Decision 050/2019: Investigative report into allegations of data manipulation

Public authority: University of Edinburgh
Case Ref: 201800425

Summary

The University was asked for an investigative report regarding the research misconduct of a senior lecturer who had been dismissed from post.

After an investigation, the Commissioner agreed that the majority of the information held by the University was personal data exempt from disclosure under section 38(1)(b) of FOISA. However, he found that some information was not exempt and should have been disclosed. The University disclosed some of this information during the investigation, but did not disclose details of the identified incorrect data or the bibliographic details of one of the journal articles identified as requiring retraction. The Commissioner ordered disclosure of this information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 20(6) (Requirement for review of refusal etc.); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA 1998) section 1(1) (definition of "personal data" (Basic interpretative provisions); Schedule 1 Part I - The principles (first data protection principle); Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data (condition 6(1))

Data Protection Act 2018 (the DPA 2018) Schedule 20, (Transitional provision etc - paragraph 56)

General Data Protection Regulation (the GDPR) Articles 5(1) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 13 October 2017, Dr W made a request for information to the University of Edinburgh (the University). The information requested was:

(i) Investigative report on a named lecturer's publications, and assessment of the data manipulation evidence in them, including recommendations on corrections or retractions.

(ii) A statement on whether a named senior author of several of these publications was investigated or questioned in any way, and what the outcome was.

2. The University responded on 16 November 2017. It withheld the information under section 38(1)(b) of FOISA, arguing that disclosure would be unfair to the individuals concerned.

3. On 16 November 2017, Dr W wrote to the University and requested a review of its decision. In this email, Dr W did not explain why he was dissatisfied with the University's initial response to his request for information.

4. The University responded on 14 December 2018. It notified Dr W that it was upholding its previous response and that it still considered the information he had requested to be exempt from disclosure under section 38(1)(b) of FOISA.

5. On 22 December 2017, Dr W applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Dr W stated he was dissatisfied with the outcome of the University's review because it was withholding all of the information he had requested, and it had not considered disclosing a redacted report to him.

6. The Commissioner was unable to accept Dr W's application as his requirement for review had not indicated why he was dissatisfied with the University's response. He was advised to ask the University to accept a late request for review, noting that the University was permitted to do so under section 20(6) of FOISA.

7. On 5 February 2018, Dr W wrote to the University requesting a new review of its original response. He provided several reasons for dissatisfaction, one of which was that he did not agree that it needed to protect the privacy of a senior faculty member.

8. The University undertook a review of its initial response and notified Dr W of the outcome of its review on 5 March 2018. It upheld its previous position, stating that the information he had requested was exempt from disclosure in terms of section 38(1)(b) of FOISA.

9. On 5 March 2018, Dr W applied to the Commissioner for a decision in terms of section 47(1) of FOISA. The Commissioner has taken into account the terms of dissatisfaction raised by Dr W in his application of 22 December 2017 as well as those raised in the application made on 5 March 2018.

Investigation

10. The application was accepted as valid. The Commissioner confirmed that Dr W made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

11. On 21 March 2018, the University was notified in writing that Dr W had made a valid application. The University was asked to send the Commissioner the information withheld from Dr W. The University provided the information and the case was allocated to an investigating officer.

12. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The University was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

Commissioner's analysis and findings

13. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Dr W and the University of Edinburgh. He is satisfied that no matter of relevance has been overlooked.

Withheld information

14. The information being withheld from Dr W is the entire investigative report into allegations of data manipulation by a named lecturer, including the list of journal articles that were identified as requiring retraction.

15. During the investigation, the University provided Dr W with the bibliographic details of all but one of the journal articles identified as requiring retraction. However, the Commissioner will consider whether details of all of the journal articles should have been provided to Dr W at the time when he submitted his requirement for review.

16. The University is also withholding information on whether a senior author was questioned or investigated in any way regarding the investigation into the named lecturer, along with the outcome of any such questioning.

Section 38(1)(b) of FOISA (Personal information)

17. The University withheld all of the information requested by Dr W on the basis that it was exempt from disclosure under section 38(1)(b) of FOISA, being personal data which, if disclosed, would breach the first data protection principle.

Data Protection Act 2018 (Transitional provisions)

18. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amended section 38 of FOISA and also introduced a set of transitional provisions which set out what should happen where a public authority dealt with an information request before FOISA was amended on 25 May 2018, but where the matter is being considered by the Commissioner after that date.

19. In line with paragraph 56 of Schedule 20 to the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018 (as is the case here - the review response was issued on 5 March 2018), the Commissioner must consider the law as it was before 25 May 2018 when determining whether the authority dealt with the request in accordance with Part 1 of FOISA.

20. Paragraph 56 of Schedule 20 goes on to say that, if the Commissioner concludes that the request was not dealt with in accordance with Part 1 of FOISA (as it stood before 25 May 2018), he cannot require the authority to take steps which it would not be required to take in order to comply with Part 1 of FOISA on or after 25 May 2018.

21. The Commissioner will therefore consider whether the University was entitled to apply the exemption in section 38(1)(b) of FOISA under the old law. If he finds that the University was not entitled to withhold the information under the old law, he will only order the University to disclose the information if disclosure would not now be contrary to the new law.

The exemption

22. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA 1998) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA 1998.

23. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

24. In order to rely on this exemption, the University must show that the information being withheld is personal data for the purposes of the DPA 1998 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA 1998. The University considered disclosure of the information would breach the first data protection principle.

Is the withheld information personal data?

25. "Personal data" are defined in section 1(1) of the DPA 1998 as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

26. The University submitted that the withheld information concerns allegations into research misconduct by a named member of staff, and whether they were founded or unfounded. It argued that the investigation report contains not only the personal data of the person under investigation, but also those of witnesses. The University submitted that disclosing the investigation report would disclose information 'relating to' and 'obviously about' the named member of staff as well as the witnesses. It concluded that all of the information contained in the report is the personal data of the named member of staff: they and their actions are at the heart of the report.

27. The University also submitted that any information revealing whether a senior author was questioned or investigated in relation to the research misconduct (and information about the outcome of any such questioning or investigation) would be the personal data of the senior author.

28. Having considered the submissions received from the University and the withheld information, the Commissioner accepts the arguments put forward by the University, and is satisfied that the report contains the personal data of one or more identifiable living individuals. He notes that the withheld information, as a whole, clearly relates to the named lecturer under investigation. The Commissioner also accepts that any information regarding the questioning of the named senior author would be the personal data of that individual. Consequently, the Commissioner accepts that the information is personal data, as defined by section 1(1) of the DPA 1998.

Would disclosure breach the first data protection principle?

29. The University indicated that disclosure of the withheld personal data would breach the first data protection principle.

30. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA 1998 is met. The processing in this case would be making the information publicly available in response to Dr W's request.

Can any of the conditions in Schedule 2 be met?

31. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47 [1] (the CSA case) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).

32. It appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the personal data to Dr W. In any event, neither Dr W nor the University have suggested that any other condition would be relevant.

33. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

34. There are a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Does Dr W have a legitimate interest or interests in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Dr W's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

35. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Dr W must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the personal data to Dr W.

Does Dr W have a legitimate interest in obtaining the personal data?

36. Dr W argued that the information should be disclosed because the wider scientific community has a right to know which particular journal articles were found to be based on unreliable information. He argued that, by not disclosing this information, the University is misleading scientists worldwide by failing to indicate which research is unreliable. Dr W alleged that academics at the University have an unfair advantage over researchers at other Institutions through their knowledge of which results can be trusted and which cannot.

37. Dr W submitted that if research funds were used for "fraudulent" research, the tax-payer and non-profit funding agencies were entitled to learn of it.

38. Dr W stated that he was content for the names and identities of witnesses and whistle blowers to be withheld, but he did not agree that the names of scientists who are under a misconduct investigation should be withheld, particularly if they are above the rank of a PhD student.

39. The University accepted that Dr W has a legitimate interest in the information as he is a journalist and there is a public interest in ensuring the appropriate use of public funds, and in ensuring research misconduct is identified.

40. The Commissioner is satisfied that Dr W has a legitimate interest in information which would enable him (and the wider public) to understand which journal articles were based on discredited research and which would also shed light on the investigative procedure which resulted in research misconduct being identified.

41. The Commissioner acknowledges that Dr W is not generally seeking the identities of witnesses or whistle blowers (apart from asking whether a named senior author was included in the investigation), but given the interwoven nature of the withheld information, it does not appear possible to anonymise the contents of the report for disclosure (as noted, the Commissioner considers that the whole report is the personal data of the named member of staff). He will go on to consider whether any of the personal data should be disclosed, including the names of any witnesses.

Is the processing necessary for the purposes of these interests?

42. In reaching a decision on whether disclosure of the personal data under FOISA is required for the purposes of Dr W's legitimate interests, the Commissioner must consider whether those interests might reasonably be met by any alternative means.

43. Having considered all relevant arguments carefully, the Commissioner is satisfied that disclosure of the withheld personal data would give Dr W (and the wider public) a clear understanding of the research papers which were found to be unreliable, and the process through which the University formed its conclusion.

44. The Commissioner finds that, in the circumstances of this case, Dr W's legitimate interests could not reasonably be met by alternative means. The University suggested that it could not disclose information about the retracted journal articles until it had contacted all relevant parties. The University contacted the affected journals on 27 October 2017, more than three months before the date when Dr W submitted his requirement for review. By the date of the review, the journals had not yet published retractions of the affected articles (and, indeed, had not done so by May 2018). The Commissioner does not consider it was reasonable to expect Dr W to wait until this entire process was complete. Overall, the Commissioner is satisfied that disclosure of the personal data is necessary to meet Dr W's legitimate interests.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

45. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Dr W's legitimate interests, he is now required to consider whether that disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Dr W and those of the data subjects. Only if the legitimate interests of Dr W outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

46. The Commissioner must approach this balancing exercise on the basis that disclosure under FOISA is disclosure to the world at large and not simply to Dr W.

47. The University referred to previous decisions issued by the Commissioner. In particular, it referred to Decision 112/2011 Mr Alan Richardson and Perth and Kinross Council [2] where the Commissioner found that disciplinary proceedings are internal processes and that it would not be within the reasonable expectation of the employees that the information forming the report following the investigation of their conduct would be made available to anyone other than themselves, their representatives and those persons conducting the disciplinary hearing.

48. In the same Decision, the Commissioner also found that witnesses who gave or provided information within the disciplinary process would expect that the information they provided would be taken into account in the disciplinary process, but they would not expect that information to be disclosed into the public domain as part of a response to a FOISA request.

49. In summary, the University concluded that the rights and freedoms of the data subjects in this case outweighed Dr W's legitimate interests in obtaining the information.

50. Dr W submitted that the University sacked a senior lecturer on accusations of research misconduct and argued that the wider academic community does not know which publications are reliable, or whether they are basing their own research on research that may have been proven to be unreliable. Dr W argued that the academic community has a right to know which research results cannot be trusted; at present only staff within the University will know which results are "fake" and which are not. Dr W argued that the University is misleading global scientists by withholding information about the papers that have been proven to be unreliable and that the wider academic community is entitled to receive this information.

51. Dr W argued that the dismissed senior lecturer had a number of regular co-authors, who are very senior academics at the University, and believed it was important to know the extent of their potential involvement in any misconduct. Dr W noted that junior researchers regularly apply to the University for PhD or post-doctoral positions and submitted that they are entitled to know, before applying, "if any of their potential hosts and supervisors were engaged in research misconduct". The Commissioner notes that in its response to Dr W's original request for information the University stated: "In accordance with the Guidance for Managing Formal Investigations, relevant witnesses were identified and interviewed. None of the former employee's colleagues or research collaborators were implicated in anyway in the research misconduct findings."

52. In the Commissioner's guidance on section 38(1)(b) of FOISA, he notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

• whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
• the potential harm or distress that may be caused by the disclosure
• whether the individual objected to the disclosure
• the reasonable expectations of the individuals as to whether the information should be disclosed.

53. There are two parts to Dr W's information request and two different data subjects. In part (i) of the request, he is seeking a copy of the investigative report into alleged research misconduct of a named member of staff. In part (ii) of the request he is seeking information as to whether a senior author was questioned or investigated as part of the misconduct investigation, along with the outcome of any such questioning and/or investigation.

Part (ii) of the information request

54. In part (ii) of Dr W's information request, he asked for a statement on whether a named senior author was investigated or questioned in any way, and what the outcome was. While the Commissioner considers this information to be the personal data of the named member of staff (as it relates to the investigation of misconduct on their part), he also considers the senior author to be a data subject, as the information relates to him too and is therefore his personal data.

55. The University has not relied upon section 18 of FOISA, which would allow it to refuse to confirm or deny whether it holds information covered by part (ii) of Dr W's request. The University's decision to rely on the exemption in section 38(1)(b) of FOISA in effect confirms that it holds information covered by this part of the request. However, the Commissioner must consider whether disclosure of such information would breach the first data protection principle in the DPA 1998.

56. As noted above, the Commissioner is required to consider whether disclosing the information would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject, in this case the senior author. This involves a balancing exercise between the legitimate interests of Dr W (in understanding the extent of the investigation and process by which misconduct was found) and those of the senior author. Only if the legitimate interests of Dr W outweigh those of the senior author can the information be disclosed without breaching the first data protection principle.

57. The University submitted that it had not specifically approached the senior author for permission to disclose their personal data. Representations were received from the University relating to what would have been told to contributors to the misconduct investigation.

58. The Commissioner considers that for misconduct investigations to be thorough they need honest input from all contributors. It is therefore common for those being interviewed to be advised that their comments will only be seen by those involved in the disciplinary procedures or other relevant parties. This reassurance is necessary to ensure that individuals feel able to contribute fully to the process without fear that their comments may be disclosed to the wider public.

59. In the circumstances, the Commissioner is satisfied that the senior author had no expectation that their personal data would be disclosed in response to a request made under FOISA.

60. The Commissioner has considered the arguments put forward by Dr W, in which he argues that his legitimate interests (and those of the wider academic community) outweigh those of the data subjects involved in this case. While those arguments have merit and carry weight, the Commissioner must consider whole circumstances including the University's statement in response to the original request for information that none of the former employee's colleagues or research collaborators were implicated in anyway in the research

61. misconduct findings. In all the circumstances, the Commissioner is satisfied that in this case, the legitimate interests of the data subject (the senior author) outweigh the legitimate interests of Dr W.

62. As there is no condition in Schedule 2 which would permit the University to disclose the personal data of the senior author, the Commissioner finds that all of the information falling within the scope of part (ii) of Dr W's information request is exempt from disclosure under section 38(1)(b) of FOISA.

Part (i) of the information request

63. As noted above, in part (i) of Dr W's information request, he asked for the entire investigative report into the research misconduct and assessment of the data manipulative evidence in them, including recommendations on corrections or retractions. While the investigative report contains the personal data of witnesses and other third parties as well as that of the senior lecturer, the Commissioner is satisfied that all of the information (including the statements given by witnesses) is the personal data of the named member of staff who is the focus of the report.

64. As noted above, the Commissioner is required to consider whether disclosing the information would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. This involves a balancing exercise between the legitimate interests of Dr W and those of the named member of staff. Only if the legitimate interests of Dr W outweigh those of the named member of staff can the information be disclosed without breaching the first data protection principle.

65. In Decision 112/2011 Mr Alan Richardson and Perth and Kinross Council [3], the Commissioner accepted that the internal disciplinary proceedings of an authority are essentially a private matter between the employer and the employee. In paragraph 67 of that decision he stated:

"Turning first to the legitimate interests of the staff whose conduct was under investigation, the Commissioner recognises that disciplinary proceedings are internal processes between employer and employee and any investigation or hearing would normally be conducted in private. This would be the case whatever the outcome of that process."

66. The Commissioner recognises that the ramifications of the disciplinary proceedings for the named member of staff have more than a purely personal impact: they may also negatively impact on academics in the global scientific community as widely accepted research outcomes will need to be amended, and work based on those findings may need to be withdrawn. However, his view remains that misconduct proceedings are essentially private and while the named member of staff must accept that the outcome of the proceedings may be made public in order to put right the harm caused by any identified research misconduct (in that certain journal articles may require to be retracted or amended) they will have no expectation that the details of the process will be made public.

67. The Commissioner has also taken account of the substantial arguments put forward by Dr W regarding the detriment which will be caused to the wider academic community if details of the discredited research articles are not made public. The Commissioner recognises the importance of citations and references in the academic world, where researchers often build on the findings published from previous research by others. Clearly, if the findings in a published article are later found to be based on incorrect data, this would have implications for all of those researchers who may have used those findings as the basis of their own research or who may have referenced the article in their own publications.

