Decision 058/2013 Mr John W H McLean and the Scottish Parliamentary Corporate Body Review information Reference No: 201202663 Decision Date: 27 March 2013

Summary

On 2 November 2012, Mr McLean asked the Scottish Parliamentary Corporate Body (the SPCB) for information about the Scottish Public Services Ombudsman's (the Ombudsman) annual performance reviews. The SPCB provided some information to Mr Mclean, but withheld other information on the basis that it was the Ombudsman's personal data and that its disclosure would breach the data protection principles.Following an investigation, the Commissioner accepted this.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I ? the principles) (the first data protection principle); and 2 (Conditions relevant for purposes of the first principle: processing of any personal data)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.

Background

1.As with other, similar office holders, the Ombudsman is subject to an annual performance review, carried out by an Independent Assessor on behalf of the SPCB.On 2 November 2012, Mr McLean wrote to the SPCB.He asked a number of questions relating to the office holders subject to parliamentary scrutiny and the annual reviews they were subject to.Specifically, he requested the reviews relating to the Ombudsman.

2.The SPCB responded on 19 November 2012.In relation to the Ombudsman's reports, it withheld the information under sections 30(b)(i) and 38(1)(b) of FOISA.

3.On 11 December 2012, Mr McLean wrote to the SPCB requesting a review of its decision.This related specifically to the withholding of reports on the Ombudsman's annual performance.

4.The SPCB notified Mr McLean of the outcome of its review on 19 December 2012.The SPCB upheld its original decision to withhold the information under sections 30(b)(i) and 38(1)(b) of FOISA.

5.On 20 December 2012, Mr McLean wrote to the Commissioner, stating that he was dissatisfied with the outcome of the SPCB's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr McLean made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.The case was then allocated to an investigating officer.

Investigation

7.On 15 January 2013, the investigating officer notified the SPCB in writing that an application had been received from Mr McLean.The SPCB was given an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asked to respond to specific questions.

8.The SPCB responded on 5 February 2013, providing submissions in support of its reliance on sections 38(1)(b) and 30(b)(i) of FOISA.

9.Mr McLean also provided submissions to the effect that the information should be disclosed.

10.The relevant submissions received from both the SPCB and Mr McLean will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

11.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to her by both Mr McLean and the SPCB.She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) ?personal data

12.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data from release if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.In applying this exemption, the SPCB submitted that the withheld information was the Ombudsman's personal data and that its disclosure would contravene the first data protection principle.

13.In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA and, if it is, whether she is satisfied that its disclosure would breach either the first data protection principle.The Commissioner will also consider whether any of the information is sensitive personal data as defined in section 2 of the DPA.

14.It must be borne in mind that this particular exemption is an absolute exemption.This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

15."Personal data" is defined in section 1(1) of the DPA as

data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

16.The SPCB submitted that the withheld information was an assessment of the Ombudsman's personal achievements in the reporting year, set against his personal objectives.It further explained that the report included assessments of the Ombudsman's personal performance.It was used to identify areas of personal strength and weakness and areas for personal development.The SPCB considered it to be biographical of the Ombudsman.

17.Taking account of all the submissions she has received, the Commissioner is satisfied that the information withheld is the personal data of the Ombudsman.She is satisfied that he can be identified from the information and that it relates to him.

18.The Commissioner has considered whether any of the personal data in question are sensitive personal data, as defined by section 2 of FOISA.She is satisfied that none of the personal data are sensitive personal data.

19.The Commissioner will therefore go on to consider whether disclosure of the information would breach the first data protection principle.

The first data protection principle

20.The first data protection principle states that personal data shall be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met.In the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA must also be met.As noted above, the Commissioner is satisfied that the information is not sensitive personal data, and so she is not required to consider whether any of the conditions in Schedule 3 can be met.

21.In his submissions to the Commissioner, Mr McLean provided comments on the applicability of conditions 1 to 6 in Schedule 2.The Commissioner has considered all of the points made by Mr McLean, but has concluded that only condition 6 might be considered to apply in this case.

22.Condition 6 allows personal data to be processed (in this case, disclosed in response to Mr McLean's information request made under section 1(1) of FOISA) if the disclosure of the data is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

23.There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

Does Mr McLean have a legitimate interest in having this personal data?

If so, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject (in this case, the Ombudsman)?

Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?This will involve a balancing exercise between the legitimate interests of Mr McLean and those of the data subject.Only if the legitimate interests of Mr McLean outweigh those of the data subject can the personal data be disclosed.

Does the applicant have a legitimate interest?

24.Mr McLean was asked by the Commissioner to specify why he believed he had a legitimate interest in obtaining the information withheld.He commented that there was a legitimate interest in accounting to the people of Scotland for the proper expenditure of the public purse (to ensure, as a minimum, prudent monitoring, efficient use of resources and avoidance of waste).

25.Mr McLean also commented that the public were entitled to understand (through the Ombudsman's "reports") how he has performed in compliance with defined and indirectly defined actions.The most basic of which these, Mr McLean believed, was the Ombudsman's obligation to address and report against remedy/redress of complaints submitted for his attention.

26.He further commented that the processing of the data requested would allow confirmation of whether there was any Ombudsman performance information provided to the SPCB that was hidden (for whatever reason) by this route from the eyes of the Scottish public.

27.Mr McLean also drew attention to the Officeholders' Framework Document, which states that:

Officeholders are however subject to parliamentary scrutiny and are funded by the SPCB.They are accountable to the Parliament by way of laying an Annual Report and, as part of this accountability regime, the SPCB has determined that officeholders should be subject to an annual review to ensure that they are fulfilling all the functions of their post as set down in legislation and for their use of resources.

Mr McLean commented that such reports should be confined to the professional aspects of the operation of the relevant office, rather than matters personal to the office holder.

28.The SPCB accepted that Mr McLean had a legitimate personal interest in being satisfied that those in public office were discharging their functions effectively. It believed this could be satisfied, in relation the performance of the Ombudsman, by the annual report laid before Parliament on the exercise of the Ombudsman's functions.Each annual report was publicly available, along with other performance indicators and strategic plans.

29.Having considered all relevant submissions she has received on this point, the Commissioner accepts that Mr McLean has a legitimate interest in information relating to the proper expenditure of the public purses, to ensure as a minimum (in his own words) prudent monitoring, efficient use of resources and avoidance of waste.She also accepts that this interest extends to the wider public.

30.The Commissioner also accepts the SPCB's submission that the information in which Mr McLean has a legitimate interest is the information contained in the annual reports laid before Parliament, together with related performance information, all published on the Ombudsman's website.She agrees that the availability of this information could be said to satisfy any legitimate interest in the Ombudsman's performance.

31.As explained above, the information withheld in this case relates to the individual office holder and not the office for which he is responsible.In the circumstances, the Commissioner cannot accept that Mr McLean has demonstrated that he (or the public, for that matter) has a legitimate interest in obtaining this information.Having reached that conclusion, the Commissioner must conclude that there is no condition in Schedule 2 to the DPA which would permit disclosure of the personal data which forms the withheld information.

32.In the absence of a condition permitting disclosure, the Commissioner must also find that disclosure would be unlawful.Therefore, the Commissioner must conclude that disclosure would breach the first data protection principle and that the information is exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.

33.In the circumstances, the Commissioner is not required to go on to consider the SPCB's reliance on section 30(b)(i) of FOISA to withhold the information.

DECISION

The Commissioner finds that the Scottish Parliamentary Corporate Body complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr McLean.

Appeal

Should either Mr McLean or the Scottish Parliamentary Corporate Body wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
27 March 2013

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

...

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a)from those data, or

(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a)at least one of the conditions in Schedule 2 is met, and

(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

?

6 (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.