Decision 049/2017: John Brown and the Scottish Further and Higher Education Funding Council Report on Fact Finding Exercise to Support the Scottish Funding Council's Review of Processes, Procedures and Governance at Glasgow Clyde College Reference No: 201600403 Decision Date: 31 March 2017 Summary The SFC was asked for a redacted version of the report it had commissioned from DLA Piper into governance at Glasgow Clyde College, following the suspension of its Principal. The SFC initially refused to disclose the redacted version of the report, although it did disclose it during the Commissioner's investigation. The Commissioner found that the SFC was wrong to have withheld the redacted Report initially. The SFC was also asked who the report had been distributed to. The Commissioner was not satisfied that the SFC had made it clear what recorded information it held about the distribution of the report and required the SFC to clarify this.

  Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and (2)(c) and (e)(ii) (Effect of exemptions); 36 (Confidentiality); 38(1)(b), (2)(a)(i) and (b) and (5) (definition of "data protection principles", "data subject" and "personal data) (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)

Further and Higher Education (Scotland) Act 2005 (the 2005 Act) section 7C (Assignation of colleges)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

  Background

1. On 26 November 2015, Mr Brown made an information request to the SFC. He asked for a copy of the Review Report ("the Report") "published" on or around June 2015, by solicitors DLA Piper LLP, who were commissioned by the SFC to report into the governance and procedures of Glasgow Clyde College (the College) following the suspension of its Principal. (The reference to the Report being "published" is understood to be a reference to the Report being sent to various bodies/people.) Among other requests, Mr Brown also asked for a list of all bodies and named persons who were sent a copy of the Report, either electronically or by printed copy.

2. The SFC responded on 11 January 2016. It withheld the Report in terms of section 36(1) of FOISA, stating that it was subject to legal privilege applied. It also withheld some personal data within the Report in terms of section 38(1)(b) of FOISA. The SFC disclosed information about the organisations and persons which had received copies of the Report.

3. On 15 January 2016, Mr Brown wrote to the SFC requesting a review of its decision. He reiterated that he wished to obtain the Report and considered the SFC's response misleading in respect of part of his request. He considered that legal privilege would not apply to a report that was commissioned as a statutory report and that the exemption in section 38(1)(b) could only apply to the unredacted Report, and not to the redacted Report. (This is considered in more detail below.)

4. In relation to his request for a list of bodies and named persons who had received the Report, he considered that he had been provided with incomplete information: he named people whom he understood had received the Report, but who were not listed in the SFC's response.

5. The SFC notified Mr Brown of the outcome of its review on 18 February 2016. It confirmed its initial decision and continued to withhold the Report in terms of sections 36(1) and 38(1)(b) of FOISA, adding that the Report was also exempt from disclosure in terms of section 36(2), on the basis that disclosure would constitute a breach of confidence.

6. The SFC provided further explanation of who had received the Report. The SFC's review also addressed other issues raised by Mr Brown which are not the subject of this decision.

7. On 29 February 2016, Mr Brown applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He asked the Commissioner to consider the refusal by SFC to provide him with:

· a copy of the redacted Report which had already been provided to a number of persons and

· a complete list of organisations and named individuals who had received the Report.

8. Mr Brown did not believe that the SFC had applied exemptions properly. He did not accept that the exemptions in section 36 applied or that the exemption in section 38(1)(b) of FOISA could apply to the Report after sensitive personal data had been redacted.

  Investigation

9. The application was accepted as valid. The Commissioner confirmed that Mr Brown made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

10. On 15 March 2016, the SFC was notified in writing that Mr Brown had made a valid application. The SFC was asked to send the Commissioner the information withheld from Mr Brown and the case was allocated to an investigating officer.

11. On 31 March 2016, the SFC provided Mr Brown with a copy of the redacted Report, with a further explanation of the organisations with whom the Report had been shared, before and after his request.

12. On 13 April 2016, Mr Brown wrote to the Commissioner explaining that he was still dissatisfied with the outcome to his information request. He asked who, in the Scottish Government and Audit Scotland, had received the report. He expected the SFC to hold a detailed note showing this. On 14 April 2016, Mr Brown added that he still required the list of interviewees which had been redacted from Appendix 2 of the Report. He accepted the redaction of the remaining information in the Report.

13. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 17 May 2016, the SFC was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested. The SFC responded.

