Decision 035/2013 Mrs Carolyn Neilson and Greater Glasgow and Clyde Health Board

Investigation into excessive working hours

Reference No: 201200703
Decision Date: 7 March 2013

Summary

Mrs Neilson asked Greater Glasgow and Clyde Health Board (NHS Greater Glasgow) for information about an investigation into concerns relating to GPs working excessive hours.NHS Greater Glasgow provided certain information, but withheld personal data, on the basis that disclosure would breach the data protection principles.

Following an investigation, the Commissioner found that NHS Greater Glasgow held additional information falling within the scope of Mrs Neilson's request and she ordered it to disclose the information.However, the Commissioner also accepted that NHS Greater Glasgow was correct to withhold the remaining personal data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.

Background

1.On 27 May 2011, Mrs Neilson wrote to NHS Greater Glasgow requesting the following information:

All documents that show how [two named individuals] investigated the matter [a complaint by Mrs Neilson's husband, Dr Neilson] about certain GPs working excessive hours and the impact of this on patient and public safety], and that confirm the investigation leads and process (request 1);

All information provided by [named individual] for consideration by the Clinical Support Group (CSG) and the detail and result of [named individual]'s enquiries (request 2);

All documentation that details the issues considered by the CSG and how and why it reached their conclusion (request 3);

All documentation that confirms the CSG's conclusions (request 4);

All documentation that details the recommendations made by the CSG (request 5);

All additional documentation held by [NHS Greater Glasgow] in relation to this matter, including minutes of meetings and internal and external email correspondence (request 6).

2.Having received only an acknowledgement, Mrs Neilson wrote to NHS Greater Glasgow on 29 June 2011, requesting a review in respect of its failure to respond.

3.NHS Greater Glasgow responded to Mrs Neilson's request on 25 July 2011.It provided certain information, while other information was withheld on the basis that it was personal data and its disclosure would breach the DPA.It referred to section 33 (Commercial interests and the economy) of FOISA in support of its decision to withhold this information.

4.Following further correspondence, in the course of which NHS Greater Glasgow confirmed that the information was in fact being withheld under section 38 (Personal information) of FOISA, Mrs Neilson wrote to NHS Greater Glasgow on 13 September 2011, requesting a review of its decision to withhold the information.She stated that she had a legitimate interest in obtaining the information; that full disclosure was necessary to achieve that interest; that her legitimate interests outweighed those of the data subjects (and, in the circumstances, any intrusion of privacy was not unwarranted), and that disclosure would be fair and lawful.

5.NHS Greater Glasgow notified Mrs Neilson of the outcome of its review on 18 October 2011.It apologised for the delay in dealing with the request and for quoting the wrong section of FOISA.NHS Greater Glasgow upheld its decision to withhold the personal data, however, under section 38(1)(b) of FOISA: the review concluded that disclosure would breach the first data protection principle.It also concluded that certain information previously identified as falling within the scope of Mrs Neilson's request did not in fact do so.

6.On 11 April 2012, Mrs Neilson wrote to the Commissioner, stating that she was dissatisfied with the outcome of NHS Greater Glasgow's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

7.The application was validated by establishing that Mrs Neilson had made requests for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to those requests.

Investigation

8.On 20 April 2012, NHS Greater Glasgow was notified in writing that an application had been received from Mrs Neilson and was asked to provide the Commissioner with any information withheld from her.NHS Greater Glasgow responded with the information requested and the case was then allocated to an investigating officer.

9.The investigating officer subsequently contacted NHS Greater Glasgow, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, NHS Greater Glasgow was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested, with particular reference to the requirements of section 38(1)(b).

10.Mrs Neilson's dissatisfaction related to the following:

she had not received information to which she believed she was entitled;

she believed further information was held by NHS Greater Glasgow; and

certain information had been identified by NHS Greater Glasgow as falling outside the scope of her requests.

11.The relevant submissions received from both NHS Greater Glasgow and Mrs Neilson will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to her by both Mrs Neilson and NHS Greater Glasgow and is satisfied that no matter of relevance has been overlooked.

Information held by NHS Greater Glasgow

13.Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to certain restrictions which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.The restrictions referred in section 1(6) are not under consideration in this case.The information to be given is that held by the authority at the time the request is received, as defined in section 1(4).

14.NHS Greater Glasgow's review response referred to three categories of information that it held.These were:

a)information not falling within the scope of the requests;

b)personal data withheld in terms of section 38(1)(b) (and not covered by c) below); and

c)correspondence written to and from Mrs Neilson's husband (whose concerns had instigated the investigation), also withheld under section 38(1)(b).

15.The information identified in paragraph 14 c) above was considered part of the information requested by Mrs Neilson.It was described by the authority as forming the bulk of the information withheld from Mrs Neilson.Having viewed the information withheld in terms of the three categories described in paragraph 14, the Commissioner would confirm that this is the case.

16.Mrs Neilson confirmed that she had access to information covered by paragraph 14 c) above, released to her husband in response to a subject access request under the DPA.She did not, however, withdraw her application insofar as it related to this information.

17.NHS Greater Glasgow identified three documents as not falling within the scope of Mrs Neilson's requests.These documents were provided to the Commissioner and she is satisfied that the content of two of them did not relate to the subject matter of any of Mrs Neilson's requests.The third document was created following receipt of Mrs Neilson's requests, and was not, therefore, covered by the requests.

18.As an example of information Mrs Neilson expected the authority to provide to her, her application to the Commissioner made reference to rotas shown to the Clinical Support Group (CSG) and her belief that NHS Greater Glasgow held this information (the clinical rotas): she believed it fell within the scope of her requests and should be disclosed to her.Mrs Neilson's requirement for review of 13 September 2011 also listed information she had expected to be (but had not been) provided with, including evidence gathered by the investigation and provided to the CSG and information on the CSG's conclusions and recommendations.

19.NHS Greater Glasgow's review outcome acknowledged that it had not made clear for which request or requests it had provided or withheld information.NHS Greater Glasgow's submission to the Commissioner indicated which request (or requests) each document, both disclosed and withheld, applied to.

20.NHS Greater Glasgow was asked by the Commissioner how it had ensured that all information covered by the requests was identified. NHS Greater Glasgow explained that appropriate managers within the relevant Directorate were forwarded a copy of Mrs Neilson's requests and asked to provide the relevant information: in response, information was provided.At review, another request was made to the Directorate to check that all relevant information had been provided: no further information was provided by the Directorate.

21.During the investigation, the investigating officer asked NHS Greater Glasgow to clarify what information was provided to the CSG and if the CSG itself, or its staff, had any record of the information considered.

22.NHS Greater Glasgow explained that the information discussed with the CSG was that contained within the rotas.It understood that Dr Neilson's concerns were discussed by the CSG and the rotas were reviewed as part of that discussion.

23.NHS Greater Glasgow commented that Mrs Neilson's requests did not refer directly to rotas or specify any timescale parameters.For it to be able to provide rotas, it believed an indication of the period of time covered would have been necessary.NHS Greater Glasgow commented that FOISA did not allow it to interpret an applicant's request, or "second-guess" the information being requested: if Mrs Neilson had requested rotas then it would have provided these, or at least made reference to them being available.

24.NHS Greater Glasgow also explained that Mrs Neilson's husband had made a request for, and been provided with, copies of various rotas relating to the Out of Hours and Integrated Care services.If Mrs Neilson did not have access to the rotas via her husband, she could request the information from NHS Greater Glasgow (since it was now in the public domain).

25.The Commissioner takes the view that Mrs Neilson's requests relate to rotas insofar as they were supplied to the CSG as part of any evidence, or were otherwise considered by the CSG in reaching its conclusions.NHS Greater Glasgow confirmed that it believed the rotas were supplied to the CSG.Such rotas would therefore fall within the scope of Mrs Neilson's requests.

26.As NHS Greater Glasgow now considered these rotas to be in the public domain, it confirmed during the investigation that it was willing to supply copies of the rotas to Mrs Neilson if required.

27.Mrs Neilson was asked by the investigating officer if she wished these rotas and confirmed that she did.

28.On 19 February 2013, NHS Greater Glasgow confirmed that it was in possession of a number of rotas provided to Dr Neilson following a request for review and that it would forward these to Mrs Neilson immediately. However, the bulk of the information provided to Dr Neilson was in the form of hard copies amounting to about the size of a box of photocopy paper. Due to the volume of paperwork, a further hard copy was not kept and the rotas could not be scanned electronically due to the excessive resources this would have required. NHS Greater Glasgow explained that it was in the position of asking the relevant part of its service to re-provide the information from their systems and the rotaswould be forwarded to Mrs Neilson once the task was complete. As at the date of this decision, this had not been done.

29.Mrs Neilson's application to the Commissioner also referred to a document entitled Background circumstances to current OOH rotas and []'s position.Mrs Neilson supplied the Commissioner with a copy of this document, which her husband had received (in redacted form) in response to his subject access request.

30.NHS Greater Glasgow explained that, at the time of Mrs Neilson's initial requests, this document was not identified as information falling under the scope of the requests. Consequently, it was not included in the initial response.Having reviewed the content of the document, NHS Greater Glasgow acknowledged that it would appear to fall under the scope of Mrs Neilson's requests.It explained that a redacted version of this document had been provided to Dr Neilson in response to his subject access request, but believed careful consideration would need to be given to whether "this sensitive document" could be released into the public domain and, if so, the extent of redaction necessary to remove or anonymise personal information or information that would identify individuals.It supplied an unredacted copy of the document for the purposes of the present investigation.

31.Having read this document and Mrs Neilson's requests, the Commissioner finds that the information in question does fall within the terms of those requests, in particular request 6.The Commissioner finds, therefore, that certain relevant information (i.e. in this document and the rotas) was not identified by NHS Greater Glasgow as falling within the scope of the requests made by Mrs Neilson: in not identifying this information, NHS Greater Glasgow failed to deal with the requests in accordance with section 1(1) of FOISA.As the information in the rotas (see paragraphs 22-28 above) has not yet been provided to Mrs Neilson, and NHS Greater Glasgow has not identified any exemption or other provision which would permit the authority not to provide them, the Commissioner now requires NHS Greater Glasgow to provide Mrs Neilson with the information.

32.However, having considered the terms of the requests, all relevant submissions and the withheld information, the Commissioner accepts (subject to her conclusions above in respect of the rotas and the document referred to in paragraph 29 above) that NHS Greater Glasgow interpreted Mrs Neilson's requests reasonably and took adequate steps to identify, locate and provide any information it held and which fell within the scope of those requests.

33.The information withheld from the document referred to in paragraph 29 will be considered further below.

Section 38(1)(b) - Personal information

34.NHS Greater Glasgow withheld information in terms of section 38(1)(b) of FOISA, on the basis that disclosure would breach the first data protection principle. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (b) (as appropriate), exempts personal data if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.

35.In considering the application of this exemption, therefore, the Commissioner will firstly consider whether the information in question is personal data as defined in section 1(1) of the DPA.If it is, she will go on to consider whether its disclosure would breach the first data protection principle.

Is the information under consideration personal data?

36."Personal data" are defined in section 1(1) of the DPA as, inter alia, "data which relate to a living individual who can be identified from those data, or from those data and other information which is the possession of, or is likely to come into the possession of, the data controller ..." (the full definition is set out in the Appendix).

37.The Commissioner has considered the withheld information and is satisfied that it comprises personal data.Individuals (involved in the complaint or the matter under investigation in one way or another) can be identified from the information, either by itself or with other information as defined in section 1(1).The information is biographical in relation to those individuals and focuses on them.The Commissioner is therefore satisfied that the information relates to those individuals.

38.NHS Greater Glasgow indicated that certain documents were withheld in full as they contained so much personal data that redaction was not a suitable option.In this respect, the Commissioner would agree.

The first data protection principle

39.NHS Greater Glasgow considered that disclosure of this information would contravene the first data protection principle.It explained that information was supplied to it in relation to concerns that specific members of staff were working excessive hours. To disclose this information under FOISA, NHS Greater Glasgow submitted, would contravene the first data protection principle, as it had been provided to the authority for the purpose of investigating a complaint against individuals and it would not be fair or lawful to release this information into the public domain.

40.The first data protection principle states that personal data shall be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The Commissioner is satisfied that none of the withheld information constitutes sensitive personal data: therefore, she is not required to consider whether any of the conditions in Schedule 3 can be met.

41.The processing in this case would be by way of disclosure into the public domain in response to Mrs Neilson's requests.When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner[1], that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.

