to the DPA be met?

32.The Commissioner's guidance[1] on the section 38 exemption identifies that in practical terms there are only two conditions in schedule 2 that would allow personal data to be processed in relation to a request for information under FOISA, namely:

a.Condition 1 ? the data subject has given his consent to the processing; or,

b.Condition 6 ? the processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. the individuals to whom the data relate).

33.In its submissions, the SPS indicated that it had considered the conditions in Schedule 2 but did not consider that any of the conditions would allow information to be disclosed to Mr Scott. It indicated that in previous negotiations with Mr Scott it had offered to seek the consent of the data subjects to disclose the information but this had been rejected as Mr Scott did not consider there was a reasonable prospect of consent being granted. The SPS also indicated that it had offered to allow Mr Scott to review the information in confidence under the auspices of a Union / Management agreement that would fully serve any legitimate need or interest.

34.The Commissioner considers that, by rejecting an offer by the SPS to seek the consent of the data subjects, Mr Scott has excluded the possibility of condition 1 being met in this case. The Commissioner therefore concluded that only Condition 6 might potentially be applicable in the circumstances of this case.

35.There are a number of different tests which must be satisfied before condition 6 can be met. These are:

a.Does Mr Scott have a legitimate interest in obtaining the personal data?

b.If yes, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the employees in question?

c.Even if the processing is necessary for Mr Scott's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects? There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA. Accordingly, the legitimate interests of Mr Scott must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the SPS was correct to refuse to disclose the personal data to Mr Scott.

Does Mr Scott have a legitimate interest in obtaining the personal data?

36.Mr Scott explained that in his role as a union representative he was concerned that there was a lack of transparency regarding the distribution of RRA across the prison service in Scotland as well as the level of such awards and the length of time that individual RRAs had been awarded to posts. He indicated that he was anxious to establish that the award of RRA was being applied fairly across the workforce and expressed some concern that there was a concentration of awards of RRA in Headquarters posts. Mr Scott explained why he requested each of the categories of information sought by his requests, and how they would contribute to the overall analysis.

37.He also indicated that, other than the pay band, he did not have any interest in obtaining information regarding the specific salaries paid to individuals holding a post that attracted the award of RRA; his only interest related to what he termed "a temporary allowance".

38.In its submissions, the SPS accepted that, as an employee and union representative, Mr Scott does have a legitimate interest in ascertaining the fairness or otherwise of pay and allowances paid to SPS employees. However, it also indicated that, having refused its offer to allow him to review the withheld information in confidence, Mr Scott's motivation was not ascertaining fairness of the award of RRA but was in a political capacity seeking to publicly identify individuals and the levels of RRA awarded to them to enhance his personal reputation in the union.

39.The Commissioner considers that Mr Scott's interest in increasing the transparency and assessing the fairness of the award of RRAs reflects a wider public interest (which is shared with staff across the SPS) regarding the distribution of public funds. Whether or not this more general interest is accompanied by private interests, the Commissioner considers that Mr Scott has a legitimate interest in obtaining the personal information requested.

Is the disclosure necessary to achieve these legitimate aims?

40.Having established that Mr Scott does have a legitimate interest in obtaining the personal information, the Commissioner must now go on to consider whether the disclosure is proportionate as a means and fairly balanced as to ends, or whether these legitimate aims could be achieved by alternative means which would interfere less with the privacy of the employees in question.

41.The SPS informed the Commissioner that during the review process it had offered Mr Scott the opportunity to discuss and consider any format of the information requested that would be helpful to him, but that would not identify individuals. The SPS indicated that Mr Scott rejected this opportunity stating that he was not interested in receiving information that failed to identify the data subjects and he was simply interested in receiving a list of names, as requested.

42.The Commissioner considers that assessment of the fairness of allocation of RRA in line with Mr Scott's legitimate interest would require comparison of the distribution of posts which attract RRA across the SPS.Such analysis could only be done effectively via disclosure that identifies (at least) the relevant posts.The Commissioner has accepted that such disclosure would also have the effect in most instances of identifying the post holders in receipt of RRA.