14. Further correspondence took place with Mr Brown and with the SFC over the next few months including on the scope of the investigation. On 29 November 2016, the investigating officer told Mr Brown that, although he wanted the Commissioner to consider whether the SFC should have disclosed the list of people interviewed by DLA Piper as part of this investigation, she did not have the power to do that. The reasons for this are set out below.

15. On 30 January 2017, Mr Brown confirmed that, although he had been given a copy of the redacted Report in March 2016, he wanted a decision from the Commissioner on whether the SFC had been entitled to withhold the Report from him the previous month. He again expressed his frustration and dissatisfaction at not having received a circulation list or any comprehensive account showing to whom the redacted Report had been circulated.

16. The SFC was informed on 28 February 2017 that Mr Brown wished a decision on the circulation list and also on whether the redacted version of the Report should have been disclosed to him at review, rather than a few weeks later. As the SFC had not expressly been invited by the Commissioner to comment on this point, it was invited to do so and to explain, with reference to FOISA, why it withheld the redacted Report when reviewing its response to Mr Brown's request. The SFC responded on 13 March 2017.

  Commissioner's analysis and findings

17. In coming to a decision on this matter, the Commissioner considered all the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Brown and the SFC. She is satisfied that no matter of relevance has been overlooked.

The list of people interviewed by DLA Piper

18. The SFC commissioned DLA Piper LLP to carry out a fact finding exercise to support its review of processes, procedures and governance at the College, following the suspension of its Principal.

19. A redacted version of the Report was circulated to some organisations and persons, with some personal data removed. The redacted Report does not include Annex 2, i.e. a list of those interviewed by DLA Piper.

20. Mr Brown initially asked for the Report "published on or around June 2015". The full Report has not been published and, on an objective reading of the request, it is not clear whether it referred to the full unpublished Report or to the redacted circulated Report. However, Mr Brown's request for review and his application were clear and were framed in terms of dissatisfaction at not receiving the redacted version of the Report.

21. As a result, the Commissioner concluded that her investigation was limited to considering whether the redacted Report should have been disclosed to Mr Brown. This means she cannot consider whether he should have received the names of the interviewees (Appendix 2 to the Report), as this information was not part of the redacted version of the Report.

22. The Commissioner acknowledges that Mr Brown was not aware that the list of interviewees had been redacted from the version of the Report to which he referred in his request for review and application. However, the list of interviewees is the subject of a separate application to her and the matter will be considered in due course in a separate decision.

23. This decision therefore focusses on two points:

· whether Mr Brown received all the information which the SFC held at that time which would show to whom the Report was circulated and

· whether the SFC was entitled to withhold the redacted Report when it reviewed its response to Mr Brown's request on 18 February 2016.

The circulation list/distribution of the Report

24. Mr Brown was dissatisfied that the SFC had not supplied him with a circulation or distribution list for the Report, and was surprised that the SFC stated that it did not hold any such list, given that it viewed the Report as confidential and had limited its circulation.

25. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received. This is subject to qualifications, but these are not applicable in this case.

26. The SFC's initial reply of 11 January 2016 stated that those sent a copy of the Report were:

· the Scottish Government (redacted copy with sensitive personal data removed)

· the former members of the Board of the College (redacted copy with sensitive personal data removed)

· the Acting Principal of the College (redacted with sensitive personal data removed)

· the Former Chair of the Board of the College (unredacted copy)

27. The SFC's review of 18 February 2016 confirmed that the Report had been shared with:

· the Scottish Government (and the Scottish Government informed the SFC that they shared the Report with other parties with a common interest)

· Audit Scotland

· Brodies LLP (solicitors to the College: DLA Piper had shared a copy of the report with Brodies)

28. On 31 March 2016, having clarified the position with the Scottish Government, the SFC told Mr Brown that the circulation of the report included:

· the then members of the Board of the College, including the Acting Principal, but not the then suspended Principal (redacted Report)

· the Chair of the Glasgow Colleges' Regional Board (redacted Report)

· the then Chair of the Board of the College (unredacted Report)

29. On 21 June 2016, the SFC told Mr Brown:

"The information held by the SFC shows the report was sent directly to Angela Constance the then Cabinet Secretary for Education and Lifelong Learning. The report was not circulated to anybody else by the SFC." (Commissioner's emphasis)

30. The SFC explained that it was normal practice to email documents such as the Report to civil servants in the SFC's sponsor department at the Scottish Government. At the time of Mr Brown's request, no emails were located detailing how the Report was transferred to the Scottish Government.

