Decision 058/2021: Examination fairness

Public authority: University of Glasgow
Case Ref: 202000346

Summary

The University was asked for information concerning raw and evaluated data used in the preparation of a specific report. The University withheld the information requested.

Following investigation, the Commissioner found that, while University had correctly interpreted the Applicant's request, it had not been entitled to withhold the information. Given that the information was disclosed during the investigation, the Commissioner did not require the University to take any action.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 33(1)(b) (Commercial interest and the economy): 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. The Applicant had been in correspondence with the University of Glasgow (the University) concerning OSCE (Objective Structured Clinical Examination) collusion and fairness. Some of the background to this correspondence is outlined in Decision 008/2020. During the previous correspondence, the University drew reference to the data presented by Dr Nazim Ghouri and included in the published academic paper: Gaining an advantage by sitting an OSCE after your peers: a retrospective study, which had previously been released to the Applicant.

2. On 12 November 2019, the Applicant made a request for information to the University. The information request included a request for:

All raw and evaluated data Dr Nazim Ghouri has including extension back to 2008 OSCE

3. The University responded on 9 December 2019. It advised that Dr Ghouri did not hold the raw data referred to, but that it was held by Robertson Centre for Biostatistics. It advised the Applicant that the data gathered was exempt in terms of section 33(1)(b) of FOISA (Commercial interests and the economy) and section 38(1)(b) (Personal information).

4. On 13 January 2020, the Applicant wrote to the University requesting a review of its decision as he wished to be provided with the OSCE data, irrespective of where it was held.

5. The University notified the Applicant of the outcome of its review on 5 March 2020. It upheld the original response without modification.

6. On 5 March 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the University's review because he believed the OSCE data should be assessible to the public.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

8. On 20 March 2020, the University was notified in writing that the Applicant had made a valid application. The University was asked to send the Commissioner the information withheld from the Applicant. While waiting for the University to provide the withheld information withheld, the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The University was invited to comment on this application and to answer specific questions, focusing on its application of any provisions or exemptions in FOISA to the withheld information.

10. The University responded and advised that staff from the School of Medicine, Dentistry and Nursing had undertaken research in this area and their findings were published in Gaining an advantage by sitting an OSCE after your peers: a retrospective study. It provided the investigating officer with the data held for the years 2009 to 2014, which had been referenced in the published report.

11. The University submitted that it considered the information held to be exempt from disclosure in terms of section 33(1)(b), on the basis that disclosure would prejudice the University's commercial interests substantially. It also submitted that disclosure would breach the data protection principles (and therefore section 38(1)(b) of FOISA applied).

12. The University submitted that, even if the information relating to the age, gender and date of birth of the individuals was removed from the data held, it would still be possible that disclosure would lead to the identity of individuals. It did not, therefore, consider that the data could be anonymised to allow disclosure.

13. During the investigation, the Applicant confirmed that he did not expect the information to include names, dates of birth or gender, and confirmed he had no objection to the withholding of any personal data.

14. Following further communication with the investigating officer, the University was asked whether it wished to reconsider its position and give consideration to disclosing the information requested, with the redaction of the information relating to gender, age and date of birth.

15. On 10 December 2020, the University provided the Applicant with a copy of the information held, advising that this was the dataset used to inform the publication referred to above. It advised that the age, gender and date of birth fields had been removed, in accordance with section 38(1)(b) of FOISA.

16. The Applicant acknowledged receipt of the disclosed information and confirmed he had no objection to the redaction of the gender, age and date of birth fields. The Applicant confirmed he did not require the information that was redacted.

17. However, he questioned whether the University had provided all of the relevant information it held. In particular, he pointed out that he had not been provided with the data from 2008 or 2017, which he confirmed was vital to him. He reiterated that his request as for: All raw and evaluated data Dr Nazim Ghouri has including extension back to 2008 OSCE.

18. The Applicant also commented that the data provided had examination ID numbers redacted, which he did not consider to be a personal identifier. He also believed that further information should be held and wished the Commissioner to come to a decision on the matter.

19. After further communications, the University provided the Applicant with a further set of the data, with the examination ID numbers reinstated. It apologised for this error and any inconvenience caused.

20. The University provided further submissions as to its interpretation of the Applicant's request, which it stated was limited to the data that had been provided to Dr Ghouri for research purposes. It submitted that this was restricted to the data for the years 2009 to 2014. It was satisfied that it had identified all of the information that it held, which it stated had now been provided to the Applicant subject to the agreed personal data redaction.

21. While the University acknowledged that it held data relating to 2008 and from 2015 to 2017, it did not consider this to fall within the scope of the Applicant's request, which had been specific to the data that had been evaluated by Dr Ghouri. Whilst this further information was considered not to fall within the scope of the Applicant's request, the University provided this information to him, subject to the redaction of personal data.

22. The Applicant acknowledged receipt of the information disclosed, but submitted that he still believed relevant non-identifying information had been withheld.

Commissioner's analysis and findings

23. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the University. He is satisfied that no matter of relevance has been overlooked.

Information held by the University

24. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable in this case.

25. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the authority should hold.

26. The standard of proof to determine whether a Scottish public authority holds information, or whether it has identified all of the information that it does hold, is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information or has identified all of the information held. While it may be relevant as part of this exercise to explore expectations as to what information the authority should hold, ultimately the Commissioner's role is to determine what relevant information is actually held by the public authority (or was, at the time it received the request).

27. As stated in many previous decisions, the Commissioner's remit extends only to consideration of whether a Scottish public authority actually holds the requested information and whether it has complied with Part 1 of FOISA (or where relevant with the Environmental Information (Scotland) Regulations 2004) in responding to a request. The Commissioner cannot comment on what records the authority should maintain.

Interpretation of the request

28. The Commissioner notes the submissions provided by the Applicant, in which he provides reasons why he considers the University should have provided him with all the data that it held regarding the OSCE examination for the years 2008 to 2017 and any reports held on the matter. He also notes the Applicant's belief that further research data should be held by the University. The Commissioner has, however, to consider and interpret the actual request under consideration in this case, that is, the Applicant's request for:

All raw and evaluated data Dr Nazim Ghouri has including extension back to 2008 OSCE

29. The University provided submissions that the request had to be considered as the information Dr Ghouri had evaluated and considered prior to the publication of Gaining an advantage by sitting an OSCE after your peers: a retrospective study.

30. Taking account of all of the correspondence, the Commissioner has to consider the context, content and wording of the actual request that is under investigation. In this case, the Commissioner notes that, on 28 October 2019, during the investigation which led to the issuing of Decision 008/2020, the University provided the Applicant with some information. On providing that information, the Applicant was advised that, within the information disclosed, the reference to the data presented by Dr Nazim Ghouri was included in the published academic paper which had previously been released to him. (That academic paper being Gaining an advantage by sitting an OSCE after your peers: a retrospective study.)

31. In response to that email of 28 October 2019, the Applicant made the information request under consideration here.

32. Taking the request in context, the Commissioner considers it apparent that the Applicant had sought specific information relating to the data considered by the authors of the publication in question. Dr Ghouri is one of the authors of that publication and could only be expected - in the context of this request - to hold data that was relevant to his analysis for that purpose.

33. The Commissioner therefore accepts the University interpreted the Applicant's request reasonably and accepts that the information that falls to be considered in this decision is limited to the data provided to Dr Ghouri for consideration in his research for the publication in question, which is the data for the years 2009 to 2014.

Was all the information identified?

34. The Applicant believed the University should hold further information, in addition to that provided to him during the investigation. He further believed the data provided should hold candidate or matriculation numbers, which, in his view, would not be classed as personal data and should be disclosed.

35. The University provided submissions as to the investigations carried out to ascertain what information was held falling within the scope of the request. In relation to the data provided to Dr Ghouri, it confirmed that, in order to ensure the integrity of the research, no candidate or matriculation numbers had been included in the data provided to and considered by Dr Ghouri. It submitted, therefore, that the Applicant had been provided with all of the information it held falling within the scope of his request during the investigation, subject to the redaction of personal data as mentioned above.

36. Having considered all relevant submissions and the terms of the request, the Commissioner accepts that the University interpreted the Applicant's request reasonably and took adequate, proportionate steps in the circumstances to establish what information it held. Given the explanations and other submissions provided, the Commissioner is satisfied, on the balance of probabilities, that the University held no information falling within the scope of the Applicant's request, other than that provided to the Applicant.

37. While the information under consideration in this decision is limited to the data disclosed as mentioned above, the University confirmed that it did hold further OSCE data for the years 2007 and from 2015 to 2017. It further explained that this was in a different format to that considered by Dr Ghouri, as it had never been evaluated by him. While it did not consider this data to fall within the scope of the request, it advised it would provide this to the Applicant, subject to the redaction of personal data.

38. The Commissioner notes that this additional information was provided to the Applicant on 3 February 2021. Given that the Commissioner accepts that this information does not fall within the scope of the request, he cannot comment further on that further disclosure.

39. As mentioned above, during the investigation, the University provided the Applicant with the information that it held falling within the scope of the request, subject to redaction of the age, gender and date of birth fields under section 38(1)(b) of FOISA. As the Applicant accepted the redactions, and did not dispute the application of section 38(1)(b) to the personal information that was redacted, the Commissioner will now consider whether the University had been entitled to withhold the information it did disclose during the investigation, at the time it dealt with Dr Ghouri's request.

Section 33(1)(b) of FOISA - Commercial interests and the economy

40. The University submitted that the data under consideration was exempt from disclosure under section 33(1)(b) of FOISA. This provides that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). Section 33(1)(b) of FOISA is set out in full in Appendix 1. This is a qualified exemption and is therefore subject to the public interest test in section 2(1)(b) of FOISA.

41. There are certain elements which an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to identify:

(i) whose commercial interests would (or would be likely to) be harmed by disclosure;

(ii) the nature of those commercial interests; and

(iii) how those interests would (or would be likely to) be prejudiced substantially by disclosure.

42. In order to evidence that this exemption is engaged, an authority has to show that disclosure of the information would, or would be likely to, be the catalyst that would cause the substantial prejudice to a commercial interest. The prejudice must be substantial, in other words of real and demonstrable significance.

43. On being asked for submissions regarding this exemption, the University was strongly advised to consider the Commissioner's briefing on section 33[1], which provides further guidance on the tests to be met in applying this exemption.

44. The University submitted that, whilst the data related to research rather than being industrial or financial in nature, it did have a commercial dimension in undoubtedly adding value to the University's profile, reputation and standing within the Higher Education sector and beyond.

45. The University submitted that the data provided significant reassurance to potential applicants, current and former students and their potential patients and colleagues as to the fact that a degree from the University of Glasgow's Medical School demonstrates the calibre and ability of holders of this qualification. It stated that, while any interpretation or understanding of the data would be extremely limited, it was concerned the data might be used or misused, which in turn would present significant prejudice to the commercial interests of the University as a leading research institution. It also provided submissions to the effect that disclosure would prejudice substantially its ability to further analyse the data, produce seminal research outcomes and publish related papers.

46. The University further stated that disclosure might also allow competitor research groups to utilise the dataset to conduct their own research and produce publications in advance of the University. Any risk to the University's ability to conduct its research, to its own timescales and with due rigour, might result in lesser quality output, which would cause reputational damage, lead to potential research integrity issues and, consequently, commercial damage to the institution.

47. Taking account of all of the submissions by the University in relation to the application of section 33(1)(b) of FOISA, and having taken a broad view, the Commissioner accepts that the information in question is commercial in nature.

48. As mentioned above, in order to rely on this exemption, an authority has to evidence why disclosure would, or would be likely to, prejudice the commercial interests of any person (including a Scottish public authority) substantially.

49. On the question of harm, the Commissioner must be persuaded by the submissions he has received from the University. In his view, these do not explain how the disclosure of the requested information would have had, or would have been likely to have (at the time the University responded to the Applicant's request or his requirement for review), the substantially prejudicial impact claimed on the commercial interests of the University: the link between disclosure and the harm in question has not been demonstrated.

50. The Commissioner considers the submissions provided can only be described as being general in nature and speculative, and do not provide the evidence required to show that disclosure would cause the type of substantial prejudice required for section 33(1)(b) of FOISA to be engaged. Consequently, in this case, the Commissioner is not satisfied that the information requested was properly withheld under this exemption: by doing so, the University failed to comply with section 1(1) of FOISA.

51. Having reached that conclusion, the Commissioner is not required to consider the public interest test in section 2(1)(b) of FOISA.

52. As mentioned above, however, the University provided the information to the Applicant during the investigation and, in the circumstances, the Commissioner does not require the University to take any action.

Section 38(1)(b) of FOISA - Personal information

53. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.

54. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

55. To rely on this exemption, the University must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.

56. In its submissions to the Commissioner, the University initially applied section 38(1)(b) of FOISA, to withhold all of the information under consideration, stating that it could not be redacted of personal data to allow disclosure.

57. As mentioned above, during the investigation, the University accepted that it could disclose the information in question, once it had redacted the gender, age and date of birth data contained within the information. The Applicant did not dispute the withholding of this information, and the Commissioner does not consider it necessary to consider that matter further. However, in relation to the information disclosed during the investigation, the Commissioner has to conclude that the University was not entitled to withhold this information under section 38(1)(b) of FOISA, at the time it dealt with the Applicant's request. In this respect, it failed to comply with section 1(1) of FOISA

58. Given that the information concerned was provided to the Applicant during the investigation, the Commissioner does not require the University to take any action in respect of this failure.

Decision

The Commissioner finds that the University of Glasgow (the University) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. The Commissioner finds that, while the University identified all of the information it held falling within the scope of the request, it was not entitled to withhold the information it subsequently disclosed during the investigation, and by doing so it failed to comply with section 1(1) of FOISA.

Given that the information has been provided to the Applicant, the Commissioner does not require the University to take any action in respect of this failure, in response to the Applicant's application.

Appeal

Should either the Applicant or the University wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
28 April 2021

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

33 Commercial interests and the economy

(1) Information is exempt information if-

…

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in -

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

…

the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

United Kingdom General Data Protection Regulation

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -

…

(d) disclosure by transmission, dissemination or otherwise making available.

…

(subject to subsection 14(c ) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).

(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.

…

(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4).

---