Decision 040/2017: Mr X and the University of St Andrews Senior management team remuneration Reference No: 201602124 Decision Date: 17 March 2017 Summary The University was asked for information on senior management remuneration. It withheld this on the grounds that (i) it was the personal information of the staff in question, disclosure of which would breach the Data Protection Act, and (ii) it would prejudice the effective operation of the University (and thus the effective conduct of public affairs). The Commissioner did not uphold the application of these two exemptions. She required the University to disclose the information requested by Mr X.

  Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

  Background

1. On 8 August 2016, Mr X made a request for information to the University of St Andrews (the University). He asked for the following information:

"For each member of the University's senior management team (referred to as the 'Principal's Office' on your website) as at 31 July 2016, their name, job title and salary (in bands of £5,000) for the academic years ended 31 July 2016, and 31 July 2015. Salary in this context represents the amount earned in the year and includes salary, bonuses, overtime, benefits in kind and other allowances (as applicable)."

2. The University responded on 5 September 2016 and cited section 25(1) of FOISA (information otherwise available) in relation to the identities of the senior executive team members and also the information sought in respect of the Principal and Vice-Chancellor. It provided website links to where Mr X could access that information.

3. The University also applied section 38(1)(b) of FOISA (Personal information) to withhold the remainder of the information requested by Mr X. It provided a table with the numbers of the staff concerned, broken down into £10K bands for each of the financial years covered by the request, explaining that this was in line with the arrangements it had made to meet the relevant requirements of Scottish Code of Good Higher Education Governance (the Code)[1]. It submitted that the Code had set the expectations of the relevant employees in relation to publication.

4. On 10 October 2016, Mr X wrote to the University requiring a review of its decision, stating that he did not agree with the University's reasons for withholding the information.

5. The University notified Mr X of the outcome of its review on 7 November 2016. It upheld its original decision to withhold the information under section 38(1)(b) of FOISA, expanding on its reasons for doing so. It also applied the exemption in section 30(c) of FOISA (Prejudice to effective conduct of public affairs) to the same information, arguing that disclosure of salary details could set unrealistic expectations in future recruitments, thus limiting its ability to operate effectively in a global recruitment and retention market.

6. On 18 November 2016, Mr X wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr X stated he was dissatisfied with the outcome of the University's review: noting that publication of such information was widespread in both the public and private sectors, he did not accept that the University's senior management should have any reasonable expectation that information on their remuneration would not be published at the level he was seeking. He also disagreed with the University's reasons for applying section 30(c). He highlighted a perceived conflict of interest in the constitution of the University's review panel.

  Investigation

7. The application was accepted as valid. The Commissioner confirmed that Mr X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

8. On 12 December 2016, the University was notified in writing that Mr X had made a valid application. The University was asked to send the Commissioner the information withheld from Mr X, which the University provided. The case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The University was invited to comment on this application, with questions focusing on its application of the exemptions in sections 30(c) and 38(1)b) of FOISA.

10. Mr X was also asked to provide any further comments he wished to make, with particular reference to his legitimate interest in obtaining the information (relevant to the application of section 38(1)(b)) and the public interest in disclosure (relevant to the application of section 30(c)).

11. Both the University and Mr X provided further submissions to the investigating officer.

  Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr X and the University. She is satisfied that no matter of relevance has been overlooked.

Section 30(c) of FOISA - Prejudice to the effective conduct of public affairs

13. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs". The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

14. There is a high threshold to be crossed in applying the test contained in the section 30(c) exemption. The prejudice in question must be substantial and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future: not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case by case basis, taking into consideration the content of the information and all other relevant circumstances.

Submissions from the University

15. The University submitted that the structure and composition of its senior management team in the Principal's Office (the PO) was flexible and that the salaries of each role within the PO vary, depending on the current business need (the level of skill and experience required to deliver in a particular role) and market factors. If a post holder left, a replacement or broadly equivalent post would not necessarily have the same scope/remit or require the same level of responsibility: the remuneration package for each job role would be assessed and determined individually, when the post became available, on a case by case basis.

16. The University went on to explain that potential applicants for the jobs would not be given specific salary details at the outset of the recruitment process. They would be informed that the salary package was competitive and negotiable. Publication of the withheld information, in the University's view, would be likely to create unrealistic expectations in applicants (i.e. that the role would attract a reward package based on a value within a particular £5K band). This might, in practice, be an over- or under- estimation of the actual value of the post being recruited for.

17. The creation of these unrealistic expectations, the University argued, would significantly undermine its ability to engage with a pool of candidates without undue interference. This would make it more difficult to attract the widest possible range of talent: people might not express an interest or apply where their expectations of reward did not match what the University was offering. A limited recruitment pool would, in turn, constrain its ability to develop the diversity and inclusivity of the PO and secure the best possible candidate for each role.

18. The University believed its ability to negotiate with potential applicants would also be constrained by disclosure. All salaries were negotiated individually and negotiation would become particularly difficult where the value of a role had fallen but the applicant knew the previous remuneration level.

19. The University highlighted the key strategic, leadership and business transformation functions performed by all PO roles, and also the important specialist niche roles performed by individual members of the PO. It needed these roles, with holders being the best fit in each, to maintain its ability to develop and compete in a global market while protecting and maintaining its core mission and values.

20. When the recruitment process became more challenging or restricted, the University stated, the resultant effects would impact negatively on its operation.

21. The University made reference to the Scottish Information Commissioner's Decision 154/2011 Paul Hutcheon of the Sunday Herald and tie Limited[2], which looked at the salaries of officials earning over £100K and Decision 192/2011 Rebecca Gordon-Nesbitt and Culture and Sport Glasgow (Trading) CIC (trading as Glasgow Life)[3], which looked at information on Trade Union negotiations relating to a review of staff terms and conditions. With regard to Decision 192/2011, in particular, the University identified reasons why the Commissioner had found disclosure (of the information requested in that case) would not be in the public interest.

Submissions from the applicant

22. Mr X disagreed that the effective operation of the University (by way of detriment to its recruitment and retention of senior managers) would be substantially prejudiced by disclosure. He submitted that most of the UK's largest companies published detailed information about their senior management's remuneration (listed companies being, in his view, required to), which did not appear to have adversely affected their ability to operate effectively on a global basis. In support of his position, he also highlighted similar publication elsewhere in both the public and private sectors.

The Commissioner's conclusions

23. The Commissioner notes that Decision 154/2011 only considered the application of section 38(1)(b) of FOISA (considered in this case below). In any event, it concluded that the authority had not made a persuasive case for withholding the requested salary information. Regarding Decision 192/2011, the subject matter is not directly comparable with this case (as the University admits) and the only evident lesson to be drawn from the University's submissions, in terms of harm, is the very broad proposition that public authorities should be allowed to negotiate freely and consider all options in the process. While the Commissioner acknowledges that substantial prejudice to either of these things may, in a particular case, amount to substantial prejudice to the effective conduct of public affairs, she is not satisfied that Decision 192/2011 offers much, if anything, by way of guidance as to whether substantial prejudice, at either level, can be considered present here. For that, she needs to look to the University's more specific submissions.

24. Clearly, it is important that the University can attract a broad range of interest to senior recruitment exercises, with a view to appointing high-quality candidates with the best possible fit to each role and maintaining an effective and diverse leadership team. No-one would argue with that. If disclosure of the withheld information were to make the tasks inherent in achieving that substantially more difficult, that would be to the substantial prejudice of the University's effective operation and, by extension, the effective conduct of public affairs. The question is whether that can be considered an actual or likely consequence of disclosure.

25. The Commissioner is surprised at the extent to which the University believes the withheld information would condition the expectations of applicants and potential applicants as to remuneration. It would appear to have concluded that it would be deprived of any opportunity to influence or manage those expectations, with the result that it would lose control of the process of negotiating that remuneration with preferred candidates. This appears unlikely, to say the least.

26. The University has explained that it already makes it clear that salary packages are competitive and negotiable. Presumably, it would continue to do so, adding (if it considered it necessary) that the value it ascribed to the role was assessed on the basis of the current requirements of the job and current market conditions: previous salary levels could not necessarily be relied upon as a guide. The University will be dealing with intelligent people who are likely to be familiar with the sector: this is a message they are likely to be able to comprehend. It seems unlikely that they would be deterred from seeking employment with an institution of the standing of the University, simply because past salaries might not provide a reliable guide to current ones.

27. Presumably, the University's ability to compete in a highly competitive market has more to do with its reputation, and its ability to meet the market's expectations in relation to salary and other benefits, than with a relatively minor detail such as this. The competitive nature of the senior management job market is hardly unique to universities and, as Mr X has noted, plenty of other organisations in both the public and private sectors manage to cope with the publication of this kind of salary information.

28. Having considered the submissions made by both parties on the exemption in section 30(c) of FOISA, the Commissioner cannot accept that it would be reasonable to consider the level of detriment outlined by the University as even likely. To the extent that unrealistic expectations might be raised by disclosure, she considers it perfectly practicable for the University to manage them.