68. During the Commissioner's investigation, the University explained that it did not begin the process for retracting the affected journal articles until the disciplinary process was completely concluded.

69. The Commissioner notes that Dr W made his information request on 13 October 2017 and his request for review was made on 5 February 2018. At the time of Dr W's request for review, some four months had passed since the conclusion of the disciplinary process. The Commissioner considers that this was sufficient time for the University to have initiated retraction proceedings (indeed the University confirmed that it contacted all but one of the affected journals on 27 October 2017) and that once this step had taken place, details of the articles found to contain incorrect data should have been disclosed to Dr W.

70. The University provided Dr W with a list of the affected journal articles during the Commissioner's investigation, but this list was incomplete. The Commissioner asked the University why it had omitted details of one of the discredited articles from the list provided to Dr W. In response, the University explained that this particular publication was previously investigated in 2009/10; although it fell outside the remit of the investigation panel it had been taken into account during the misconduct investigation.

71. The University could offer no satisfactory explanation as to why it had not taken action to retract this article at the time of the original investigation (2009/10). It acknowledged that it was unfortunate that, having identified the original lack of action, it has yet to be addressed. The University stated that it would ensure that the intent to retract this article was disclosed to Dr W as soon as it completed the initial engagement with the authors and the journal editor.

72. The investigative report contains detailed information about the allegations made regarding the research practices of the named member of staff. The Commissioner is satisfied that while Dr W (and the wider academic community) may be interested in seeing the detail contained in the report, the named member of staff (i.e. the data subject) has a reasonable expectation that the University's detailed examination of their work practices in such an investigation will remain private and will not be placed into the public domain.

73. In relation to the list of journal articles that have been found to contain incorrect data, and which are listed on pages 9 and 10 of the report, the Commissioner considers (for the most part) the strong legitimate interests demonstrated by Dr W outweigh the interests or fundamental rights and freedoms of the data subject. The wider academic community relies on the veracity and verifiability of published research and if published research is found to have been incorrect, then the detriment is not restricted to the reputation of the named member of staff; it can extend to co-authors as well as those working in similar fields who have cited the research in their own papers. Incorrect research needs to be identified and disclosed to the wider academic community in order to help protect the careers and reputations of researchers and ultimately, to advance the scientific cause.

74. The Commissioner recognises that the list of journal articles on pages 9 and 10 of the report contains specific information about the misconduct allegations made against the senior lecturer and he agrees that this information should be withheld, for the reasons outlined above in paragraph 71 and in paragraph 75 below. However, he finds that in relation to the identification of confirmed incorrect data and bibliographic details of the affected journal articles, the processing (i.e. disclosure under FOISA) of the information is not unwarranted, and that the legitimate interests of Dr W (and the wider scientific community) outweigh the legitimate interests of the data subject (the named member of staff).

75. The Commissioner acknowledges that the University disclosed details of all but one of the affected journal articles to Dr W during his investigation.

76. In relation to the other information in the investigative report, the Commissioner has considered the arguments put forward by Dr W, in which he argues that his legitimate interests (and those of the wider academic community) outweigh those of the data subjects. The Commissioner is satisfied that with regard to this information, the legitimate interests of the data subject (the named member of staff) outweigh the legitimate interests of Dr W with the exception of details of all of the journal articles due for retraction.

77. In relation to the personal data of other contributors to the journal articles, the Commissioner finds that disclosure of the personal data in question would not contravene any of the data protection principles in Article 5(1) of the GDPR, and, in particular, would not contravene the principle that personal data should be processed lawfully, fairly and in a transparent manner. The Commissioner's reasons are those set out in paragraphs 72 and 73. He is satisfied that, in terms of Article 6(1)(f) of the GDPR, processing the information (in this case disclosing the information to Dr W) is necessary for the purposes of Dr W's legitimate interests which, in the circumstances of this case, outweigh the interests or fundamental rights and freedoms of the data subjects.

78. Having found that condition 6 of Schedule 2 of the DPA 1998 can be met, in relation to information about the discredited journal articles, the Commissioner finds that disclosure of this information would not have been unfair or unlawful at the time of the University's review, and would not have contravened the first data protection principle.

79. The Commissioner therefore concludes that the University wrongly withheld details of the identified incorrect data and affected journal articles under section 38(1)(b) of FOISA. However, the Commissioner is satisfied that there is no condition in Schedule 2 which would permit the University to disclose the remainder of the investigative report, and he finds that it has been correctly withheld under section 38(1)(b) of FOISA.

Section 38(1)(b) of FOISA on or after 25 May 2018

80. Given that the Commissioner has concluded that the University did not comply with Part 1 of FOISA (as it stood before 25 May 2018) in withholding details of the identified incorrect data and the affected journal articles under section 38(1)(b), he must now go on to consider whether disclosure would breach Part 1 of FOISA as it currently stands.

81. The Commissioner contacted the University to ask whether it considered that any of the provisions of the GDPR presented any additional barriers to disclosure of some of the personal data. He provided the University with a copy of the information he was minded to disclose (from pages 9 and 10 of the report) and he gave the University an opportunity to comment on whether it considered that disclosure would be contrary to section 38(1)(b) of FOISA, as amended.

82. In response, the University indicated that it was content with the proposed redactions of page 9 of the report, and, in relation to that information, it was satisfied that disclosure now would not be contrary to section 38(1)(b) of FOISA, as amended. However, with regard to page 10 of the report (which contained details of the single journal article that was not previously provided to Dr W), the University submitted that disclosure would be contrary to section 38(1)(b) of FOISA, as amended.

83. The University noted that discussions with the Journal Editor of that specific publication had been initiated but they had not yet been concluded; it stated that it was chasing a response from the publication. The University submitted that it intends to provide the information to Dr W as soon as it is able to confirm to the non-implicated authors the agreed approach to retraction. The University argued that disclosure at this stage would breach section 38(1)(b) of FOISA, as amended, because of the potential distress which would be caused to third parties.

84. The University recognised the public interest in the information but it believed its approach would mitigate the distress to the third parties involved, given the importance of publication to research careers and the fact that they were not implicated in the research misconduct identified.

85. The Commissioner does not intend to repeat his views on the disclosure of personal data in this case. However, for the reasons set out above in paragraphs 72 and 73, the Commissioner finds that disclosure of the personal data in question (details of the affected journal articles and some information about the conclusion of the investigation) would not contravene any of the data protection principles in Article 5(1) of the GDPR, and, in particular, the principle that personal data should be processed lawfully, fairly and in a transparent manner. He is satisfied that, in terms of Article 6(1)(f) of the GDPR, processing the information (in this case disclosing the information to Dr W) is necessary for the purposes of Dr W's legitimate interests which, in the circumstances of this case, outweigh the interests or fundamental rights and freedoms of the data subjects.

86. The Commissioner will provide the University of Edinburgh with a marked up copy of the report showing what information should now be disclosed.

Decision

The Commissioner finds that the University of Edinburgh (the University) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Dr W.

The Commissioner finds that by correctly withholding the majority of the investigative report on the ground that it is personal data exempt under section 38(1)(b) of FOISA, the University complied with Part 1.

However, by wrongly withholding under this exemption the identification of confirmed incorrect data and bibliographic details of the journal articles that were identified as containing incorrect data, the University failed to comply with Part 1 of FOISA.

The Commissioner therefore requires the University to provide Dr W with the information which was wrongly withheld by 13 May 2019.

Appeal

Should either Dr W or the University of Edinburgh wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the University of Edinburgh fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the University of Edinburgh has failed to comply. The Court has the right to inquire into the matter and may deal with the University of Edinburgh as if it had committed a contempt of court.

Daren Fitzhenry
Scottish Information Commissioner
29 March 2019

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

20 Requirement for review of refusal etc.

…

(6) A Scottish public authority may comply with a requirement for review made after the expiry of the time allowed by subsection (5) for making such a requirement if it considers it appropriate to do so.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

….

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

…

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Data Protection Act 2018

Schedule 2 - Transitional provision etc

56 Freedom of Information (Scotland) Act 2002

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 ("the 2002 Act") before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

(3) To the extent that the request was dealt with before the relevant time -

(a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act as amended by Schedule 19 to this Act, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.

(4) In this paragraph -

"Scottish public authority" has the same meaning as in the 2002 Act;

"the relevant time" means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.

General Data Protection Regulation

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

…

f. the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

---