31. During the investigation, the SFC made another search of its records, and discovered a letter sent to the Cabinet Secretary. It explained to the Commissioner that the Report had been sent directly to the Cabinet Secretary with a letter from the SFC's Vice Chair. This had been overlooked in its initial information search. The SFC told Mr Brown that, at the time of his request:

"…the report was not on any circulation list held as information by the SFC. The information held by the SFC shows the report was sent directly to Angela Constance the then Cabinet Secretary for Education and Lifelong Learning. The report was not circulated to anybody else by the SFC."

32. The SFC also stated that, as far as it was aware, DLA Piper's process was to send Brodies LLP the final draft of the Report before it was sent to the Government, but it held no recorded information outlining a direct instruction for DLA Piper to do this. The SFC commented that, in any case: "this was not the official final report that was sent to Angela Constance."

33. The SFC then explained to the Commissioner that the Report was originally sent directly to the then Cabinet Secretary on 30 June 2015 and further redacted versions were later sent, on request, to a named civil servant. The civil servant was not the initial contact, and the SFC submitted that the name of that civil servant was exempt from disclosure in terms of section 38(1)(b) of FOISA. The SFC then stated that, at the time of the request, the only definite (i.e. recorded) information it held regarding who the report was sent to directly was the letter to Angela Constance. It confirmed that the Report was not sent directly to the named civil servant or distributed by the SFC to third parties.

34. The Commissioner is disappointed that, even after a lengthy investigation, she has been unable to establish with any degree of certainty what recorded information the SFC held at the time of Mr Brown's request about the circulation of the Report, and whether the SFC provided the information to Mr Brown. The Commissioner accepts that the SFC did not hold a circulation list of the type Mr Brown expected, but it is clear that the SFC did hold some recorded information showing the persons and organisations to whom it had sent the Report, or to whom it had instructed its solicitors to send the Report. Although the SFC provided Mr Brown with some information, it failed to provide all the information which it held and which was covered by this part of his request. It therefore failed to comply in full with section 1(1) of FOISA.

35. As there is still no certainty about the recorded information which the SFC held at the date when Mr Brown made his request (as distinct from information which was recorded after that date), the Commissioner requires the SFC to respond again to Mr Brown on this point, making it clear what recorded information it held at the date of his request about the circulation of the Report. If the SFC holds information about the circulation of the Report which postdates Mr Brown's request, it may choose to provide Mr Brown with that information also, although, if it does this, it should make it clear whether the information pre-dates or post-dates the request.

36. If the SFC needs to carry out further searches to be sure what information was held, it should do so, and be prepared to provide evidence from these searches or elsewhere to support its final response on this point.

The redacted Report

37. The Commissioner will now consider whether the SFC was correct to withhold the redacted Report, when responding to Mr Brown's request and request for review.

38. When reviewing its response to Mr Brown's request, the SFC applied the exemptions in section 36(1) and (2) of FOISA (Confidentiality) and section 38(1)(b) (Personal information). The SFC's review makes clear that it "considered the request afresh." However, it appears to have made no attempt to address whether the redacted Report could be disclosed, in whole or in part, or the extent to which the information in it was exempt from disclosure.

39. The Commissioner is required to consider whether the exemptions cited by the SFC at review applied to any of the information in the redacted Report, at the time the SFC carried out its review.

40. The Commissioner invited submissions from the SFC on why it had withheld the redacted Report at review when it had been able to disclose it to Mr Brown a few weeks later. The SFC responded on 13 March 2017. It referred the Commissioner to its review response to Mr Brown (see paragraph 5). It also referred the Commissioner to the email it sent to Mr Brown when it disclosed the redacted Report to him. The email states:

"Given that there are now a number of documents in the public domain, including previously unpublished minutes of the College Board, we have decided to provide you with a copy of the redacted DLA Piper report into the governance of Glasgow Clyde College".

41. The SFC also told the Commissioner that, as the redacted report was by then in the public domain, any exemptions no longer applied.

Section 36(1) - Legal privilege

42. Section 36(1) of FOISA provides that information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

43. The SFC initially relied on this to withhold all information in the Report. As stated above, the Commissioner will consider whether this exemption applied to the information in the redacted Report.