43.Having considered the SPS's comments regarding its willingness to consider disclosure in a format that would not allow identification of post-holders, the Commissioner can only conclude that the type of information that might have been provided to Mr Scott under this arrangement would have been redacted or restricted to the extent that it would have been impossible to assess the fairness of the award of RRA in the way he envisages.As such, it would not enable Mr Scott to pursue his legitimate interests.

44.The Commissioner has also considered whether the SPS's offer to allow Mr Scott to review the information in full, in confidence, means that processing via disclosure in response to his requests under FOISA is unnecessary for the purposes of his legitimate interests.As noted above, the SPS has maintained that such disclosure would fully serve any legitimate need or interest

45.Mr Scott informed the Commissioner that the offer to review the information was made verbally by a senior member of SPS staff during a meeting in March 2010, prior to the SPS providing him with its response to his request for review. He indicated that the offer was quite vague and conditional upon the information reviewed remaining confidential. Mr Scott considered that the terms of this offer were insufficient to determine whether he would be able to establish the fairness or otherwise of the award of RRA to certain posts. Mr Scott also indicated that the condition of confidentiality meant that, should he identify anything that caused him concern regarding the award of RRA, he would be prevented from sharing the information upon which his concern was based with anybody else.

46.The Commissioner is clear that restricted access to information under a confidentiality agreement, such as that mentioned above, is substantially different from the public release of information under FOISA. In the circumstances, the Commissioner considers the restrictions of confidentiality would substantially limit Mr Scott's ability to pursue his legitimate aims.Disclosure only on the basis of a confidentiality agreement would prevent him from sharing evidence to support his analysis of the fairness of the RRA among colleagues or other parties with whom he wishes to engage in discussion.

47.Accordingly the Commissioner again considers that the limited form of disclosure proposed by the SPS is insufficient for the purposes of Mr Scott's legitimate aims.

48.In the light of the above, the Commissioner is generally persuaded that disclosure of the information requested by Mr Scott in response to his requests made in terms of FOISA is necessary for the purposes of his legitimate interests.

49.However, he has concluded that the necessity test cannot be met in relation to Mr Scott's requests for the names of the recipients of RRA at 30 June 2009 and 31 December 2009.While the Commissioner has recognised that the disclosure of a list of posts will in most cases allow the identification of the person holding the posts, he considers that disclosure of the post rather than the post holder is a less intrusive method of allowing Mr Scott's legitimate interests to be met.

50.The Commissioner has noted that Mr Scott has explained that he wishes to know the names of recipients of RRA at two particular dates to allow him to consider whether or not a person was or is in receipt of RRA having left the post or position it was intended for.

51.He recognises that such an assessment forms part of the wider analysis of the fairness and appropriateness of distribution of RRA awards.As such, there is a legitimate interest in obtaining the information for that purpose.However, this aspect of the analysis proposed by Mr Scott would involve considering the individual circumstances of post-holders over time.Disclosing the list of names of post-holders at the two specified dates would allow the identification of changes to their employment and financial circumstances over time.

52.Having regard to the contribution this analysis would make to Mr Scott's overall analysis of the fairness of the RRA awards, the Commissioner does not consider that access to this information would actually allow the insights that Mr Scott suggests.In particular, he notes that access to the two lists of names along with the other information requested by Mr Scott would not allow any conclusion to be drawn as to why a person who had changed posts was in receipt of RRA at both dates specified by Mr Scott.While he suggests it might be that they were still receiving RRA that was awarded to their old post, it might equally be that they had moved to a different post to which RRA had been awarded.

53.In the circumstances, the Commissioner considers that disclosure of the names of staff in receipt of RRA at the two dates specified by Mr Scott would contribute very little to any analysis of the fairness of the distribution of RRA within the SPS. In the circumstances, the Commissioner considers that disclosure of the names of recipients of RRA would be disproportionate and that the legitimate ends identified by Mr Scott can be met by less intrusive means.

54.Having concluded that the test of necessity cannot be met in relation to the names of the recipients of RRA, the Commissioner concludes that no condition within Schedule 2 of the DPA can be met in relation to this information, and so disclosure would breach the first data protection principle.For this reason, the Commissioner accepts that the SPS applied the exemption in section 38(1)(b) of FOISA to this information.

55.Having concluded that disclosure of the remaining personal data was necessary for Mr Scott's legitimate interests, the Commissioner will go on to consider the final test within condition 6 in relation to this information.

Would disclosure cause unwarranted prejudice to the rights and freedoms of the data subjects?

56.The SPS maintained that disclosure of the withheld information was unwarranted, because it would compromise the reasonable expectations of privacy of the individuals concerned.

57.The SPS explained that the RRA is an additional payment for recruitment and retention purposes received by a very limited number of staff occupying posts in which the SPS requires specific knowledge, skills and experience or where the pay band does not match the local job market rate for such qualities.It informed the Commissioner that none of the individuals occupying posts in receipt of RRA are Directors and all are employed below Senior Civil Servant level.

58.The SPS submitted that, as none of the recipients worked at grades where salary and pay information are routinely released and/or work in public facing posts with responsibility for major policy decisions or financial expenditure, they would have no expectation that their personal pay information would be released.

59.The Commissioner has considered these arguments and set out his conclusions in relation to each of the types of information that remains under consideration in what follows.In so doing he has had regard to the guidance[2] issued by the Information Commissioner, who has responsibility for oversight of the DPA, entitled "Public Sector Salaries: how and when to disclose" (the ICO guidance). This guidance indicates that those who are paid from the public purse should expect some information about their salaries to be made public. However, the guidance also acknowledges that salary information relates to personal financial circumstances and deserves some protection.

60.The Commissioner accepts that the staff members in receipt of RRA would be unlikely to hold any expectation that details of their salaries would be disclosed in response to a request under FOISA, given their level of seniority within the SPS.However the Commissioner notes that the information under consideration in this case, although including the salary bands of RRA recipients, does not include precise salary information.Disclosure of a salary band (which is often included on publicly available recruitment information) will be considerably less intrusive than disclosure of actual salary.

61.The Commissioner notes further that any disclosure of the pay bands of staff receiving RRA in this case would be in response to a request for numbers of recipients broken down by pay band (as well as establishment and function).Such disclosure would not associate a particular salary or pay band with any individual person or post.

62.Nonetheless, the information under consideration in this case would provide some insight into the remuneration of staff who are in receipt of RRA.The Commissioner accepts that the staff concerned may not expect such information to be disclosed.Indeed, it appears Mr Scott has acknowledged this, when refusing the SPS's offer to seek consent to disclosure from post-holders on the grounds that he did not expect it to be granted.

63.The Commissioner would note, however, that RRA is not a performance related award, but is an allowance designed to recruit or retain individuals in a small number of identified posts and which does not directly reflect the performance of those individuals.As such, he considers that disclosure that a person receives RRA, or the value of RRA payments made to them, would be less intrusive into their financial affairs or individual performance at work than disclosure of information about their whether they received (or did not receive) a performance-related bonus or the value of such a bonus.

64.The Commissioner's task in what follows is to balance the expectations and legitimate interests of the data subjects in this case (i.e. the staff in receipt of RRA) against the legitimate interests identified by Mr Scott to establish whether disclosure would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects.It is only if the identified legitimate interests outweigh those of the data subjects that condition 6 will apply in this case.

Post titles, establishment and function

65.The Commissioner first considered the balancing exercise in relation to the following types of information:

a.a list of posts in receipt of RRA and their establishment (first request)

b.numbers of staff in receipt of RRA by establishment and function and pay band (second request)

66.The Commissioner's view is that b. above is essentially the list of posts and their establishments presented in a slightly different (and potentially less intrusive) way.Since SPS publishes its salary bands, and its internal job adverts will refer to the salary band associated with the vacant post, the Commissioner considers that disclosure of the list of posts in receipt of RRA and their establishment would readily allow understanding (at least by members of SPS staff) of the number of posts receiving RRA within each pay band, as well as the post function.

67.The Commissioner therefore considers that his conclusions with respect to the list of posts and their establishments will be equally applicable to the numbers of staff in receipt of RRA broken down by establishment, function and pay band.

68.Having accepted that both of these groups of data contain personal data, the Commissioner recognises that disclosure of the list of posts will (in most or possibly all instances) allow identification of the relevant SPS staff member receiving RRA.

69.That disclosure would allow some insight into the financial affairs of the data subjects, by revealing that the post holder is paid an allowance in addition to their regular salary.Since this allowance is awarded in recognition of the importance of recruiting and retaining staff with the necessary skills within that post, disclosure would also suggest that the post-holder has skills that are valuable or in short supply on the job market (either in general or within the geographical area in which they work).

70.However, the Commissioner notes that this disclosure reveals nothing more than this about their individual financial affairs (such as their salary, the level of the award, or their performance at work).The factors under-pinning the award of RRA do not directly reflect the full range of skills, experience, knowledge or the performance of the post-holder, but they relate to the needs of the post.

71.In the light of all of the above, the Commissioner considers that the level of intrusion into the private lives of the data subject from the disclosure of the fact that RRA has been awarded to their post is very limited.

72.Having balanced the rights, expectations and legitimate interests of the post holders against the legitimate interest identified by Mr Scott, the Commissioner has concluded that disclosure of the title and establishment of each of the posts in receipt of RRA would not cause unwarranted prejudice to the rights and freedoms of the data subjects.In line with his comments above, the Commissioner has reached the same conclusion with respect to the numbers of staff in receipt of RRA broken down by establishment, function and pay band.

73.The Commissioner therefore concludes that condition 6 can be met with respect to this information.

Monthly payments to recipients

74.The Commissioner next considered the balancing exercise in relation to the monthly payment that each person received in relation to RRA (first request).

75.When asked to provide the information withheld in this case to the Commissioner, the SPS provided details of the value of RRA by reference to the sums awarded to the individuals receiving RRA, as at 30 June and 31 December 2009.

76.Having concluded above that it was not necessary to disclose the names of recipients of RRA at the two specified dates in order to meet Mr Scott's legitimate interests, the Commissioner has consequently limited his consideration of this information of the value of the award made in relation to each post receiving it at 30 June 2009.The Commissioner recognises that disclosure would be likely to allow the identity of the recipient of the payment to be identified in most or all cases.

77.In assessing whether disclosure of this information would cause unwarranted prejudice to the rights and freedoms of the data subjects, the Commissioner was again mindful of the ICO guidance. The guidance indicates that there will always be some legitimate interest in knowing how public money is spent, how public sector salaries compare with those in other areas and how money is distributed between different levels of staff. However, it makes clear that this legitimate interest can often be met via routine disclosure of salary bands, and without individuals' salary information being disclosed.

78.The ICO guidance identifies situations in which disclosure of the advertised salary band is insufficient to answer legitimate questions.This includes where the pay scales do not disclose the full cost to the authority, such as when there is a significant element of performance related pay or other bonuses is paid.In circumstances where it is appropriate to reveal detail of an individual's remuneration, the ICO guidance suggests that in most cases, it will be sufficient to release the approximate amount paid to an individual, for example, to the nearest ?5,000.

79.The ICO guidance indicates that it will only be in exceptional circumstances that disclosure of an exact salary may be appropriate.Examples of exceptional circumstances include cases where there are current controversies or credible allegations or where the individual(s) in question are paid significantly more than the usual salary for the post, or have significant control over the setting of their own or others' salaries.

80.The Commissioner considered that the comments in the ICO guidance regarding the circumstances where it may be appropriate to release approximate and precise salary information to be relevant also to considering whether disclosure of the approximate or precise value of RRA awarded to individual post-holders would be unwarranted.

81.He has concluded that the award of RRA means that knowing the pay scale associated with the relevant posts is not sufficient to identify the full cost to the SPS of employing the staff concerned, or to allow an evaluation of the fairness with respect to the value of this award, as proposed by Mr Scott.

82.The Commissioner notes that disclosure of the value of individual RRA payments would not reveal the salary of the individuals concerned, but recognises that it would reveal one element of their overall remuneration.In conjunction with the salary band associated with that post, this information would provide some indication of the total remuneration received by the post-holder.As such, disclosure of the actual amount paid would involve some intrusion into the private lives of the individuals concerned.The Commissioner does not consider thatexceptional circumstances of the type discussed in the ICO guidance are present in this case and, having balanced the legitimate interests of Mr Scott against those of the data subjects, he has concluded that disclosure of the precise monthly value of the award would be unwarranted in this case.

83.However, the Commissioner considers that the level of intrusion into the private lives of the individuals will be limited if only the approximate value of RRA payments were disclosed.

84.In considering how the payments might be expressed in an approximate form, the Commissioner has noted that the ICO suggestion of disclosure in ?5000 bands was made in relation to annual salary details.Dividing this by 12 to allow banding of monthly payments would suggest the use of bands of ?400.The Commissioner does not consider these would be sufficiently narrow to provide real insights into the variation between RRA payments across the posts under consideration.

85.The Commissioner has found the guidance on disclosing directors' remuneration within the HM Treasury Financial Reporting Manual[3] also to be of assistance when considering this matter.This recommends (at paragraph 5.2.19) disclosing salary information within ?5000 bands, and increases each year in the individuals' pension and any related lump sum at age 60 in bands of ?2,500.

86.In the light of this guidance, the Commissioner considers that ?2500 bands will on occasion be appropriate ways of communicating the approximate value of remuneration where it is of a type involving sums smaller than would be expected for actual salaries.The Commissioner believes that expression of the annual value of RRA awards in bands of ?2500 would considerably reduce the level of intrusion into the private financial affairs of those staff concerned, while enabling insight into the distribution of RRA payments among the posts in receipt of the awards.

87.Using this as a guide for determining the size of bands that would be appropriate for disclosure of monthly payments, the Commissioner has considered the balance of legitimate interests if the value of monthly payments was expressed in terms of ?200 bands.

88.Having balanced the legitimate interests of Mr Scott against those of the data subjects (i.e. the post holders in receipt of the RRA award), the Commissioner has concluded that disclosure of the approximate payments (expressed in terms of ?200 bands - ?1 - ?200; ?201 ? ?400 etc) would not be unwarranted by reason of prejudice to the rights and freedoms of those data subjects.

89.The Commissioner has therefore concluded that, while condition 6 cannot be met in relation to the actual monthly payments made to individual post-holders, condition 6 can be met if the sum paid is disclosed as an approximate value within a band of ?200.

Date of commencement of payment and subsequent reviews of the award of RRA

90.The Commissioner next considered the balancing exercise in relation to the following types of information:

a.the date when RRA payments commenced for each post (first request)

b.information relating to any review of RRA payments for individual posts (first request)

c.the range of dates RRA commenced, broken down into years (second request)

d.how many reviews have taken place in relation to each post (second request)

91.The range of dates when RRA commenced broken down into years would provide information about the commencement of RRA for each post, but in a less detailed and less intrusive manner than was sought in Mr Scott's first request.The Commissioner has therefore focussed in what follows on the actual dates of commencement for each post in the first instance, on the basis that his conclusions in relation to that part of Mr Scott's first request will be applicable also to the range of dates where RRA commenced as sought in his second request.

