Decision 044/2010 Mr X and Aberdeenshire Council Legal assistance for Community Council Members Reference No: 200901109 Decision Date: 15 March 2010

Summary

Mr X requested information from Aberdeenshire Council (the Council) relating to the issue of legal assistance being provided to former members of a specified Community Council.The Council responded by withholding the information requested on the basis of sections 30(c) and 38(1)(b) of the Freedom of Information (Scotland) Act (FOISA).Following a review, Mr X remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Council had dealt with Mr X's request for information in accordance with Part 1 of FOISA. In particular, he was satisfied that the Council had been correct to rely on the exemption in section 38(1)(b) for withholding certain information from Mr X, on the basis that it was personal data the disclosure of which would contravene the data protection principles. The Commissioner did not require the Council to take any action.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.

Background

1.On 25 November 2008, Mr X wrote to the Council requesting the following information:

a.A copy of all internal and external correspondence, memos etc including email correspondence between [specified Council officers], all former Community Councillors and all [] Area Councillors relating to the issue of legal aid being provided to former members of the [] Community Council

b.The amount of the financial assistance provided to former Members of the Community Council.The name of all officials and / or Elected Members who were aware of the financial assistance being granted to the former Members of the Community Council prior to and after the event

c.The basis upon which the funding was organised in terms of the Council's internal procedures and source of funding itself ?

2.The Council responded on 16 December 2008, confirming that it held the information requested by Mr X, but withholding it under the exemptions in sections 30(c) and 38(1)(b) of FOISA.

3.On 30 December 2008, Mr X wrote to the Council requesting a review of its decision.He referred to certain issues relating to the Community Council and argued that disclosure of the requested information was in the public interest.

4.The Council notified Mr X of the outcome of its review on 2 February 2009, informing him that the decision of the Review Panel was to uphold the Council's initial decision to withhold the information requested in terms of sections 30(c) and 38(1)(b) of FOISA.

5.On 15 June 2009 Mr X wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to him for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr X had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 24 June 2009, the Council was notified in writing that an application had been received from Mr X and was asked to provide the Commissioner with any information withheld from him. The Council responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested (with particular reference to sections 30(c) and 38(1)(b)).

9.The Council provided a statement of reasons summarising its approach to the two exemptions claimed, along with some background information.In subsequent correspondence, it clarified which exemptions it considered applicable to which particular items of withheld information.

10.The Council's arguments, insofar as relevant, will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

11.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr X and the Council and is satisfied that no matter of relevance has been overlooked.

Scope of request

12.The Commissioner has considered the withheld information carefully in the context of Mr X's request.The request is focused on issues relating to the provision of assistance to a specific Community Council in specific circumstances.In that context, while acknowledging the Council's helpful approach in providing a comprehensive set of information that might be considered relevant to the request, the Commissioner is satisfied that the information in documents 3, 4, 13 and 14 relates to broader issues of assistance to Community Councils in general, rather than the specific circumstances of concern to Mr X, and therefore does not fall within the scope of the request.Consequently, in what follows he will consider the remainder of the withheld information only and subsequent references to "the withheld information" should be read accordingly.

Section 38(1)(b) ? Personal information

13.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles in Schedule 1 to the DPA.

14.This exemption is not subject to the public interest test laid down by section 2(1)(b) of FOISA.

15.The Council withheld information under section 38(1)(b) on the grounds that it was the personal data of certain individuals who had not consented to its disclosure.The Council considered that, as none of the statutory conditions permitting disclosure applied, disclosure would breach the first data protection principle.

Is the withheld information personal data?

16.When considering the exemption in section 38(1)(b) of FOISA, the Commissioner must first establish whether the information withheld is personal data.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the definition is set out in full in the Appendix).

17.The Commissioner is satisfied that all of the withheld information constitutes personal data. While noting that the Council has not referred to this exemption in relation to the information in document 12, he considers that information to be of exactly the same character as the remainder of the withheld information and therefore is satisfied that the same conclusions can be reached in relation to it.Certain living individuals can be identified from the information, either by itself or read in conjunction with other information in the possession of (or likely to come into the possession of) the data controller.It clearly focuses on those individuals and is biographical of them in a significant sense, and consequently the Commissioner is satisfied that it relates to them.

Would disclosure of the withheld information breach the first data protection principle?

18.The first data protection principle requires that personal data be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (to the DPA) is also met.In this case, processing would be by disclosure in response to Mr X's request for information.

19.There are therefore three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are inter-linked. If there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

20.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and he is satisfied that the personal data under consideration in this case do not fall into this category. Therefore, it is not necessary to consider the conditions in Schedule 3 of the DPA in this particular case.

21.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he will then go on to consider whether the disclosure of this personal data would otherwise be fair and lawful.If no conditions can be met, he must find that the disclosure would breach the first data protection principle.

Can any of the conditions in Schedule 2 to the DPA be met?

22.In its submissions, the Council failed to identify specifically which condition in Schedule 2 of the DPA might allow disclosure.In the absence of this information, the Commissioner believes that only the sixth condition might permit disclosure in this case.

23.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (the individuals to whom the data relate).

24.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

a.Does Mr X have a legitimate interest in obtaining the personal data?

b.If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the candidates in question?

c.Even if the processing is necessary for Mr X's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr X must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr X.

Is there a legitimate interest?

25.In his correspondence with the investigating officer, Mr X highlighted that he was seeking information relating to a "fiscal transaction" undertaken by officers of the local authority and involving a third party or parties, in respect of which the local authority must be fully accountable.The Commissioner has also noted Mr X's personal involvement in the matters he is concerned about and in all the circumstances is satisfied that he has a legitimate interest in obtaining the withheld personal data.

Is disclosure necessary to achieve these legitimate aims?

26.In the circumstances, the Commissioner cannot identify a means of meeting Mr X's legitimate interests which would be less intrusive than the disclosure of the withheld personal data.Consequently, he is satisfied that disclosure would be necessary to meet those legitimate interests.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

27.The Council argued that because the information constituted personal data relating to certain individuals who had not consented to its disclosure, the exemption under 38(1)(b) of FIOISA applied, adding that in its view none of the statutory conditions for disclosure was met.

28.The Commissioner has considered the arguments put forward by Mr X and the Council and is of the view that the withheld personal data derive from a context (the defence, or potential defence, by the individuals concerned of their legal rights) in which the data subjects would have had no reasonable expectation that their data would be disclosed to the applicant in response to his request for information.

Conclusions on section 38(1)(b)

29.While accepting that disclosure of the withheld personal data would be necessary to meet Mr X's legitimate interests, the Commissioner must balance this against the rights, freedoms or legitimate interests of the data subjects.Having done this, he finds that the legitimate interests served by disclosure to Mr X would not outweigh the unwarranted prejudice that would be caused to the rights, freedoms or legitimate interests of the data subjects.The Commissioner is therefore satisfied that condition 6 is not met in this case.

30.In reaching this conclusion, the Commissioner has noted Mr X's particular interest in transparency in the expenditure of public funds and has taken account of the sums involved in this particular case in considering whether disclosure would be proportionate to the intrusion that would follow.

31.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights, freedoms and legitimate interest of the data subjects as described above, the Commissioner must also conclude that disclosure would be unfair.As condition 6 is not met, he would also regard disclosure as unlawful.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information and therefore that the withheld personal data was properly withheld under section 38(1)(b) of FOISA.

32.While accepting the applicability of section 38(1)(b) in the circumstances of this particular case, the Commissioner would also observe that the withheld information appears to comprise material prepared in contemplation of litigation, to which litigation privilege and therefore the exemption in section 36(1) of FOISA might be considered to apply.Without passing any comment on which would have been the more appropriate exemption here, the Commissioner would remind authorities generally to consider carefully which exemptions in Part 2 of FOISA are most relevant to information they are seeking to withhold in any given context.

33.The Council also applied the exemption in section 30(c) to certain of the withheld information. As the Commissioner is satisfied that all of the withheld information was properly withheld under section 38(1)(b) of FOISA, he is not required to consider the section 30(c) exemption.

DECISION

The Commissioner finds that Aberdeenshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr X.

Appeal

Should either Mr X or Aberdeenshire Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
15 March 2010

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

(i) paragraphs (a), (c) and (d); and

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c. 29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

?

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?