Legal advice privilege

44. One type of communication covered by this exemption is that to which legal advice privilege, a form of legal professional privilege, applies. Legal advice privilege covers communications between lawyers and their clients in the course of which legal advice is sought or given. For legal advice privilege to apply, certain conditions must be fulfilled:

(i) the communications must involve a professional legal adviser, such as a solicitor or an advocate. This may include an in-house legal adviser or an external solicitor engaged by the Council;

(ii) the legal adviser must be acting in his/her professional capacity, and

(iii) the communications must occur in the context of the legal adviser's professional relationship with his/her client.

45. In its review, the SFC stated that it had engaged DLA Piper in a professional capacity to gather information and present legal advice, and that the Report contains legal advice to the SFC as DLA Piper's client. The redacted Report clearly states that it is "strictly confidential and legally privileged". The SFC acknowledged that the content of the Report was "towards information gathered, rather than legal advice," but argued that advice on legal issues was incorporated into the overall text and could be difficult to disentangle.

46. Mr Brown did not agree that legal privilege could apply to a "statutory report" and took the view that such a report was not a confidential communication between client and solicitor. He considered the Report to be "statutory fact-finding" rather than "private advice".

47. The Commissioner accepts that DLA Piper were employed by the SFC to produce the Report according to the terms of reference. However, the exemption in section 36(1) is specific and relates only to information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings.

48. The Report is a review conducted in terms of section 7C(7) of the Further and Higher Education (Scotland) Act 2005 (the 2005 Act). This section provides:

"The [SFC] may, whenever it considers appropriate, review whether a college which is assigned by order under subsection (1) is a body for which there are suitable provisions, procedures and arrangements of the type described by or under section 7(2)."

49. Section 7C(8) of the 2005 Act provides:

"On completing a review, the [SFC] must provide a report of the review to the Scottish Ministers which-

(a) sets out the conclusions which it has reached;

(b) explains why it has reached those conclusions; and

(c) makes any recommendations for action in consequence of those conclusions as it considers appropriate."

50. Section 7C of the 2005 Act is set out in full in Appendix 1.

51. The Commissioner understands that the Report was the outcome of work carried out by DLA Piper to assist the SFC to complete the review under section 7C(8) of the 2005 Act, and was not envisaged as the report specified in section 7C(8), to be provided to the Scottish Ministers. However, from all that SFC has supplied and argued in its submissions to the Commissioner, she understands that the Report by DLA Piper was, in fact, the report supplied to the Scottish Minsters by the SFC under section 7C(8).

52. The SFC originally argued that the whole of the Report was subject to legal professional privilege. The Commissioner acknowledges that the Report was prepared by solicitors on the instructions of the SFC. However, it generally makes findings of fact and recommendations on matters of good governance and management, as opposed to giving legal advice to the SFC. The Commissioner finds that such information is not, in the circumstances of this case, subject to legal advice privilege.

53. The Commissioner accepts that the redacted Report contains a small amount of information which could be legally privileged in line with the tests in paragraph 44. However, information cannot be privileged unless it is also confidential.

54. The redacted Report was circulated to a number of persons, even before Mr Brown made his request, albeit that such circulation was (according to the SFC) carried out in the expectation that the Report was confidential. Despite the difficulty the SFC has had in providing a definite distribution list for the Report, it is clear that the Report, in some form or other, was distributed to various organisations, including the Scottish Government, the former members of the College Board, the Acting Principal, the Former Chair of Board, Audit Scotland, Brodies LLP, the Chair of the Glasgow Colleges' Regional Board, and the then Chair of the College Board.

55. In the light of the above, the Commissioner is not able to accept, given the extent to which it had been shared, that the limited amount of legal advice in the redacted Report remained confidential. Any privilege in the legal advice had been waived by the SFC.

Litigation privilege

56. The Commissioner has considered whether litigation privilege applies to the information in the redacted Report. If litigation privilege applies, the exemption in section 36(1) of FOISA is engaged.

57. Litigation privilege covers documents created in contemplation of litigation (also known as communications post litem motam.) Communications post litem motam are treated as legally privileged to ensure that any person or organisation involved in or contemplating a court action can prepare their case as fully as possible, without the risk that their opponent/s or prospective opponent/s will gain access to the material generated by their preparations. The privilege covers communications at the stage when litigation is pending or in contemplation.

58. Whether litigation privilege applies in any particular case will be a question of fact, the key question generally being whether litigation was actually in contemplation at a particular time.