92.In correspondence with the Commissioner concerning his first request, Mr Scott indicated that the information he wished to obtain about the review of awards amounted to the date of any such review, the identity of the person conducting the review and the outcome.

93.In his submissions to the Commissioner, Mr Scott indicated that he wished to know how long individual RRAs had been in place in order to examine the justifying factors at the time the award was made and also to ascertain if any of these underlying factors had changed over time. He also indicated that, in relation to reviews, while he expected that awards of RRA would be subject to periodic review, he did not know whether there was any form of review conducted to ascertain whether the award of an RRA remained justified with the passage of time.

94.The Commissioner recognise that access to this information would allow Mr Scott or another person with knowledge of SPS staffing to consider which person held or assumed a post at the point where RRA was awarded or reviewed.Since RRA is awarded to enable the SPS to recruit or retain staff with particular skills, inferences might be drawn about the skills of the staff holding the posts at the time of commencement or review of the RRA.

95.Notwithstanding this, the Commissioner considers any intrusion into the private lives of individual recipients of the RRA that would be allowed by disclosure of this information is limited, and is (at most) of a similar nature to that allowed by disclosure of the posts in receipt of RRA.

96.Having balanced Mr Scott's legitimate interests in accessing this information against that of the data subjects, the Commissioner is not persuaded that disclosure would be unwarranted.He consequently concludes that condition 6 can also be met in relation to this information.

The business cases

97.The Commissioner considered the balancing exercise in relation to the following types of information:

a.The business cases presented as justification for RRA in relation to each post (first request)

b.How many business cases were presented in relation to each post (second request)

98.The Commissioner considers that disclosure of the content of the business cases would contribute significantly to the achievement of Mr Scott's legitimate interests by providing insight into the reasons for awarding RRA to particular posts.Consideration of the business cases would be central to any fully informed assessment of the fairness of the SPS approach to the allocation of RRA.

99.However, the business cases contain a range of personal data relating to individual post holders which goes significantly beyond their simple identification as a holder of a post to which an RRA is awarded.The documents include, for example, information about individual post-holders' exact salaries, personal circumstances, and career prospects.The Commissioner considers that where the information within the business cases relays such information about individual post-holders, its disclosure would contribute something to Mr Scott's understanding of the reasons for awarding RRA to that post, but would intrude significantly into the privacy of the individuals concerned.

100.Having balanced the competing legitimate interests of Mr Scott and the post-holders, the Commissioner has concluded that disclosure of much of the content of the business cases would not be unwarranted by reason of prejudice to the rights and freedoms of the data subjects.The Commissioner has reached this conclusion with respect to information that identifies the posts to which an award of RRA was proposed, its grade, and the reasons for the award being proposed.For this information, the Commissioner considers that condition 6 can be met.

101.Having drawn this conclusion, he also considers that Condition 6 can be met in relation to the number of business cases made in relation to each post.

102.Where the information in the business cases relates to individual post-holders, their salaries, career, finances, or other personal circumstances, the Commissioner has concluded that disclosure would be unwarranted in this case, and Condition 6 cannot be met.Consequently, disclosure of this information would breach the first data protection principle, the exemption in section 38(1)(b) of FOISA was correctly applied to this information.

103.Where the business cases refer to the value RRA awarded to particular posts, the Commissioner concludes for the same reasons set out above (when discussing the monthly payments) that disclosure of the precise value of the award would be unwarranted, and so Condition 6 cannot be met.However, considers that disclosure of an approximate sum can meet the legitimate interests of Mr Scott without unwarranted intrusion into the privacy of the post-holders.

104.The Commissioner considers that an appropriate way to indicate the value of RRA awards (which is broadly consistent with the approach taken to monthly payments) would be:

a.where an annual value of an RRA award is mentioned, to indicate the approximate value of this sum in terms of ?2500 bands (?1-?2,500; ?2,501-?5,000 etc.).

b.where a 6-monthly value of an RRA award is mentioned, to indicate the approximate value of this sum in terms of ?1250 bands (?1 - ?1,250; ?1,251 - ?2,500 etc).

105.The Commissioner has therefore concluded that, while condition 6 cannot be met in relation to the actual annual or 6-monthly values of the RRA awards where they are referred to in the business cases, condition 6 can be met if the sum paid is disclosed as an approximate values expressed as above.

Would disclosure otherwise be fair and lawful

106.Having concluded that condition 6(1) can be met in relation to much of the information discussed above, the Commissioner has gone on to consider (as required by the first data protection principle) whether disclosure of that personal data would be fair and lawful.

107.The Commissioner considers that disclosure would be fair, for the reasons already outlined in relation to condition 6.The Ministers have not put forward any arguments as to why the disclosure of the information would be unlawful (other than in terms of a breach of the data protection principles) and, in any event, the Commissioner can identify no reason why disclosure should be considered unlawful.

108.Having found disclosure of this information to be both fair and lawful, and in accordance with condition 6(1), the Commissioner concludes that disclosure of this information would not breach the first data protection principle.He consequently concludes that the exemption in section 38(1)(b) of FOISA was incorrectly applied to this information.

DECISION

The First request

The Commissioner finds that the Scottish Prison Service (SPS) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to Mr Ian Scott's first information request.

The Commissioner finds that the Ministers were entitled to withhold the names of recipients of RRA at the two dates specified by Mr Scott under the exemption in section 38(1)(b) of FOISA.The Commissioner also concluded that this exemption had been correctly applied to certain information within the business cases and the precise value of monthly payments made to individual post-holders.By withholding this information, the SPS acted in accordance with Part 1 of FOISA.

However, the Commissioner finds that the exemption in section 38(1)(b) was misapplied to the remaining information within the business cases and the other information sought by Mr Scott's first request.The Commissioner concludes that by withholding this information, the SPS acted in breach of section 1(1) of FOISA.

The Commissioner also concludes that the SPS acted in breach of section 1(1) by failing to disclose the approximate value of RRA payments (where mentioned in the business cases, or as a list of monthly payments).The Commissioner concluded that the value of the RRA payments, where presented as approximate values (as discussed above), was not exempt in terms of section 38(1)(b).

The Commissioner requires the SPS to disclose all information sought in Mr Scott's first information request, except for the names of staff members in receipt of RRA.This disclosure should be subject to some modification and redactions, however.The value of RRA payments should be disclosed only as approximate values, within the bands discussed above in this decision.The business cases should be redacted to remove exempt information in line with guidance that will be issued by the Commissioner along with this decision.

The information disclosed in response to Mr Scott's request for information relating to any reviews of RRA awards should be (in line with Mr Scott's wishes, as discussed at paragraph 92 above) the date of any review, the identity of the reviewer, and the outcome.

This information should be disclosed to Mr Scott by 4 April 2011.

The Second request

The Commissioner finds that the SPS failed to comply with Part 1 of FOISA in responding to parts (a), (b), (c) and (d) of Mr Scott's second information request (as set out in paragraph 5 above).The Commissioner has found that the SPS misapplied the exemption in section 38(1)(b) of FOISA to the requested information, and by withholding this information, it failed to comply with section 1(1) of FOISA.

The Commissioner now requires the SPS to provide the information sought by parts (a) ? (d) of Mr Scott's second request, also by 4 April 2011.

Appeal

Should either Mr Scott or the SPS wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
17 February 2011

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

...

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

...

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

...

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

...

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

...

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

---

[1] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=3085&sID=133

[2] http://www.ico.gov.uk/upload/documents/library/freedom_of_information/practical_application/salary_disclosure.pdf

[3] http://www.hm-treasury.gov.uk/d/2010_11_chap05_form_and_content.pdf