Decision 042/2012 Professor Krishen Rana and the University of Stirling
Scores applied in selection for redundancy
Reference No: 201101481
Decision Date: 5 March 2012
Summary
Professor Rana requested from the University of Stirling (the University) a number of items of information relating to redundancies in its Institute of Aquaculture.The University released some information, while withholding the remainder under a number of exemptions contained in FOISA.In particular, it redacted information from a table relating to the pool of academic staff from which individuals were selected for redundancy (table 5).Following a review, Professor Rana remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the University had dealt with Professor Rana's request for information in accordance with Part 1 of FOISA, by correctly withholding the information redacted from table 5.She found that disclosure of this information would breach the first data protection principle.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles ? Part 1: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
All references in this decision to "the Commissioner" are to Margaret Keyse, who has been appointed by the Scottish Parliamentary Corporate Body to discharge the functions of the Commissioner under section 42(8) of FOISA.
Background
1.On 17 May 2011, a request was submitted to the University on behalf of Professor Rana, seeking a number of items of information relating to redundancies in its Institute of Aquaculture.
2.The University responded on 13 June 2011.To the extent that it considered the information requested to be Professor Rana's own personal data, it dealt with the request under the DPA.In dealing with the remainder of the request under FOISA, it provided certain of the requested information, while also setting out its reasoning for withholding the other information under the exemptions in sections 30(b)(ii), 33(1)(b) and 38(1)(b) of FOISA.
3.On 13 July 2011, Professor Rana wrote to the University requesting a review of its decision.He did not agree with its reasons for applying the above exemptions.
4.The University notified Professor Rana of the outcome of its review on 8 August 2011.While disclosing certain additional information, it upheld its decision in respect of the majority of the information withheld in dealing with the initial request.
5.On 11 August 2011 Professor Rana wrote to the Commissioner, stating that he was dissatisfied with the outcome of the University's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Professor Rana had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 23 August 2011, the University was notified in writing that an application had been received from Professor Rana and asked to provide the Commissioner with any information withheld from him. The University responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the University, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to supply further documents and to confirm (with reasons) which exemptions it was continuing to rely upon.
9.Following its initial response, further information and clarification was sought from the University on a number of points.In the course of the investigation, Professor Rana confirmed that he wished the investigation to focus on the withholding of information from table 5 and the University was asked to comment in more detail on its reasons for withholding this information.
10.The submissions received from both the University and Professor Rana, in so far as relevant, will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
11.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to her by both Professor Rana and the University and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? personal information
12.The University withheld all the names in the first column of table 5, to prevent identification of the relevant academic staff alongside their individual scores.Professor Rana's name was disclosed to him only, under the separate right of access to his own personal data under the DPA: it was not released into the public domain under FOISA.
13.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and its disclosure to a member of the public (otherwise than under FOISA) would breach any of the data protection principles set out in Schedule 1 to the DPA.
14.The exemption in section 38(1)(b) is an absolute exemption, and is therefore not subject to the public interest test laid down by section 2(1)(b) of FOISA.
Is the information personal data?
15.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
16.The Commissioner accepts that the names of the employees listed in table 5 are the personal data of those individuals, in terms of the first part of the definition in section 1(1) of the DPA.In other words, they are data relating to living individuals who can be identified from those data.Were the names not to be withheld from the table, he also accepts that the remaining information in the table would be those individuals' personal data, as information relating to their performance and future prospects.The Commissioner will now go on to consider whether this information is exempt from disclosure under section 38(1)(b) of FOISA.
Would disclosure breach the first data protection principle?
17.The University contended that disclosure of the information requested by Professor Rana would breach the first data protection principle, which requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met.In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.
18.The Commissioner does not consider any of the personal data withheld in this case to be sensitive personal data, as defined in section 2 of the DPA.He will therefore only consider whether any of the conditions in Schedule 2 to the DPA would permit disclosure of the information.
Can any of the conditions in Schedule 2 to the DPA be met?
19.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.
20.The Commissioner considers that condition 6 of Schedule 2 of the DPA would appear to be the only condition which might permit disclosure of the personal data requested by Professor Rana. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
21.There are a number of different tests which must therefore be satisfied before condition 6 can be met.These are:
Does Professor Rana have a legitimate interest in obtaining the personal data?
If he does, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?(In this case, the data subjects are those University employees listed in table 5.)
Even if the processing is necessary for Professor Rana's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
22.There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Professor Rana must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the personal data to Professor Rana.
Does Professor Rana have a legitimate interest?
23.Professor Rana explained that he wished to know the names of the other staff in the same redundancy pool as himself (which he understood to be those staff listed in table 5), so he could understand how he had been scored relative to the other staff in this table and could verify that the scoring had been carried out accurately and in accordance with the University's stated criteria.
24.The University accepted that Professor Rana had a legitimate interest in the withheld information in table 5.
25.Clearly, Professor Rana has an ongoing interest in the way the University conducted the redundancy process, given its effects on his employment.The fairness of this process is also a matter of wider interest.
26.Having considered all relevant arguments, the Commissioner accepts that Professor Rana has a legitimate interest in the matters he has described.
Is disclosure necessary to achieve these legitimate aims?
27.Professor Rana confirmed to the investigating officer that, at the time he made his request, the University had identified to him which staff had been made redundant.The reason he still required table 5 was to verify the accuracy of the redundancy scoring process, by comparing the scores for each member of staff, in the light of the stated criteria.
28.It is clear that Professor Rana has been provided with his own scores and can therefore see how he was scored in this exercise.The Commissioner canalso see that while Professor Rana will know from working in his department what roles and responsibilities are assigned to other academic staff there, it may not be possible for him to make an effective comparison of the scores allocated to those colleagues simply by reference to the information he has already.Assuming that to be the case (and the University has not sought to argue otherwise), the Commissioner can identify no viable means of meeting Professor Rana's legitimate interest which would interfere less with the privacy of the data subjects than obtaining the information requested.Therefore, she is prepared to accept that disclosure of the information is necessary for the purposes of the legitimate interests identified by Professor Rana.
Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the staff who are the subjects of the processing?
29.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects.As noted above, this involves a balancing exercise between the legitimate interests of Professor Rana and those of the data subjects (i.e. those staff listed in table 5).Only if the legitimate interests of Professor Rana outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
30.The University has submitted that (taking account of factors including their relative seniority within the University) the data subjects would have had no reasonable expectation or understanding that these personal data would be released into the public domain under FOISA.It also confirmed during the investigation that it had not sought or obtained consent from the data subjects to disclose their names with their individual scores.
31.The Commissioner has considered carefully the submissions she has received from both Professor Rana and the University on the effects of disclosing the information.She acknowledges (as Professor Rana has pointed out) that the redundancies had been announced prior to the University receiving Professor Rana's request, and that by that time the identities of those made redundant were relatively widely known.That said, the Commissioner would also acknowledge that it does not follow that those individuals would reasonably expect that more specific information on their selection for redundancy would be made public.He accepts that the information, in relating to the individuals' performance and prospects, is of some sensitivity.
32.In this case, therefore, having considered the arguments presented to her, and having weighed Professor Rana's legitimate interests against the legitimate interests, rights and freedoms of the staff listed in table 5, the Commissioner has concluded that the legitimate interests of those individuals outweigh those of Professor Rana.As a result, she has determined that disclosure would be unwarranted in this case.The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA could not be met in this case in relation to the withheld information in table 5.For the same reasons, she finds that disclosure would be unfair.In the absence of a condition permitting disclosure, she also finds that it would be unlawful.Consequently, the Commissioner finds that disclosure of the information would breach the first data protection principle.
33.The Commissioner therefore concludes that the University was correct to withhold the names in table 5 under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds, in respect of the matters covered by Professor Rana's application, that the University of Stirling complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Professor Rana.
Appeal
Should either Professor Rana or the University of Stirling wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Acting Scottish Information Commissioner
5 March 2012
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
...
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
...
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a)at least one of the conditions in Schedule 2 is met, and
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