59. There is nothing in the SFC's submission which would make it reasonable to accept that the Report (redacted or unredacted) was prepared in contemplation of litigation, and was of a character which brought it within the scope of litigation privilege. The Report was prepared for the purposes of the 2005 Act. The SFC has not provided the Commissioner with any evidence to suggest that any person was contemplating litigation at that time, though there is mention of possible litigation in the disclosed redacted Report.

60. As noted, the redacted Report was distributed to other persons and the Commissioner finds that, even if the contents were privileged at one time (which has not been shown), any privilege was lost by the time of Mr Brown made his request.

61. Having considered the submissions received from the SFC, the Commissioner does not accept that the information in the redacted Report was subject to litigation privilege. Consequently, she does not accept that the information in the redacted Report was correctly withheld under section 36(1) of FOISA.

62. Having reached this conclusion, she is not required to consider the public interest test in section 2(1)(b) of FOISA, in relation to the information in the redacted Report.

Section 36(2) - Confidentiality

63. In its review response, the SFC explained that DLA Piper interviewed individuals on a confidential basis. The interview notes are held in confidence, and DLA Piper regarded them as legally privileged.

64. Section 36(2) of FOISA provides that information is exempt if it was obtained by a Scottish public authority from another person (including another such authority) and its disclosure by the authority so obtaining it to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or any other person. Section 36(2) is an absolute exemption and is not, therefore, subject to the public interest test in section 2(1)(b) of FOISA. However, it is generally accepted in common law that an obligation of confidence will not be enforced to restrain the disclosure of information which is necessary in the public interest.

Was the information obtained from another person?

65. Section 36(2) contains a two stage test, both parts of which must be fulfilled before the exemption can be relied upon. The first is that the information must have been obtained by a Scottish public authority from another person. "Person" is defined widely and means another individual, another Scottish public authority or any other legal entity, such as a company or partnership.

66. In its review response, the SFC explained that the information contained in the Report was collected from individuals through interviews.

67. The Commissioner cannot accept that the actual information in the redacted Report was "obtained" from another person. While the redacted Report inevitably draws on evidence and views obtained from interviewees, its contents represent the conclusions DLA Piper reached after considering the evidence from the interviewees, as opposed to the views of the interviewees.

68. The redacted Report states that the interviews were "conducted on a confidential basis in order to ensure a frank and open discussion with interviewees." It continues with the proviso:

"However, the focus of the interviews was to identify key themes, concerns, behaviours and approach and then to report to [the SFC] on these at a higher level without identifying individuals or attributing comments to specific persons (where it is possible to do so)."

69. The Commissioner does not take this to mean that confidentiality was offered to interviewees in the sense that they would not be named. Rather, the confidentiality appears to extend to what they said when interviewed, so that comments would not be attributable.

70. Given that the information in the redacted Report does not represent reported, attributable comments or conclusions drawn from interviewees, but instead represents the conclusions reached by DLA Piper, the Commissioner does not accept that the information was "obtained" from the interviewees.

71. She therefore takes the view that the first test required for section 36(2) to apply is not met and that the exemption does not apply.

Section 38(1)(b) - Personal Information

72. The SFC withheld the Report under section 38(1)(b) of FOISA on the basis that disclosure would breach the first data protection principle.

73. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, section 38(2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA. This exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

74. The Commissioner is considering here only the personal data that can be found in the redacted Report (which the SFC has now disclosed). She is not considering the personal data which was redacted from the full version of the Report - for example, the names of those interviewed.

75. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual".

76. The Report was redacted in a way which was clearly intended to avoid identifying individuals, or attributing comments to specific persons. However, it contains some names and some references to persons who could be identified from their job description. The information clearly relates to those identifiable individuals and is therefore their personal data.

Would disclosure contravene the first data protection principle?

77. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The Commissioner does not regard any of the personal data in the redacted Report as sensitive personal data, as defined by the DPA. "Processing" here means disclosing the personal data into the public domain in response to Mr Brown's information request.

Can any of the conditions in Schedule 2 of the DPA be met?

78. Guidance[1] issued by the Commissioner on section 38(1)(b) states that, generally, only the first and sixth conditions in Schedule 2 of the DPA are likely to be relevant when considering a request for personal data under FOISA.

79. The first condition allows personal data to be disclosed where a data subject has given consent to the processing. The Commissioner accepts that consent has not been sought or given by the data subjects in this case. Therefore, condition 1 in Schedule 2 cannot be met.