29. The Commissioner is not persuaded, therefore, that disclosure of the withheld information would, or would be likely to, prejudice substantially the effective conduct of public affairs in the ways claimed by the University. She therefore finds that the exemption in section 30(c) of FOISA does not apply to the withheld information. Having reached that conclusion, she is not required to go on to consider the public interest test in section 2(1)(b) of FOISA.

30. The Commissioner will now go on to consider the University's application of the exemption in section 38(1)(b) of FOISA.

Section 38(1)(b) of FOISA - Personal information

31. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, section 38(2)(b)), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

32. In order to rely on this exemption the University must show, firstly, that any such information would be personal data for the purposes of the DPA and, secondly, that disclosure of those data would contravene one or more of the data protection principles to be found in Schedule 1.

33. This exemption is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the withheld information personal data?

34. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

35. In this case, the withheld information comprises the names of the individual members of the PO, their job titles and their salary information in a £5K banding.

36. The University submitted that this was the personal data of the PO staff members because it related to living individuals who could be identified from the data. The Commissioner accepts that this is the case.

Would disclosure contravene the first data protection principle?

37. In its submissions, the University argued that disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain, in response to Mr X's FOISA request.

38. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for her to consider the conditions in Schedule 3.

39. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether disclosure of the information would be fair and lawful.

40. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

41. The University submitted that conditions 1 and 6 in Schedule 2 were the only ones which might permit disclosure of the information to Mr X.

42. Condition 1 allows for disclosure where the data subject has given consent.

43. The University stated that the PO had discussed its position on Mr X's information request following his application to the Commissioner. It stated that there was "no appetite" among the data subjects (the individuals to whom the data relate, i.e. the PO team members) for the information to be disclosed, the view being that the University's existing position should be maintained. Although there was no written record of this discussion or its conclusions, the University considered it clear that the PO members did not give their consent to disclosure.

44. While it may have been helpful for the University to consult the PO members more formally, or at least to record their conclusions more formally, the Commissioner accepts that she is unable to find that the data subjects in this case consent to the disclosure of the withheld personal data. Therefore, condition 1 cannot permit disclosure in this case.

45. Condition 6 allows personal data to be processed where that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

46. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does Mr X have a legitimate interest or interests in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could the legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr X's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

47. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Mr X must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr X.

Does Mr X have a legitimate interest in obtaining the personal data?

48. Mr X identified what he considered to be a clear public interest, in the context of ongoing debate about tuition fees and university funding more generally, in people understanding how universities chose to allocate their funds - which included money received from the public purse. As part of this, he considered there to be an interest in their processes for determining and setting the remuneration of senior staff. He argued that there was no reason to limit the public interest in remuneration to the salaries of Vice-Chancellors

49. Mr X set his arguments in the context of wider public debate on executive pay. He submitted that the Code (page 30) set as a standard that:

The remuneration committee should identify those posts in the senior team which are regarded as forming the senior executive team, and it should publish the salaries of this group of staff by salary band.

He concluded that there was overwhelming evidence that public policy favoured the information being disclosed, in the interests of good corporate governance.

50. The University accepted that Mr X had a legitimate interest. In the circumstances, the Commissioner is satisfied that Mr X does have a legitimate interest in obtaining the information he is seeking and that there is also a wider public interest in transparency in relation to any public sector salaries at such a senior level.

 Is disclosure necessary to achieve those legitimate interests?

51. Having established that Mr X does have a legitimate interest in obtaining the information he is seeking, the Commissioner must now go on to consider whether disclosure of that information is necessary for the purposes of that legitimate interest. She must consider whether disclosure is proportionate as a means and fairly balanced as to ends, or whether these legitimate aims could be achieved by alternative means which would interfere less with the privacy of the individuals in question.

52. Mr X argued that to understand the University's spending decisions as regards salaries, it was necessary to know more than simply how many employees were paid in bands of £10,000. For example, in his view, there continued to be substantial gender pay inequalities in universities, and the disclosure of the information requested would allow the public to draw conclusions about the size of any gender pay gap and how it compared with other universities. Disclosure at the level requested would also, in his view, allow public scrutiny of how remuneration paid by the University compared with that paid by other public sector bodies for similar senior positions and thus enable scrutiny (and, where necessary, challenge) of the actions of its remuneration committee.

53. The University put forward arguments to the effect that it considered the information to be of limited application in meeting Mr X's legitimate interests. It advanced these arguments in support of its view that disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject, but the Commissioner considers them to be more relevant to the question of necessity.

54. The University did not believe the information allowed conclusions to be drawn on the effectiveness of the operations of university senior management teams or the existence of gender pay gaps. Given that each Scottish Higher Education Institution was unique in so many respects, meaningful comparison between them was not possible. Without that scope for comparison, it did not consider the information to be of value in understanding whether the senior management function was providing value for money.

55. In this regard, the University went on to explain that direct comparisons could not be made between PO roles, as they varied considerably in terms of responsibility and remit. The remuneration for each was negotiated separately. Disclosure would simply disclose who earned more than whom, which would be unnecessarily intrusive in the context of the limited purpose served.

56. Finally, given the variation across the sector, and across different roles within an institution, the University did not believe the information would be of value - in isolation - in determining whether there was a gender pay gap within the sector. It also noted that it was required to report on this issue, under the Equalities Act 2010, by the end of April 2017. This would do more to provide an understanding on the existence (or otherwise) of a gender pay gap than disclosure of the withheld information.

57. The Commissioner has considered these arguments carefully. She acknowledges that Scottish Higher Education Institutions may not be directly comparable with each other in every respect. That is not necessarily a unique situation, even amongst organisations within a particular sector of the public service. It does not follow that all scope for comparison of senior staff salaries is lost, even if a degree of caution may be required in relation to specific roles and, by extension, whether gender pay gaps exist. All of that is context the University can provide, should disclosure be required.

58. The Commissioner has also considered Mr X's arguments fully. In all the circumstances, she is satisfied that his reasons are relevant and that disclosure of the withheld information is necessary if his legitimate interests are to be met. Regarding the scope for comparison, even if some caveats may be required, she has borne in mind that summary (but presumably accurate) information on each of the PO roles is already provided on the University's website[4]: it is unlikely that more detailed information of this nature will be available for senior posts elsewhere for which publication is routine (and required).

Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

59. The Commissioner will now consider whether disclosure of the information would nevertheless cause unwarranted prejudice to the data subjects' rights and freedoms or legitimate interests (as the University has argued). This involves a balancing exercise between the legitimate interests of Mr X and those of the individuals concerned. Only if the legitimate interests of Mr X outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

60. In the Commissioner's briefing on personal information[5], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

(i) whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

(ii) the potential harm or distress that may be caused by disclosure

(iii) whether the individual objected to the disclosure

(iv) the reasonable expectations of the individual as to whether the information should be disclosed.

Submissions from the University

61. The University submitted that its PO staff members had a reasonable expectation that their personal data would not be disclosed, given the undertaking made by their employer that their privacy would be respected. It had given this undertaking in responding to the Code, seeking to find a balance between (on the one hand) transparency and accountability and (on the other) protecting the privacy of the staff concerned.

62. The University also considered disclosure would lead to a breach of trust between it as employer and the relevant PO staff. That breach, in its view, would be a source of harm or distress, given the obligation of mutual trust and confidence at the heart of the employment relationship.

63. With regard to expectations, the University explained the role of the Code, adopted by the Scottish Funding Council (the SFC) in 2013 as part of the framework for funding Higher Education Institutions in Scotland. Institutions were required to adopt the Code, which contained the principles of good governance with which they were required to comply as a condition of receiving public funding.

64. On remuneration, the University highlighted Principle 15 of the Code, also referred to by Mr X in his submissions (see paragraph 49 above). It also noted the principle of university autonomy, acknowledged in the Implementation Document which reviews the implementation of the Code. In the context of that autonomy, the University's Remuneration Committee had taken the position that the Code was a starting point - it did not mandate publication of specific information on senior staff salaries, but afforded each Higher Education Institute with a degree of discretion as to how it would report and publish these details.

65. On 6 November 2014, the Remuneration Committee determined that salary details of PO post-holders should be published in £10K bands, without specifying the role titles. The University submitted that the Code did not require the identification of senior managers' salaries by an individual's name or role. It considered this to be a common approach across the HE sector (while acknowledging that there was no single, "normal" approach). The University noted that PO team members were made aware of the Remuneration Committee's decision after it was made and were not involved in the preparation of the paper which led to the determination being reached.

66. The University stated that since 2013, in the Scottish Higher Education sector, senior management expectations had not been set by practices common across other elements of the public sector. This was attributable to the implementation of the Code. While separate requirements demanded the publication of equivalent information for other public authorities, and while the SFC had moved in a similar direction in relation to colleges, neither the Scottish Government nor SFC had moved to do the same with respect to Higher Education Institutions.