42.NHS Greater Glasgow was asked whether any of the conditions in Schedule 2 to the DPA would allow the information to be disclosed.It was asked if it had considered the application of condition 1, which applies where the data subject (i.e. the person to whom the data relate) has consented to the processing of their personal data.If this condition had been considered and discounted, NHS Greater Glasgow was asked to explain why.

43.NHS Greater Glasgow responded that it did consider the application of condition 1 in schedule 2.It said that it was aware that the complainant was Mrs Neilson's husband and thought it appropriate to suggest to Mrs Neilson that Dr Neilson should make a direct request under the DPA, or alternatively that he submit a mandate which would allow NHS Greater Glasgow to provide the information to Mrs Neilson. NHS Greater Glasgow commented that Dr Neilson subsequently made a request under the DPA and was provided with certain correspondence.

44.Mrs Neilson confirmed to the Commissioner that she had not submitted the mandate as her husband had made a subject access request for his own data.In the circumstances, it is not possible to determine whether any mandate would have related to disclosure to the world at large under FOISA, or simply to Mrs Neilson (which would not have been disclosure under FOISA).

45.NHS Greater Glasgow did not indicate whether it had attempted to contact any of the other data subjects.Clearly, in the absence of consent from any of the data subjects, condition 1 cannot be relevant in this case.

46.In the circumstances, the Commissioner considers that only condition 6 in Schedule 2 to the DPA might be applicable in this case.Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

47.As the Commissioner has stated in previous decisions, there are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

Does Mrs Neilson have a legitimate interest in obtaining the personal data?

If so, is the disclosure necessary to achieve those legitimate aims? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?

Even if disclosure is necessary for the legitimate purposes of the applicant, would that disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?As noted by Lord Hope in the above judgement, there is no presumption in favour of the release of personal data under the general obligation laid down in FOISA.Accordingly, the legitimate interests of Mrs Neilson must outweigh the rights, freedoms or legitimate interests of the data subjects before condition 6(1) will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that NHS Greater Glasgow was correct to refuse to disclose the personal data to Mrs Neilson.

Does Mrs Neilson have a legitimate interest?

48.Mrs Neilson's application to the Commissioner, and also her request for review to NHS Greater Glasgow, indicated why she considered the information should be disclosed: she referred to the general principles of transparency and accountability; patient and public safety; and assessing the probity of the authority's investigation and those involved.Along with other reasons, Mrs Neilson indicated that she has a personal interest in the information.

49.The Commissioner accepts that Mrs Neilson has a legitimate interest, as the spouse of the person who raised the complaint and also as a member of the general public, in understanding the circumstances surrounding the investigation of the complaint about excessive working, in which there is an obvious public interest (in terms of patient safety).

Is disclosure of the information necessary to achieve these legitimate interests?

50.The Commissioner must now consider whether disclosure of the personal data is necessary for the legitimate interests identified above.In doing, so she must consider whether these interests might reasonably be met by any alternative means.

51.NHS Greater Glasgow submitted that a range of information was sought by both Mrs Neilson and her husband around the same subject matter.These requests were kept separate, as it considered strictly necessary under the legislation. It was therefore a difficult series of enquiries to respond to without breaching either party's rights under the DPA.

52.The Commissioner has interpreted this part of the authority's submission as arguing that disclosure is not necessary under FOISA as Mrs Neilson can obtain the information from her husband.This point was put to Mrs Neilson by the investigating officer: that is, why did she specifically want the information released under FOISA when this was information Dr Neilson could obtain in terms of the DPA.Mrs Neilson explained her reasons for requesting the information under FOISA.

53.Mrs Neilson explained that she was unsure what relevant information the authority held, and confirmed that she wanted access to all of the information (that is, including information her husband had not received in terms of the DPA) and the only method was through FOISA.

54.It is not for the Commissioner to put herself in the place of the authority as the body responsible for dealing with Dr Neilson's subject access request, nor to address other concerns raised by Dr Neilson with the authority.The Commissioner must confine herself to Mrs Neilson's entitlement to the information under FOISA.

55.Whilst the Commissioner accepts that Mrs Neilson does have access to certain of the withheld information via her husband, it has not been possible for her to determine precisely which information falls within this description.On balance, having considered the submissions of both parties, the Commissioner acknowledges that disclosure of the withheld personal data would allow a degree of additional scrutiny in relation to the complaint and its investigation, which could not be achieved by any alternative means.To that extent, the Commissioner accepts that disclosure is necessary for the purposes of Mrs Neilson's legitimate interests.

56.The Commissioner is satisfied in the circumstances that the disclosure of the withheld personal data is necessary to meet Mrs Neilson's legitimate interests.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the staff who are the subjects of the processing?

57.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects.As noted above, this involves a balancing exercise between the legitimate interests of Mrs Neilson and those of the data subjects.Only if the legitimate interests of Mrs Neilson outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

58.NHS Greater Glasgow stated that it believed that direct correspondence between it and individuals who raised concerns which affected them personally should not be available under FOISA. Data subjects would not expect this information to be made routinely available to the general public.

59.Mrs Neilson put forward several, detailed arguments for disclosure, including arguments as to why she did not consider disclosure to be prejudicial.These arguments included:

the information requested related to the professional, rather than the public, lives of the individuals concerned

those investigating, and investigated, held positions within NHS management, most had public-facing roles, and many held senior positions (in addition to which, other information relating to them was already in the public domain).

60.In the Commissioner's briefing on section 38 of FOISA[2], the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise. These include:

whether the information relates the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

the potential harm or distress that may be caused to by the disclosure;

whether the individual has objected to the disclosure; and

the reasonable expectations of the individual as to whether the information would be disclosed.

61.The Commissioner accepts that the information might be considered to pertain more to the data subjects' public, rather than personal, lives.However, some of the information is more personal in nature, in particular (but not exclusively) that relating to the data subjects complained of.In any event, given the nature of the issues covered by the information, it is not always possible to draw a clear line between what should be considered "public" and what should be considered "personal".

62.The Commissioner agrees with Mrs Neilson's submission that certain of the data subjects are relatively senior staff within the public authority and that many of them have in some sense a public-facing role.

63.No indication has been given to the Commissioner of the objection of the data subjects to disclosure, but equally there has been no indication of consent.

64.Although NHS Greater Glasgow did not make any specific submissions about the disclosure causing distress to the data subjects, the Commissioner considers that disclosure of certain of the information being withheld is likely to have the potential to cause distress to certain data subjects.

65.The Commissioner also accepts that the individuals whose information has been withheld would not have any reasonable expectation that their personal data would be publicly disclosed (which is the effect of the disclosure of information under FOISA) in the context of Mrs Neilson's information request.

66.On balance, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfill Mrs Neilson's legitimate interests, in this instance she does not agree that this outweighs the prejudice that would be caused to the data subjects' rights, freedoms and legitimate interests.Consequently, she finds that such prejudice would be unwarranted.The Commissioner is therefore satisfied that Condition 6 of Schedule 2 is not met in this case.The arguments may in some senses be finely balanced, but (as indicated above) there is no presumption that personal data should be disclosed under FOISA, and the Commissioner must be satisfied that the applicant's legitimate interests outweigh the rights, freedoms or legitimate interests of the data subjects before she can require disclosure.

67.Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would be unfair. As condition 6 cannot be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was therefore properly withheld under section 38(1)(b) of FOISA.

68.If Mrs Neilson's husband has any concerns about the completeness of the information provided in response to his subject access request, he can pursue that matter with the (UK) Information Commissioner, who is responsible for enforcement of the DPA across the United Kingdom.The Commissioner is satisfied that Mrs Neilson is aware of this.

DECISION

The Commissioner finds that Greater Glasgow and Clyde Health Board (NHS Greater Glasgow) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mrs Carolyn Neilson.

The Commissioner finds that in withholding information under section 38(1)(b) of FOISA, NHS Greater Glasgow complied with Part 1.

However, NHS Greater Glasgow failed to comply with Part 1 (and in particular section 1(1)) in failing to identify, locate and provide to Mrs Neilson certain information falling within the scope of her request.

NHS Greater Glasgow agreed to provide certain information (i.e. the information in the rotas) to Mrs Neilson, but as this has not been done (as of the date of this decision) and no reason has been advanced (in terms of Part 1 of FOISA) as to why it should not be done, the Commissioner requires NHS Greater Glasgow to provide that information by 22 April 2013.

Appeal

Should either Mrs Neilson or Greater Glasgow and Clyde Health Board wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
7 March 2013

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

[1] 2008 UKHL 47: http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx