Decision 043/2011 Mr Y and Aberdeen City Council

Councillors' telephone bills

Reference No: 201001377
Decision Date: 3 March 2011

Summary

Mr Y asked Aberdeen City Council (the Council) for details of the mobile phone calls made and texts sent by three Councillors during a specific period. The Council disclosed some information (e.g. total usage and cost per councillor), but advised Mr Y that it only held detailed information for part of the period he had asked for.The Council withheld this detailed information on the basis that it was exempt from disclosure under section 38(1)(b) of FOISA.

Following a review, Mr Y remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Council had been entitled to withhold the information under section 38(1)(b) of FOISA on the basis that it was personal data and that its disclosure would breach the first data protection principle.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 3(2)(a)(i) (Scottish public authorities) and 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 15 March 2010, Mr Y asked the Council for details of all calls and texts sent by the Councillors in the Airyhall, Broomhall and Garthdee wards using mobile phones and Blackberries supplied or paid for by the Council for the period of 1 December 2009 to 15 March 2010, including details of the numbers called, the time the calls were made or texts were sent, the duration and the cost of the calls.

2.The Council responded on 13 April 2010. It advised Mr Y, in terms of section 17 of FOISA, that it did not hold information on the time, duration and cost of individual calls.The Council explained that this information was contained in bills from the service provider, which it had not yet received.

3.In order to assist Mr Y, however, the Council provided Mr Y with some totals, based on unbilled information it held for the period 1 December 2009 to 5 April 2010 (total usage in minutes and total cost for each mobile phone and Blackberry for each of the three Councillors who represent the wards).

4.The Council also advised Mr Y that the actual numbers called were third party personal data and were therefore exempt from disclosure under section 38(1)(b) of FOISA.

5.On 13 April 2010, Mr Y emailed the Council requesting a review of its decision.Mr Y advised that he was willing to wait until the bills had been received to get the breakdown.He believed that personal details could not be obtained from a list of telephone numbers and that disclosing the numbers would not breach the data protection principles, but that if the Council believed that identification would be possible, he was willing to accept the last four digits alone.

6.The Council carried out a review and notified Mr Y of the outcome on 30 April 2010; it advised him that it had upheld its previous response without amendment.

7.Mr Y subsequently contacted the Council, commenting that neither the original response nor the outcome of the review explained how disclosure of the numbers would breach the data protection principles.

8.In response, the Council advised Mr Y, with reference to the text of the principles, that it considered that disclosure would breach the first and second data protection principles.

9.On 1 July 2010, the Commissioner received a letter from Mr Y, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Y considered that the information he had asked for was not personal data.

10.The application was validated by establishing that Mr Y had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

11.On 13 July 2010, the Council was notified in writing that an application had been received from Mr Y and was asked to provide the Commissioner with the information withheld from him. The Council provided the information, and the case was then allocated to an investigating officer.

12.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the Council was asked to explain why it considered that the telephone numbers withheld from Mr Y comprised personal data.

13.In response, the Council advised that it was unable to distinguish which telephone calls (or texts) were made to a constituent, which were private or were to a business.The Council also commented that it considered Mr Y was seeking a particular telephone number and so, even if a partial phone number were provided, the individual could still be identified.The Council considered that the first data protection principle applied to the withheld information in that it was unfair to disclose the information and that the second data protection principle applied because the data had been collected for a different purpose (payment of a telephone bill).

14.The investigating officer contacted Mr Y and asked him for his views and comments regarding his interests in accessing the withheld information under consideration. Mr Y responded, explaining why he considered he had a legitimate interest in the withheld information.

15.The investigating officer and the Council entered into discussions regarding the information that was held at the date of the request; the Council advised that it only held bill information from 1 to 31 December 2009 at the date of Mr Y's request.The investigating officer advised Mr Y that this was the case, and that the Commissioner's investigation and decision would focus on the information withheld in the December bills alone, given that this was the information held by the Council on the details of the calls at the time of his request and given that the Council had already provided Mr Y with the other, more general, information it held at the time of his request.

16.The investigating officer requested and obtained additional comments from the Council regarding the provision of mobile phones and Blackberries to Councillors.The Council also provided additional submissions on its reliance on section 38(1)(b) of FOISA and, in particular, its consideration of the first and second data protection principles.The Council also advised the investigating officer that it did not consider that it held the telephone numbers, but rather that, in terms of section 3(2)(a)(i) of FOISA, it held the numbers on behalf of the Councillors.(If this is the case, then the numbers cannot be requested under FOISA.)However, the Council also said that if the Commissioner considered that it did hold the information, then it would argue that the information was the personal data of the named Councillors in addition to that of the individuals who had been called or texted.

Commissioner's analysis and findings

17.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Y and the Council and is satisfied that no matter of relevance has been overlooked.

18.The information withheld in this case is the telephone numbers dialled or texted, the duration of the call and cost for the mobile phone and Blackberry telephone bills for each of the named Councillors between 1 and 31 December 2009.

Is the information held by the Council on behalf of the named Councillors ? section 3(2)(a)(i)

19.Section 1(1) of FOISA states that a person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.However, section 3(2)(a)(i) of FOISA makes it clear that if the authority holds the information on behalf of another person, then the information is not held by the authority for the purposes of FOISA.

20.The Council provides mobile phones and Blackberries to Councillors for Council business.The Council pays the bills.However, the Council argued that it only holds a record of the telephone numbers called or texted because a record of the calls is sent to the Council by the service provider.

21.The Council referred to the Commissioner's Fact Sheet on "Elected Members and Freedom of Information"[1] which states:

"Information created by elected representatives as part of their duties and stored on public authority systems (e.g., parliamentary) will not normally be covered by FOISA, even if the public authority receives a request for it.This is because FOISA excludes information which is held by a public authority only on behalf of another person (e.g., an elected member)."

The Council therefore maintained that the list of telephone numbers called or texted by a Councillor is information it holds on behalf of that particular Councillor.

22.The Council publishes the cost of mobile phones for each of its Councillors on an annual basis. However, it does not consider that the cost of calls, or number of calls or text messages sent is information held on behalf of a Councillor as this information is factual, anonymous and information which it legitimately holds as the bill payer.The Council also considered that it was in the public interest to disclose this information, given the financial difficulties the Council is facing.Despite this, the Council maintains that the actual telephone numbers called or texted is information which was not obtained or used by it, but was obtained and used by a Councillor in furtherance of their duties as an elected representative and is, therefore, held by the Council on behalf of the Councillors.

23.The concept of "holding" information for the purposes of FOISA is not simply a question of physical fact. For example, if the information in question was simply held on the Council's premises for storage or safe-keeping (e.g. an off-site archive) for the Councillor then this could constitute information held "on behalf of another person", especially if the Council had no access to the information. However, in this instance, the Council is provided with the full bill (which lists the telephone numbers called or texted) by the service provider and reviews the bills to identify any concern about usage.

24.The Commissioner's guidance which is referred to in paragraph 21 refers to information created and under the control of the Councillor, for example emails.However, in this instance, the detailed bill information was not generated by the Councillor and they have no control over it; it remains the property of the Council as part of the bill information issued by the service provider.A similar situation arises when a Councillor uses the Council's landline telephone to call a constituent and the bill for this use is charged to the Council and the bill is held by the Council.

25.The Councillor has no input into the service provider selected, tariff chosen or the type of telephone or Blackberry provided; consequently it is outwith their control and is in effect part of the Council's administrative support which it provides to Councillors.The Commissioner considers that the opposite applies to Councillor's constituency correspondence which is generated by themselves with little direction or control from the Council.

26.Consequently, the Commissioner has come to the conclusion that the withheld information is held by the Council in its own right, in conjunction with its responsibilities for the provision and payment of the other Council provided facilities used by the Councillors.

27.As the Commissioner has found that the information is held by the Council for the purposes of FOISA, he will now consider whether the information is exempt from disclosure under section 38(1)(b) of FOISA.

Consideration of section 38(1)(b) of FOISA

28.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts personal data from disclosure if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles laid down in Schedule 1 to the DPA.

29.In order for a public authority to rely on this exemption, it must show that the information which has been withheld is personal data for the purposes of the DPA and that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.

30.The Council took the view that the telephone bills comprised the personal data both of the Councillors and of the constituents they called or texted.The Council argued that disclosure of this information would contravene both the first and second data protection principles in the DPA.

Is the information personal data?

31.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

32.The withheld information consists of telephone numbers.In considering whether this comprises personal data, the Commissioner has had regard to guidance entitled "Determining what is personal data"[2], issued by the (UK) Information Commissioner (ICO), who is responsible for enforcing the DPA throughout the UK.

33.There is no name or other identifying information set out on the bills that would lead to a direct correlation between the telephone number and an identified individual.As is clear from the ICO's guidance, just because a name has not been provided with the telephone numbers, does not mean that an individual cannot be identified from a telephone number.In deciding whether an individual can be identified, account must be taken of all the means likely reasonably to be used to identify an individual and any individual determined to identify an individual is likely to find identification a very simple matter; it would be relatively straightforward to identify an individual by either by dialling the telephone number and speaking to the individual who answered or use other covert methods to identify the individual.

34.In addition, there will also be cases where an individual recognises a telephone number and finds out that the person whose number it is has been in contact with another named individual (in this case, an elected official).

35.Although an individual may be identified from the telephone number, this is not enough to make the information personal data; to be personal data, the information must relate to the individual. The ICO guidance referred to above considers that information will relate to an individual where it is processed to learn or record something about that individual, or where the information has an impact upon that individual.In this case the information in the telephone bills (telephone numbers called, duration and time of call, etc.) would allow a person to build up a pattern of activities in relation to the individual being telephoned or texted and to determine things that would be otherwise unknown.

36.The Commissioner is therefore satisfied that the withheld information relates to the individuals telephoned or texted by the Councillors and that it is those individuals' personal data.

37.The Commissioner notes that Mr Y suggested that he would accept the last four digits of the telephone numbers if the Council were unwilling to provide him with the numbers in full.However, the Commissioner considers that, given that it would be relatively easy to determine the dialling code and first part of many of the numbers (given the use for which the mobile telephones and Blackberries are made), even with the first parts of the telephone numbers redacted, the numbers would remain the personal data of the people called or texted.

38.The Commissioner is also satisfied that the information is the personal data of the Councillors who made the calls or sent the texts.The Councillors can clearly be identified from the bills (their names appear on the bills) and the information on the bills would allow an individual to determine the activities of the Councillor.As a consequence, the information clearly relates to them.

39.The Commissioner will now consider whether disclosure of the information would contravene the first (and, if necessary, the second) data protection principle.

Would disclosure breach the first data protection principle?

40.The first data protection principle states that personal data must be processed fairly and lawfully and, in particular, must not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met."Processing" here would be the disclosure of the information into the public domain in response to Mr Y's information request.(The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the data in this case does not fall into any of the relevant categories.It is therefore not necessary to consider the conditions in Schedule 3 in this case.)

41.There are, therefore, three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

42.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.

Can any of the conditions in Schedule 2 to the DPA be met?

43.In the circumstances, condition 6 would appear to be the only condition which could permit disclosure to Mr Y. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s) (the individuals to whom the data relate).

44.There are a number of different tests which must be satisfied before condition 6 can be met.These are:

Does Mr Y have a legitimate interest in obtaining the personal data?

If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?

Even if the processing is necessary for Mr Y's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Y must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Y.

Does the applicant have a legitimate interest?

45.The Council did not consider whether Mr Y had a legitimate interest in the information as it considered FOISA to be "applicant blind".However, as noted in the Commissioner's guidance on the exemption in section 38[3], this is one of the few areas in FOISA where the identity of the applicant may well have a bearing on whether information should be disclosed.

46.The Council considered that it had been transparent and open by publishing information online about the Councillors' total telephone costs and by providing Mr Y with this information.

47.However, in correspondence with the investigating officer, Mr Y commented that it was absolutely essential to know who the Councillors are calling (and when) at the expense of the Council tax payer.

48.Mr Y has not referred to any impropriety on behalf of the Councillors, nor has he commented that he considers the bills to be excessive or that the public should not pay for such telephone bills.It would seem that Mr Y's key interest is solely in the telephone numbers dialled, but it is not clear as to the purpose for this request apart from that it is essential to know what telephone numbers were called.

49.In the Commissioner's opinion, Mr Y has not demonstrated that he has a legitimate interest in obtaining the personal data.While it is clear that there may well be a wider legitimate interest, with public finances in mind, in knowing how much Councillors' publicly funded mobile telephones and Blackberries cost the taxpayer, such information is already published by the Council.

50.However, despite this finding, the Commissioner will go on to consider whether the other tests in the exemption would apply.

Is disclosure of the personal data necessary for Mr Y's legitimate interests?

51.The next test to be considered is whether, in the event that Mr Y does have a legitimate interest in the information, disclosure is necessary for those legitimate interests.In considering this, the Commissioner must consider whether these interests might reasonably be met by any alternative means.

52.Having considered the detailed information requested by Mr Y, the Commissioner can identify no viable means of meeting Mr Y's legitimate interests (if they existed) which would interfere less with the privacy of the relevant data subjects than by obtaining the information withheld.Therefore he is satisfied that disclosure of the information would be necessary for the purposes of Mr Y's legitimate interests (if they existed).

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

53.The Commissioner will now consider whether disclosure of the information would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects (i.e. the Councillors and the people they called or texted). As noted above, this would involve a balancing exercise between the legitimate interests of Mr Y (if they existed) and those of the data subjects. Only if the legitimate interests of Mr Y outweighed those of the data subjects could the information be disclosed without breaching the first data protection principle.

54.The Commissioner's guidance on the exemptions in section 38 identifies a number of factors which should be taken into account in carrying out this balancing exercise.These include:

whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

the potential harm or distress that may be caused by the disclosure;

whether the individual has objected to the disclosure;

the reasonable expectations of the individual as to whether the information would be disclosed.

55.The Council submitted that elected members are able to use their office and mobile phones for Council business, constituent business and to make private phone calls, and that the recipients of those calls are not made aware that their telephone number may be released into the public domain.The Council also commented that the Councillor's role is one in which constituents may wish to discuss matters confidentially with their ward councillor and this relationship may be comprised if the elected member is required to advise constituents that the telephone numbers elected members have called may have to be released, especially when it is possible (as the Commissioner has found to be the case here) that those numbers can identify that person.

56.The Council also submitted that the Councillors may be aware that the costs of calls will be published, but they are not informed that the numbers they have called or texted will be made public.

57.As noted above, the Council has indicated that it expects any Councillor to be entitled to contact any one of his or her constituents and the constituent to receive such calls without expectation or fear that the contact would be made public.

58.The individuals telephoned by the Council would have no reasonable expectation that their telephone numbers would be disclosed into the public domain.In many cases, given the use to which the telephones and Blackberries are put, this will be the Councillors' constituents and disclosure is highly likely to cause distress or damage to the constituents.

59.The Commissioner notes that the Councillor's role as a representative of their ward constituency involves them in private consultation with their constituents.Consequently, the Commissioner is satisfied that neither the Councillor nor the constituent would have had any expectation that the telephone number(s) would be made public.

60.The Commissioner has been provided with no evidence to show that the Councillor or the constituent has consented to the disclosure of the information and accepts that both the Councillor and constituent would make and receive calls or texts in the expectation that this fact would remain private.

61.On balance therefore, even if the Commissioner had come to the conclusion that Mr Y had a legitimate interest in the personal data, he would have come to the conclusion that, in this case, the rights, freedoms and legitimate interests of the data subjects would outweigh his legitimate interests.

62.The Commissioner has therefore concluded that condition 6 of Schedule 2 to the DPA cannot be met in this case.As this is the only condition in Schedule 2 which he considers could have applied, he must come to the conclusion that disclosure would breach the first data protection principle and that the personal data is therefore exempt from disclosure under section 38(1)(b) of FOISA.He is not required to go on to consider whether disclosure would otherwise be fair and lawful in terms of the first data protection principle, or whether disclosure would breach the second data protection principle.

DECISION

The Commissioner finds that Aberdeen City Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Y.

Appeal

Should either Mr Y or Aberdeen City Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
3 March 2011

Appendix

Relevant statutory provisions

1General entitlement

(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6)This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

3 Scottish public authorities

?

(2) For the purposes of this Act but subject to subsection (4), information is held by an authority if it is held-

(a) by the authority otherwise than-

(i) on behalf of another person; ?

38Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a)from those data, or

(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a)at least one of the conditions in Schedule 2 is met, and

(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

[1] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=2914&sID=3084

[2] http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/personal_data_flowchart_v1_with_preface001.pdf

[3] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx