|
Decision 058/2011 Mr Peter Cherbi and Scottish Legal Complaints Commission
Notes of a meeting
Reference No: 201001632
Decision Date: 21 March 2011 |
Summary
Mr Peter Cherbi (Mr Cherbi) requested from the Scottish Legal Complaints Commission (the SLCC) the notes of a meeting.The SLCC withheld the information under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA), on the grounds that it was personal data, disclosure of which would breach the first data protection principle.Following a review, Mr Cherbi remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the SLCC had dealt with Mr Cherbi's request for information in accordance with Part 1 of FOISA by withholding the information under section 38(1)(b) of FOISA.He did not require the SLCC to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), 2(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions ? definition of "personal data") and Schedules 1 (The data protection principles ? the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? conditions 1 and 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.The Law Society of Scotland is required by the Solicitors (Scotland) Act 1980 and the associated Solicitors (Scotland) Professional Indemnity Insurance Rules 2005 to maintain professional indemnity insurance arrangements for all practising solicitors in Scotland.It has chosen to do so by means of a Master Policy negotiated with Marsh Limited, an insurance broker.
2.On 20 July 2010, Mr Cherbi emailed the SLCC requesting the information contained in the notes taken during or discussions relating to the meeting between members of the SLCC, an historic complainer (complainant) and his constituency MP referred to in the SLCC Board Minutes of 15 March 2010[1] (Board Minutes) under "Chair Report".
3.The relevant parts of the Board Minutes stated at paragraphs 4.2 and 4.2.1:
The Chair referred to a meeting with an historic complainer and his Constituency MSP, John Swinney, where the complainer stated to the Chair and MSP that he was in possession of evidence of corruption within the dealings of the Master Policy.The Chair and MSP advised the complainer that this evidence should be brought to the attention of the Police.
This meeting had focused on the Master Policy and its oversight by the SLCC.In order to work effectively it was agreed to hold a further meeting between the parties in September 2010.
4.The SLCC responded on 11 August 2010. It refused to provide the meeting notes, stating that this information was exempt in terms of section 38(1)(b) of FOISA, on the basis that it was personal data of the complainant, the release of which would breach the requirement to process data fairly, as laid down by the first data protection principle in Schedule 1 to the DPA.
5.On 12 August 2010, Mr Cherbi emailed the SLCC requesting a review of its decision.In particular, Mr Cherbi advised the SLCC that he had interviewed the complainant who had advised him that the discussions that had taken place were in relation to the Master Policy rather than any discussions which may harm the complainant.
6.The SLCC notified Mr Cherbi of the outcome of its review on 16 August 2010, advising him that it upheld its previous decision without amendment.
7.On 16 August 2010, Mr Cherbi emailed the Commissioner, stating that he was dissatisfied with the outcome of the SLCC's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
8.The application was validated by establishing that Mr Cherbi had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
9.On 18 August 2010, the SLCC was notified in writing that an application had been received from Mr Cherbi and was asked to provide the Commissioner with any information withheld from him. The SLCC responded with the information requested and the case was then allocated to an investigating officer.
10.The investigating officer subsequently contacted the SLCC, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the SLCC was asked to justify its application of the exemption in section 38(1)(b) to the withheld information.
11.In response the SLCC highlighted that it considered that the withheld information was the personal information of the complainant and the note taker and that disclosure would breach the first data protection principle.It explained its reasons for coming to this conclusion.
12.The investigating officer contacted Mr Cherbi and asked him for his views and comments regarding his legitimate interests in accessing the withheld information under consideration. Mr Cherbi responded with arguments explaining why he considered he had a legitimate interest in obtaining the withheld information.
13.The comments received from both the SLCC and Mr Cherbi are summarised, where relevant, in the analysis and findings section below.
Commissioner's analysis and findings
14.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Cherbi and the SLCC and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) of FOISA ? personal information
15.The SLCC took the view that the meeting notes were the personal data of the complainant and the note taker.It maintained that disclosure of this information would contravene the first data protection principle in the DPA, and that the information is therefore exempt from disclosure under section 38(1)(b) of FOISA.
16.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data as defined by the DPA and if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles laid down in Schedule 1 to the DPA.This particular exemption is an absolute exemption, so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
Is the information personal data?
17.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
18.Having considered the withheld information, the Commissioner accepts that it is entirely the personal data of the complainant.In reaching this conclusion, he has noted that the relevant meeting related entirely to that individual's complaint, the concerns he had raised, and the SLCC's response to these.As such the withheld information, as a whole, relates to the complainant, who is identifiable from the information within the meeting note and other information in the possession of the SLCC.It is clear also that the identity of the complainant is known to Mr Cherbi, and potentially also more widely.
19.The SLCC has also indicated that it considers the meeting note to be the personal data of the note taker, who took the note as an aide memoire.The Commissioner recognises that the meeting note contains personal data relating to all of the other individuals who were present at the meeting, revealing their presence, their contribution to the discussion, and opinions on the matters raised by the complainant.
20.In general, the Commissioner would not consider documents of this type to be entirely the personal data of the individual who created them, and he is not able to accept that the note as a whole should be considered in this case to be the personal data of the note taker.The note in its entirety cannot be said to relate to that individual, since it provides a record of discussions in which this individual played only a limited role.While the note reveals that person's recollections of the discussion, it is presented as a simple factual summary rather than an expression of opinion of that individual.
21.In the light of these observations, the Commissioner finds that the note of the meeting is only the personal data of the note taker where it refers to that individual's involvement in the discussion.He has gone on to consider the remaining tests required by section 38(1)(b), in the first instance in relation to the note of the meeting, considered as the personal data of the complainant.
22.The Commissioner must now go on to consider whether disclosure of that personal data would breach any of the data protection principles contained in Schedule 1 to the DPA.As noted above, the SLCC argued that disclosure would breach the first data protection principle.
Would disclosure breach the first data protection principle?
23.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure into the public domain in response to Mr Cherbi's information request.
24.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the personal data in this case does not fall into any of the relevant categories.It is therefore not necessary to consider the conditions in Schedule 3 in this case.
25.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
26.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
27.Condition 1 of Schedule 2 permits data to be processed (in this case, disclosed to Mr Cherbi) if consent to such processing is granted by the data subject.Mr Cherbi has spoken with the data subject in this case, and he indicated that he considered that it would be appropriate to consult him on disclosure in this case.
28.The SLCC was asked if it had sought comments from the complainant regarding the possibility of disclosure of the note of the meeting in response to Mr Cherbi's request.In response, it indicated that it did not approach the complainant as it was not a formal note of the meeting and was a personal aide memoir produced by the note taker.The SLCC considered that as the complainant was not aware of the meeting notes it was inappropriate to contact him.The SLCC advised that it has had significant contact with the complainant and the individual would have asked for the meeting notes if he had wanted them.
29.The Commissioner recognises that it would have been difficult for the complainant to consider whether he would be willing to consent to disclosure of his personal data without access to that information under consideration.However, he would also note that it would have been good practice for SLCC to contact the complainant to seek his views on disclosure of information relating to the meeting, particularly after Mr Cherbi highlighted in his request for review that the complainant had spoken about the meeting and its subject matter in an interview.
30.As in any case, the Commissioner has to consider the SLCC's handling of Mr Cherbi's request, at the date when it notified Mr Cherbi of the outcome of its review.Since no consent had been granted by the complainant, the Commissioner can only conclude that Condition 1 of Schedule 2 did not apply at that time.
31.In all the circumstances of this case, the only Schedule 2 condition which would permit disclosure to Mr Cherbi is Condition 6.This allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s) (the individuals to whom the data relate).
32.There are a number of different tests which must be satisfied before condition 6 can be met.These are:
Does Mr Cherbi have a legitimate interest in obtaining the personal data?
If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?
Even if the processing is necessary for Mr Cherbi's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Cherbi must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the SLCC was correct to refuse to disclose the personal data to Mr Cherbi.
Does the Mr Cherbi have a legitimate interest?
33.Mr Cherbi has submitted that he has a legitimate interest in accessing the withheld information, since it would provide clarity on the matters discussed at that meeting, particularly since the Board Minute referred to in his information request referred to allegations of wrongdoing with respect to the Master Policy.
34.The SLCC indicated that it did not consider that Mr Cherbi had a legitimate interest in seeking the withheld information.Notwithstanding the description of the meeting within the Board Minute, it indicated that the purpose of the meeting was to address personal concerns of the complainant.As such, it considered that Mr Cherbi would only have a legitimate interest if he was seeking the information about the meeting on behalf of the complainant.
35.Notwithstanding the SLCC's comments, the Commissioner is satisfied that Mr Cherbi has a legitimate interest (which would be shared by the public at large) in understanding more fully the facts surrounding the meeting that was publicly referred to in an SLCC Board Minute.Although this meeting was convened to address the concerns of the complainant, the Commissioner considers there to be a wider legitimate interest in understanding the facts and outcomes of that meeting, particularly since the SLCC has published some information about the matters that were discussed, including a reference to the serious allegations that were made by the complainant.
Is disclosure of the personal data necessary for Mr Cherbi's legitimate interests?
36.The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so he must consider whether these interests might reasonably be met by any alternative means, or which would interfere less with the privacy of the complainant.
37.As noted above, Mr Cherbi has advised that he had interviewed the complainant, and has been provided with some information about the matters that were discussed at the meeting.While the Commissioner has not consulted the complainant on this point, it appears that he has chosen to share at least some information about the meeting with Mr Cherbi.However, Mr Cherbi does not have access to the full content of the meeting note under consideration.
38.In correspondence with the investigating officer the SLCC indicated that if the complainant requested the meeting note, it would probably disclosed it to him in pursuit of his subject access rights under the DPA.Such disclosure would be to the complainant alone (who could then reveal it to others if, and to the extent that, he chose), whereas disclosure to a third party in response to a request made under FOISA has the effect of placing the information into the public domain.
39.The Commissioner recognises that if the complainant was indeed willing to share his personal data with Mr Cherbi, an alternative was to access the information he has requested would be available.This route would leave it in the hands of the data subject to determine which of his personal data he was content to be made available to Mr Cherbi (and perhaps more widely).
40.Mr Cherbi was informed that it was likely that a request made in terms of the DPA by the complainant would be likely to result in him being provided with the information.However, as far as the Commissioner, is aware the complainant has not requested the meeting note.
41.Therefore, in the circumstances, the Commissioner cannot identify any other viable means of meeting Mr Cherbi's legitimate interests which would interfere less with the privacy of the data subject than by obtaining the information withheld.Therefore he is satisfied that disclosure of the information is necessary for the purposes of the legitimate interest identified by Mr Cherbi.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
42.The Commissioner must now consider whether disclosure of the withheld information, which is personal data, would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject (the complainant). As noted above, this involves a balancing exercise between the legitimate interests of Mr Cherbi and those of the data subject. Only if the legitimate interests of Mr Cherbi outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.
43.The Commissioner's guidance on the exemptions in section 38 identifies a number of factors which should be taken into account in carrying out this balancing exercise.These include:
whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);
the potential harm or distress that may be caused by the disclosure;
whether the individual has objected to the disclosure;
the reasonable expectations of the individual as to whether the information would be disclosed.
44.The SLCC advised that it considered that the information related to the private life of the data subject as the meeting was held in order to address his concerns and complaints.The SLCC went on to comment that the data subject had no expectation that the information would be shared further or that it would be disclosed into the public domain; to do so would cause damage and distress to the data subject.
45.In addition the SLCC stated that the complainant has expressed their views in a public forum on many occasions and consequently if he had wanted to make public any of the content of the meeting he could have published his own notes or requested the version held by the SLCC.Therefore the SLCC considered that it would be unfair to disclose the meeting notes.
46.Mr Cherbi commented in his submissions to the investigating officer that the Master Policy was of concern to many people consequently it was necessary to establish the true facts of the case and the SLCC dealings with the Law Society's insurer, Marsh in making claims against the Master Policy.
47.In considering the actual information being withheld, although references are made to the Master Policy, the main purpose of the meeting was to deal with an individual complaint's concerns, which were personal to the complainant.A further meeting was arranged to discuss the matters further some months later, and after the date of Mr Cherbi's information request.The Commissioner consequently takes the view that, at the date of Mr Cherbi's request, the matters raised by the complainant were still live.Although the complainant has made their concerns public, it can still be considered that it would be unfair to disclose the meeting notes to a third party, especially as the complainant has in effect been afforded the opportunity to either publish their version of events or request the meeting notes held by the SLCC.
48.Having considered all of the submissions made by Mr Cherbi and the SLCC, the Commissioner considers that in this case the rights, freedoms and legitimate interests of the data subject, in relation to their reasonable expectations of privacy, outweigh the legitimate interest Mr Cherbi has in obtaining the information.The Commissioner therefore concludes that disclosure in this case would be unwarranted intrusion into the private life of the complainant.
49.Given this conclusion, the Commissioner finds that condition 6 of Schedule 2 to the DPA could not be met in relation to disclosure of the withheld information.For the same reasons, the Commissioner has concluded that disclosure would be unfair and, in breaching of the first data protection principle.The Commissioner therefore accepts that the information was properly withheld under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that the Scottish Legal Complaints Commission complied with Part 1 of the Freedom of Information (Scotland) Act 2002 by withholding the information requested by Mr Cherbi under section 38(1)(b) of FOISA.
Appeal
Should either Mr Peter Cherbi or the Scottish Legal Complaints Commission wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
21 March 2011
Appendix
Relevant statutory provisions
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b)in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
1.The data subject has given his consent to the processing.
?
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.scottishlegalcomplaints.org.uk/media/10447/2010.03.15%20redacted%20slcc%20board%20minutes.pdf