80. Condition 6(1) allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

81. The tests which must be met before condition 6(1) can apply are:

(i) Does Mr Brown have a legitimate interest or interests in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr Brown's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

82. There is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Mr Brown must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 permits personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the SFC was correct to refuse to disclose the information to Mr Brown

Does Mr Brown have a legitimate interest in obtaining the personal data?

83. Mr Brown's legitimate interest is broadly a professional and personal interest in scrutiny of the investigation involved in the Report. He has expressed concerns about the events considered in the Report (these concerns are not summarised in this decision, but have been considered by the Commissioner). Mr Brown argued that the Report was part of a process involving the Scottish Ministers, and that there were important public issues at stake which were worthy of scrutiny and possible further research and publication.

84. The Commissioner is satisfied that Mr Brown has a legitimate interest in obtaining the personal data in the redacted Report. She accepts that Mr Brown (and the general public) has a legitimate interest in information relating to the SFC's compliance with its legal obligations.

Is disclosure of the information necessary for the purposes of these legitimate interests?

85. The Commissioner must now consider whether disclosure of the personal data in the redacted Report is necessary for Mr Brown's legitimate interests. In doing so, she must consider whether these interests might reasonably be met by any alternative means. She must consider these questions in relation to circumstances existing at the time of the SFC's review: in terms of her decision on this point, it is irrelevant that Mr Brown has since been given the redacted Report.

86. The decision by the Supreme Court in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[2] stated (at paragraph 27 of the judgment):

"… A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less."

87. Disclosure of the personal data in redacted Report, at the time of the SFC's review, would have allowed Mr Brown knowledge of DLA Piper's findings inasmuch as they relate to identifiable individuals or office holders. This would have assisted his understanding of the investigation undertaken by DLA Piper, and the processes followed. The Commissioner can identify no other viable means of meeting Mr Brown's legitimate interests which would interfere less with the privacy of the data subjects than providing the redacted Report. Without the personal data Mr Brown could not assess or understand the events at issue. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for Mr Brown's legitimate interests to be achieved.

Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

88. The Commissioner must consider whether disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.

89. The SFC argued that disclosure was unwarranted as it would "clearly" prejudice the rights and freedoms of the data subjects. Disclosure would have led to the identification of the data subjects, who would have a reasonable expectation that their personal data would not be disclosed. The SFC argued that Mr Brown's legitimate interests did not outweigh those of the data subjects.

90. The SFC submitted that the interviewees had an expectation of confidentiality. The SFC explained that "the vast majority of interviewees" received correspondence from DLA Piper in advance of interview, which stated:

"The transcripts will be held confidentially and securely by us in accordance with our legal obligations and those of [the SFC]. [The SFC] does not anticipate that its report of the Review will include references to named individuals, except where it is necessary in order to describe specific actions or decisions taken in the course of fulfilling their duties as officeholders."

91. In her briefing on section 38 of FOISA, the Commissioner notes a number of factors which should be taken into account in carrying out the balancing exercise relating to legitimate interests. These include:

(i) whether the information relates the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

(ii) the potential harm or distress that may be caused to by the disclosure;

(iii) whether the individual has objected to the disclosure; and

(iv) the reasonable expectations of the individual as to whether the information would be disclosed.

92. In most cases, the information in the redacted Report relates to the public life of individuals who were interviewed. They were interviewed because of their professional responsibilities, or because they represented groups of individuals with an interest in the governance of the College. The personal data in the redacted Report largely relates to individuals with a prominent and public role in governance of a higher educational institution. A person occupying a senior position in public life will have an expectation that their actions in that role will be subject to scrutiny.

93. The redacted Report contains few references to identifiable individuals: and where they appear, these describe specific actions or decisions taken in the course of fulfilling the individual's duties as an officeholder. The Commissioner is therefore not satisfied that disclosure of the personal data in the redacted Report has the potential to cause harm or distress to the data subjects.

94. The Commissioner accepts that the data subjects may have expected their comments to be treated confidentiality, but does not consider that the data subjects would expect this confidentiality to extend to the personal data that was published within the redacted Report, given their roles and involvement with the College. Interviewees were likely to be aware that the outcome of the process in which they were involved would be a published report, in which their comments might be reflected. They would have understood that they were being interviewed in respect of a statutory report that would ultimately inform a Report from the SFC to the Scottish Ministers, and that they were being interviewed because of the position they held.

95. Having considered the competing interests in this particular case, the Commissioner finds that Mr Brown's legitimate interests outweighed any prejudice to the rights and freedoms of the data subjects that would result from disclosure. Disclosure of the personal data of the redacted Report would have increased transparency about the Report and the evidence upon which it was based.

96. As noted above, the must consider these questions in relation to circumstances existing at the time of the SFC's review and she has done so. However, the fact that the SFC was able to disclose the personal data weeks after to Mr Brown weeks after it carried out a review, strengthens her view.

97. On balance, the Commissioner finds that the requirements of condition 6 of Schedule 2 of the DPA can be met here, in relation to disclosure of the withheld personal data within the redacted Report at the time of the SFC's review.

98. As the Commissioner has not accepted that disclosure of the personal data would lead to unwarranted prejudice to the rights, freedoms or legitimate interests of the data subjects, the Commissioner also concludes, for the same reasons, that disclosure of the withheld information would be fair.

99. In these circumstances, the Commissioner finds that disclosure of the personal data would be lawful in this case, and that the SCF was not entitled to withhold this information under the exemption in section 38(1)(b) of FOISA.

Decision The Commissioner finds that the Scottish Further and Higher Education Funding Council (the SFC) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Brown. The Commissioner finds that the SFC wrongly relied on the exemptions in sections 36(1), 36(2) and 38(1)(b) of FOISA to withhold the redacted Report. This was a breach of section 1(1). As the SFC provided Mr Brown with a copy of the redacted Report during the investigation, the Commissioner does not require the SFC to take any further action. The SFC provided Mr Brown with some information about the circulation of the Report. However, the SFC failed to provide some information which it later disclosed, and therefore failed to comply, in full, with section 1(1) of FOISA. The Commissioner requires the SFC to take steps, in line with paragraphs 35 and 36, to establish what information it held, and to provide this information to Mr Brown. The SFC must take these steps by 17 May 2017.

  Appeal

Should either Mr Brown or the SFC wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

  Enforcement

If the SFC fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the SFC has failed to comply. The Court has the right to inquire into the matter and may deal with the SFC as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

31 March 2017

 Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(c) section 36(2);

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

36 Confidentiality

(1) Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information.

(2) Information is exempt information if-

(a) it was obtained by a Scottish public authority from another person (including another such authority); and

(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Further and Higher Education (Scotland) Act 2005

7C Assignation of colleges

(1) The Scottish Ministers may by order assign colleges of further education to a regional strategic body.

(2) An order may assign a college which is not, immediately before the order is made, either -

(a) a fundable post-16 education body; or

(b) assigned to another regional strategic body,

only if the Council has proposed, or has approved, the assignation.

(3) For the purposes of considering whether or not to propose or approve any assignation under subsection (2), the Council must have regard to the desirability of ensuring that the college concerned is a body for which there are suitable provisions, procedures and arrangements of the type described by or under section 7(2).

(4) Without prejudice to section 34(2), the power to make an order under subsection (1) includes power to -

(a) remove from schedule 2 any entry relating to a college to which the order relates;

(b) make such further provision in relation to such a college as the Scottish Ministers consider appropriate.

(5) But an order under subsection (1) may remove an entry relating to a college from schedule 2 only if the Council has proposed, or has approved, the removal.

(6) Before making an order under this section, the Scottish Ministers must consult -

(a) the regional strategic body (except where not already established);

(b) every college to which the order relates (except any not already established);

(c) the representatives of any trade union which is recognised by any college to which the order relates or which otherwise appears to the Scottish Ministers to be representative of the staff of such a college;

(d) the students' association of the colleges to which the order relates;

(e) the Council;

(f) any local authority for an area in which any of the colleges to which the order relates is situated; and

(g) any other person appearing to the Scottish Ministers as likely to be affected by the order.

(7) The Council may, wherever is considers appropriate, review whether a college which is assigned by order under subsection (1) is a body for which there are suitable provisions, procedures and arrangements of the type described by or under section 7(2).

(8) On completing a review, the Council must provide a report of the review to the Scottish Ministers which -

(a) sets out the conclusions which it has reached;

(b) explains why it has reached those conclusions; and

(c) makes any recommendations for action in consequence of those conclusions as it considers appropriate.

(9) References in this Act to a regional strategic body's colleges are references to the governing bodies of the colleges assigned to it by an order under this section.

---