67. The University submitted that PO staff had a well-founded, reasonable expectation that their salary details would not be disclosed, based on the Code and the arrangements made by the University's Remuneration Committee (and endorsed by the University Court) for its implementation in this area. This amounted to an undertaking to employees as to how their personal data would be managed in this regard: noting that the employees concerned still objected to disclosure, it submitted that breach of that undertaking would harm both the privacy of those individuals and the employer/employee relationship. Breach of the trust inherent in that relationship would be significant matter, with potentially serious consequences.

68. The University was invited to comment on the decision of the Information Rights Tribunal in the case of King's College London v The Information Commissioner EA/2014/0054 (the King's case)[6], published on 2 October 2014 (i.e. some weeks before the Remuneration Committee made its decision). That decision required the publication of salary information in respect of broadly equivalent staff (the University confirmed this in the course of the investigation) at King's College, London, in £10K bands but including specific job titles.

69. The University argued that the expectations of the affected staff in the King's case were set by guidance applicable to that institution, of which there was no equivalent in Scotland. The equivalent expectations in this case were set by its own response to the Code.

70. The University also commented further on the question of trust in the light of the King's decision. It noted the Tribunal's rejection of the argument that disclosure would be an act of betrayal by the employer, on the basis that the employer would not have disclosed the information voluntarily. In its own circumstances, it contended that a voluntary disclosure, without a decision from the Commissioner of a formal instruction from a Court, would lead to a breach of the obligation of trust and confidence.

Submissions from the applicant

71. Mr X disagreed with the University's view that disclosure would be contrary to the employees' reasonable expectations. In his view, an expectation that the information would not be disclosed was unrealistic. He highlighted the statement by the Tribunal in the King's decision that

… it is reasonable to expect that those working at a senior level in an organisation receiving substantial public funds, would be aware that information about their salaries may be subject to greater public accountability and may have to be disclosed under FOIA.

He also submitted that such an expectation might be drawn from the Code, regardless of how the University had chosen to implement it, and from the widespread publication of similar information for other public and private bodies.

The Commissioner's conclusions

72. The main strand of the University's objection to disclosure relates to the reasonable expectations of the employees concerned. Disclosure would, in the University's view, be contrary to those reasonable expectations, as set by the University in its approach to the Code. It considers the decisions of the Remuneration Committee in relation to the Code to amount to an undertaking, the breach of which would amount to a breach of trust going to the heart of the employment relationship.

73. The Commissioner must therefore try to assess what would form the expectations of the data subjects, in the absence of any actual record of the affected employees' views.

74. Although the Public Services Reform (Scotland) Act 2010 only applies to salaries over £150,000 (and not to universities), the Scottish Government does publish salary details for Directors and above, and has secured the publication of equivalent information (in some cases for salaries at a considerably lower level) for Non Departmental Public Bodies[7]. The Commissioner notes that while practice varies across the public sector, the principle of disclosure in £5K bandings is relatively common.

75. In the circumstances, the Commissioner cannot accept that the data subjects would be unduly surprised by a move to make their salaries available in the terms requested by Mr X. They are the leaders of one of Scotland's most prestigious educational institutions, with significant responsibilities in relation to strategy, finance (partially public), property, students and staff. Universities may be autonomous, but they remain subject to the expectations of transparency fostered by FOISA and wider norms of good governance. The Code clearly expects a degree of transparency, even if it is simply a starting point from which each institution must create its own specific arrangements. As noted above, the supporting guidelines on page 30 state, in relation to Principle 15:

The remuneration committee should identify those posts in the senior team which are regarded as forming the senior executive team, and it should publish the salaries of this group of staff by salary band.

It would not be unreasonable to interpret this as expecting the publication of salary information (in bands) specific to individual posts, even if this is not the approach taken by the University.

76. The Commissioner observes that the University did not adopt its current reporting system on salaries until after the Kings case was decided and published. In that and the wider context, she must question whether it was realistic for the University to foster an expectation that senior salary information at the level sought would not be disclosed. She must also assume that University PO staff are intelligent people, well informed about developments in the wider world and realistic about developing expectations in this and other areas of governance.

77. With regard to the views of the employees themselves, the University has provided a broad, unsubstantiated statement that there was "no appetite" for disclosure when the matter was discussed within the PO. This is hardly indicative of strong objection. It hardly suggests that disclosure would cause distress, or that anyone would regard it as a fundamental breach of trust, going to the heart of the employment relationship.

78. Having considered all the arguments she has been presented with, the Commissioner is not persuaded that disclosure as requested by Mr X would lead to any substantial prejudice to the rights and freedoms or legitimate interests of the data subjects. If there were any prejudice, she would not consider it sufficient, on balance, to outweigh the legitimate interest in disclosure.

79. The Commissioner is aware of no reason why disclosure should be otherwise unfair or unlawful and therefore has concluded that disclosure of the information would not breach the first data protection principle. Consequently, she finds that the information is not exempt under section 38(1)(b) of FOISA.

80. She therefore requires the University to disclose to Mr X the information he requested.

Composition of the review panel

81. Mr X noted that the panel which considered his review requirement included the Vice Principal (Governance and Planning) (VPGP), whose salary details were amongst those requested. Mr X submitted that this was a clear conflict of interest and represented poor practice.

82. The University did not believe the participation of the VPGP on the review panel represented a conflict of interest or poor practice. The University explained that the review panel had three members. Neither of the others were members of the PO.

83. The University considered the VPGP's involvement to have been necessary to provide an insight into technical questions considered in the review, in particular aspects of the Code and the independent, autonomous nature of universities. The only other University officer who could have provided this insight was the University Chief Legal Officer (the CLO). As the CLO had produced the paper for Remuneration Committee setting out the options as to how the University should respond to the Code, it was determined that they should not sit on the review panel.

84. The University also stated that the current VPGP (who sat on the panel) was not in post when the University formulated its response to the Code relating to principal officer salary.

85. The University did not believe there was any scope for any conflict of interest to arise in the context of the review, because the matters considered in the review were limited to:

· the role of the Code in setting employee expectations

· the operation of the Code with reference to the autonomous nature of Scottish universities

· how the University's response to the Code compared with that taken by other Scottish institutions

· whether disclosure of the withheld information would be unfair

· the relevance of selected decisions from the Scottish Information Commissioner

· the application of section 30(c) of FOISA.

86. The University stated that the VPGP was able to offer a personal view on this question of fairness. This was deemed appropriate because the question of fairness (in data protection terms) was being tested and this could only be done by asking a member of the PO. However, the VPGP was not asked whether their own salary details should be released or not: discussion was strictly limited to reasonable expectations in a general sense.

The Commissioner's findings

87. Section 10.3.3 of Part 2 of the Scottish Ministers' Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004[8] states that the review procedure must be fair and impartial, and allow decision makers to look at the request afresh. It should enable different decisions to be taken, and be sufficiently flexible to allow for differing circumstances. Section 10.3.4 goes on to recommend that the reviewer should, where possible or practicable, be a person who did not respond to or advise on the original request.

88. Clearly, a review panel needs to be able to take decisions which are not only fair and impartial but also informed. However, the panel can be fully informed without those briefing it (who might, inevitably, have been closely involved in the earlier handling of the request or the underlying subject matter) being part of its membership. In cases where the interests of particular individuals are engaged by the panel's decision making, it must be possible for those interests to be taken into account fully without the individuals concerned being members of the panel.

89. In this case, having taken account of all relevant submissions provided to her, the Commissioner is satisfied that the fairness and impartiality of the review panel's decision making was not actually impaired by one (of three) members of the panel being closely involved in the subject matter under consideration. However, in being fair and impartial, it is important that the perception of bias is avoided as well as its actuality. Here, the Commissioner accepts that it would be reasonable for an informed outsider to conclude that, whatever matters were actually considered by the panel in its deliberations and whatever the role of a single member in the panel arriving at its conclusions, the presence of a very senior member of staff with a vested interest in the outcome of those deliberations could be perceived as compromising the fairness and impartiality which lies at the core of good practice in this area.

90. The Commissioner would urge the University to review its practice in the conduct of reviews, to identify ways in which similar perceptions of bias might be avoided in the future.

Decision The Commissioner finds that the University of St Andrews failed to comply with Part 1 (and in particular section 1(1)) of the Freedom of Information (Scotland) Act 2002 (FOISA) in wrongly withholding the information requested by Mr X under the exemptions in sections 30(c) and 38(1)(b) of FOISA. The Commissioner requires the University to provide Mr X with the information, by 1 May 2017.

  Appeal

Should either Mr X or the University wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

  Enforcement

If the University fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the University has failed to comply. The Court has the right to inquire into the matter and may deal with the University as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

17 March 2017

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

…

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

 

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---