Decision 044/2011 Jennifer Walley and Dumfries and Galloway Health Board
Information contained in Agenda for Change matched reports
Reference No: 201001441
Decision Date: 3 March 2011
Summary
Jennifer Walley (Mrs Walley) requested from Dumfries and Galloway Health Board (NHS Dumfries and Galloway) information contained in the Agenda for Change matched reports for seven identified posts. NHS Dumfries and Galloway responded by withholding the information requested as it considered it to be personal data exempt from disclosure under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA). Following a review, Mrs Walley remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that NHS Dumfries and Galloway had failed to deal with Mrs Walley's request for information in accordance with Part 1 of FOISA, by wrongly applying the exemption in section 38(1)(b) of FOISA to withhold the information. He required NHS Dumfries and Galloway to provide the information to Mrs Walley.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal Information)
Data Protection Act 1998 (DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data: condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 13 April 2010, Mrs Walley wrote to NHS Dumfries and Galloway requesting the information contained in the Knowledge, Training and Experience (KTE) section of the Agenda for Change matched reports (AfC matched reports), including the score applied, for seven identified posts.
2.NHS Dumfries and Galloway responded on 24 May 2010 refusing to provide Mrs Walley with the information requested as it considered it to personal information exempt from disclosure under section 38 of FOISA.
3.On 9 June 2010, Mrs Walley wrote to NHS Dumfries and Galloway requesting a review of its decision. In particular, Mrs Walley drew NHS Dumfries and Galloway's attention to her understanding that the basis of comparison under Agenda for Change was the job undertaken and not the individual holding a particular post and questioned its rationale for considering the information to be personal information.
4.NHS Dumfries and Galloway notified Mrs Walley of the outcome of its review on 8 July 2010. It upheld its original decision, clarifying that it considered the information to be personal information exempt from disclosure as each of the posts identified by Mrs Walley was occupied by a single, and therefore identifiable, post-holder.
5.On 14 July 2010, Mrs Walley wrote to the Commissioner, stating that she was dissatisfied with the outcome of NHS Dumfries and Galloway's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mrs Walley had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 20 July 2010, NHS Dumfries and Galloway was notified in writing that an application had been received from Mrs Walley and was asked to provide the Commissioner with any information withheld from her. NHS Dumfries and Galloway responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted NHS Dumfries and Galloway, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, NHS Dumfries and Galloway was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
9.NHS Dumfries and Galloway provided its submissions on 10 September 2010, and subsequently provided further comments in response to a further request from the investigating officer.
10.During the investigation, NHS Dumfries and Galloway indicated that, having considered the matter further, it would be willing to disclose the information requested by Mrs Walley with identifiable information regarding the post holders removed.The Commissioner understood this to mean that the content of the KTE sections in the Afc matched reports would be disclosed, but without identifying which section related to which post.
11.This offer was passed to Mrs Walley by the investigating officer, but her response made clear that she wished to access the information requested in full, and since she had access to the job descriptions for the posts, she could see no reason why the KTE sections relating to those posts should not be provided along with the relevant post title.
12.The Commissioner has therefore proceeded to consider whether the withheld information should be disclosed to Mrs Walley in full. The relevant submissions provided by Mrs Walley and NHS Dumfries and Galloway will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
13.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mrs Walley and NHS Dumfries and Galloway and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? Personal information
14.NHS Dumfries and Galloway relied upon the exemption in section 38(1)(b) to withhold the information and scores contained in the KTE section of the AfC matched reports requested by Mrs Walley. It submitted that this information constituted personal data, disclosure of which would contravene the first data protection principle.
15.Section 38(1)(b), read in conjunction with either section 38(2)(a)(i) or (b), exempts personal data from disclosure if the release of the information would contravene any of the data protection principles set out in Schedule 1 of the DPA.The Commissioner has therefore considered whether the information in question is personal data and, if so, whether disclosure of the information would breach any of the data protection principles.
Is the information under consideration personal data?
16.The Commissioner first considered whether the information requested by Mrs Walley constituted personal data as defined by the Data Protection Act 1998 (the DPA); that is, data which relate to a living individual who can be identified from those data or from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the definition is set out in full in the Appendix).
17.The AfC matched reports provide information about the working conditions, skills, activities, responsibilities and knowledge requirements associated with the relevant post. The KTE section of the report provides details of levels of knowledge, training and experience that are required to undertake the duties expected of the post-holder.
18.The Commissioner notes that the name of the post-holder is not included on the report.However, each of the posts specified in Mrs Walley's request has a single post-holder, and so the information also gives some indication of the level of knowledge, training and experience held by those individuals.
19.The Commissioner is therefore satisfied that the information sought by Mrs Walley, while relating to particular posts, also relates to those the individuals who hold those posts.Those individuals are identifiable from that information and other information in the possession of the data controller.
20.The Commissioner therefore finds that the information under consideration is personal data, and will therefore go on to consider whether disclosure of this personal data would contravene one or more of the data protection principles.
Would disclosure breach the first data protection principle?
21.The first data protection principle requires that the processing of personal data (here, the disclosure of the data in response to a request made under FOISA) must be fair and lawful and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. For sensitive personal data, one of the conditions in Schedule 3 to the DPA must also be met.
22.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and he is satisfied that the personal data in this case does not fall into this category. It is therefore not necessary to consider the conditions in Schedule 3 of the DPA in this case.
23.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
24.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.
Can any of the conditions in Schedule 2 of the DPA be met?
25.During the investigation, steps were taken to establish whether condition 1 (which applies where the data subject consents to the processing of their personal data) might be met in this case.NHS Dumfries and Galloway has indicated that, while it did not specifically seek the consent of staff when considering Mrs Walley's request, it has subsequently been informed by some of the relevant post-holders that should such consent have been requested it would have been withheld. Condition 1 is therefore not applicable in this case.
26.The Commissioner is satisfied that condition 1 cannot be met, and so condition 6 is the only one that might apply in the circumstances of this case.
Condition 6
27.Condition 6 allows personal data to be processed (in this case, via disclosure in response to Mrs Walley's information request) if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
28.There are, therefore, three specific tests which must be satisfied before condition 6 can be met, namely:
Does the applicant (Mrs Walley) have a legitimate interest in obtaining this personal data?
If yes, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?
Even if the processing is necessary for the legitimate purposes of the applicant, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?This will involve a balancing exercise between the legitimate interests of the applicant and those of the data subjects. Only if (or to the extent that) the legitimate interests of the applicant outweigh those of the data subjects can the personal data be disclosed.
Does Mrs Walley have a legitimate interest in obtaining the information?
29.Mrs Walley has indicated that her reason for requesting the information from NHS Dumfries and Galloway was to establish whether the post she held with NHS Dumfries and Galloway had been matched fairly and consistently with other posts of a similar nature in accordance with the aims and principles of Agenda for Change. She further indicated that while she perceived there to be an anomaly involving the assessment of her post, she had been unable to obtain the necessary information to substantiate or negate her concerns through internal mechanisms.
30.Having considered her comments, the Commissioner is satisfied that Mrs Walley has demonstrated that she has a legitimate interest in seeking information that will assist her in fully understanding the application of the Agenda for Change process by NHS Dumfries and Galloway. Indeed, he recognises that there is a general legitimate interest in achieving understanding of such job evaluation processes and how public authorities have gone about the task of ensuring that jobs are fairly and equitably evaluated.
Is the disclosure necessary to achieve those legitimate aims?
31.Having established that Mrs Walley does have a legitimate interest in obtaining the personal information, the Commissioner must now go on to consider whether the disclosure is proportionate as a means and fairly balanced as to ends, or whether these legitimate aims could be achieved by alternative means which would interfere less with the privacy of the employees in question.
32.As noted above, during the investigation, NHS Dumfries and Galloway proposed to make the information available to Mrs Walley without identifying information.Mrs Walley rejected this offer, indicating that she could see no reason why she should not be provided with the information she had requested in full.
33.While the proposed disclosure would be slightly less intrusive than providing the information Mrs Walley has requested in full, the Commissioner considers that it would not be possible for Mrs Walley to fully pursue her legitimate interest in understanding the basis for the assessment of the posts concerned without being able to identify the KTE information to the post to which it relates.
34.Taking account of the limited and specific nature of the information requested by Mrs Walley, the Commissioner is satisfied that disclosure is proportionate and that the aims of Mrs Walley cannot be achieved by any other means which would interfere less with the privacy of the employees in question.
35.The Commissioner notes that the information under consideration is explicitly held for the purposes of evaluating a post rather than an individual, and Mrs Walley has requested only one element of the information contained in the AfC matched report. He further notes that the information requested by Mrs Walley does not relate to the performance of any individual in their post. As such, the Commissioner considers at this stage that the level of intrusion which might be caused by Mrs Walley's request would be very limited.
36.In the light of the above, the Commissioner concludes that it is difficult to see how Mrs Walley could pursue her interests in a way that is less intrusive than the approach she has taken, and he finds that disclosure of all of the withheld information is necessary for the legitimate interest identified.
Would disclosure nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects?
37.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the employees in relation to the information withheld. As noted above, this will involve a balancing exercise between the legitimate interests of Mrs Walley and those of the post-holders. Only if the legitimate interests of Mrs Walley outweigh those of the post-holders can information contained in the AfC matched report be disclosed without breaching the first data protection principle.
38.The information in the reports describes the levels of knowledge, training and experience required by the post-holder to effectively fulfill the duties required of the post.In so doing, it gives some insight into the level of knowledge, training and experience held by the post-holders.However, it does not provide any detail of the actual levels of knowledge, training and experience held by individual post-holders, or include any assessment of their performance within that post.
39.The Commissioner takes the view that the information under consideration in this decision relates primarily to the post, rather than the post-holder, and is not significantly different from the type of information which might be included in a recruitment pack to enable job applicants to check they can offer the relevant skill set, qualifications and experience.
40.The Commissioner consequently considers that the degree of intrusion into the privacy of the post-holders that would follow from disclosure of the information under consideration would be very limited.The limited insights that would allowed by disclosure of the information would be restricted to the post-holders' professional lives rather than their personal lives.The Commissioner has accordingly he has given very limited weight to the legitimate interests of the post-holders in this case.
41.Having balanced the legitimate interests of the post holders against those of Mrs Walley, the Commissioner has concluded that that disclosure of the information contained in the KTE section of the AfC matched reports would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the post-holders.He finds that these are outweighed by the legitimate interests of Mrs Walley in all the circumstances of this case.
Would disclosure be fair and lawful
42.Having concluded that condition 6 can be met in relation to the withheld information discussed above, the Commissioner has gone on to consider (as required by the first data protection principle) whether disclosure of that personal data would be fair and lawful.
43.The Commissioner is satisfied that disclosure would not be unfair, for the reasons outlined above in relation to condition 6. NHS Dumfries and Galloway has not put forward any arguments as to why the disclosure of the information would be unlawful (other than in terms of a breach of the data protection principles) and, in any event, the Commissioner can identify no reason why disclosure should be considered unlawful.
44.Having found disclosure of the withheld information to be both fair and lawful, and in accordance with condition 6(1), the Commissioner concludes that disclosure of this information would not breach the first data protection principle.The Commissioner therefore concludes that the exemption in section 38(1)(b) has been wrongly applied by NHS Dumfries and Galloway to the withheld information.
DECISION
The Commissioner finds that Dumfries and Galloway Health Board (NHS Dumfries and Galloway) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mrs Walley.He finds that the information requested by Mrs Walley was not exempt from disclosure under section 38(1)(b) of FOISA, and so by withholding this information, NHS Dumfries and Galloway failed to comply with section 1(1) of FOISA.
The Commissioner requires NHS Dumfries and Galloway to provide Mrs Walley with the information contained in the Knowledge, Training and Experience section of the Agenda for Change matched reports for the seven identified posts, including the score applied, by 18 April 2011.
Appeal
Should either Mrs Walley or NHS Dumfries and Galloway wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
3 March 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
