Decision 059/2018: Mr William Ross and the Scottish Housing Regulator Communications with Viewpoint Housing Association Reference No: 201701859 Decision Date: 25 April 2018 Summary SHR was asked for all information and communications it had with Viewpoint Housing Association between specified dates. SHR disclosed a small amount of information. During the investigation, SHR disclosed the content of one email. The Commissioner investigated and found that this information should have been disclosed earlier. He was satisfied, however, that SHR had correctly applied the exemptions relating to personal data and to the effective conduct of public affairs to the remaining withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2)(a)(i) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data" (Basic interpretative provisions); Schedule 1, Part I - The principles (first data protection principle); Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data (condition 6(1))

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 1 February 2017, Mr Ross made a request for information to the Scottish Housing Regulator (SHR). He asked for "all information and communication with Viewpoint Housing Association held by the Regulator for the period commencing 19 January 2017 to today's date."

2. SHR responded on 1 March 2017, disclosing a small amount of information. SHR withheld the majority of the information caught by Mr Ross' request, for a variety of reasons. It considered exemptions under sections 30(c), 35(1)(g), 36(2) and 38(1)(b) to be engaged.

3. On 11 March 2017, Mr Ross wrote to SHR, requesting a review of its decision to withhold the majority of the information held. He questioned whether the requirements of the various exemptions were met in the circumstances, and (where relevant) whether the public interest test had been applied properly.

4. SHR notified Mr Ross of the outcome of its review on 21 April 2017, apologising that it was a week late in doing so. More information was disclosed to Mr Ross. SHR confirmed that it did not believe some information referred to in Mr Ross' requirement for review actually fell within the scope of his request, while directing him to where he might find certain other information. It upheld its original response in relation to the remainder of the information held, but stated that it was withholding some information under section 36(1) rather than section 36(2).

5. On 20 October 2017, Mr Ross wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Ross set out why he did not accept that SHR had applied the exemptions correctly.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Ross made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 16 November 2017, SHR was notified in writing that Mr Ross had made a valid application. SHR was asked to send the Commissioner the information withheld from Mr Ross. SHR provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. SHR was invited to comment on this application and answer specific questions, with reference to the exemptions claimed in its review outcome.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Ross and SHR. He is satisfied that no matter of relevance has been overlooked.

Information disclosed during investigation

10. During the investigation, SHR disclosed the content of email 8 (without identifying its sender(s) or recipient(s)), having concluded that this information could not be (and could not have been) withheld under section 36(1) of FOISA.

11. In failing to disclose this information earlier, the Commissioner finds that SHR failed to comply with section 1(1) of FOISA.

Section 30(c) - Prejudice to effective conduct of public affairs

12. The withheld information under consideration for this exemption is from email 1, emails 3-6 inclusive, and emails 11 to 15 inclusive (including any attachments).

13. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs". The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure. The exemption (if found to be engaged) is also subject to the public interest test in section 2(1)(b) of FOISA.

14. As noted in previous decisions, there is a high threshold to be crossed in applying the tests contained in the section 30(c) exemption. The prejudice must be substantial, and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case-by-case basis, taking into account the actual content of the information and all other relevant circumstances (which may include the timing of the request).

15. In his application, Mr Ross did not accept that SHR had applied this exemption correctly and remained unconvinced that the public interest arguments here prevented disclosure of the information he sought.

16. SHR submitted that it needed a private space to communicate and engage with the social landlords it regulates. This was necessary to allow SHR to gather evidence and make judgements on regulatory matters, and thus perform its statutory functions. It noted that it regularly requires social landlords to provide it with information about sensitive and confidential issues, explaining that concerns might be triggered by an anonymous allegation, whistleblowing or its own analysis of performance information. Investigatory work might then be required, including the gathering of such information from landlords.

17. The Commissioner has considered the content and nature of the information withheld under this exemption. He notes that the relative investigatory processes were not fully concluded at the time of this request or at the time of the requirement for review.

18. In respect of the withheld information under this exemption, the Commissioner is satisfied that the investigatory processes to which the information relates relied for their effectiveness on the assurance of confidentiality. It is clear that the correspondence in question would have been sent under an expectation of confidentiality, which would have subsisted at the time of the request and requirement for review, given that the investigatory processes remained ongoing and appropriate outcomes had yet to be assessed and actioned. He is also satisfied that disclosure of this withheld information would have breached that inherent expectation of confidentiality, to the substantial prejudice of public affairs, given the role of SHR as set out in the Housing (Scotland) Act 2010.

19. Consequently, the Commissioner is satisfied that the exemption under section 30(c) of FOISA was engaged at the time of the requirement for review. The Commissioner must, therefore, go on to consider whether, in all the circumstances of the case, the public interest in disclosing the withheld information is outweighed by that in maintaining the exemption.

The public interest

20. Mr Ross submitted in his requirement for review that the public interest test had not been carried out satisfactorily. Mr Ross further explained (16 January 2018) that his primary interest initially was to establish the extent of communication on fire safety issues between SHR and Viewpoint between the dates specified in his request. He stated that although SHR's role is to protect tenants, he considered there to be a level of secrecy in SHR's engagement with social landlords which he believed to be unwarranted and not in the interest of tenants. It was Mr Ross' belief that full disclosure could only be in the interests of both tenants and the wider public.

21. SHR recognised the public interest in disclosing information as part of transparent government, and in informing public debate on a matter of public interest, noting Mr Ross' comments on SRH's role as a statutory regulatory body.

22. More specifically, SHR recognised that the landlords it regulates are important institutions in the communities in which they operate. As such, SHR acknowledged a significant, legitimate local community, political and media interest in their activities. SHR recognised that Mr Ross had particular interests in Viewpoint's affairs and regulation.

23. On the other hand, SHR also identified a public interest in maintaining a strong and effective regulation of the sector where SHR could carry out its functions and duties effectively. SHR contended it was in the public interest that third parties could raise regulatory concerns with SHR in confidence and that SHR could investigate those concerns effectively, without releasing information that might compromise its inquiries and the regulatory process.

24. SHR did not believe it was in the public interest to release sensitive information, particularly where it relates to an ongoing regulatory engagement with an organisation which it regulates: it was concerned that to do so might result in that information being used out of context.

25. SHR also drew attention to information which it routinely published, which it believed went some way to addressing the public interest identified by Mr Ross. For example, within the context of its engagement with Viewpoint, SHR stated it had published Regulation Plans and the outcome of its annual risk assessment: it considered these to be the means by which it provides the public with confidence that it is discharging its functions and also transparency around its engagement with Viewpoint.

26. Contrary to what Mr Ross believed, SHR did not accept it was in the public interest to disclose individual issues or documents arising or produced in the context of ongoing regulatory engagement, particularly when other related information is routinely published to inform the public of regulatory actions and outcomes. SHR emphasised that its engagement would not be completed until made a decision on taking regulatory action (a stage, it pointed out, which had not yet been reached).

27. In balancing the public interest, SHR did not believe that disclosure would be consistent with, or enhance, its statutory regulatory responsibilities. Neither did SHR accept that disclosure here would improve accountability, or contribute to ensuring that it was adequately discharging its functions. SHR explained it was accountable to the Scottish Parliament, and must publish its Annual Reports: it also published all information submitted to it by Registered Social Landlords under the Scottish Social Housing Charter requirements. On balance, SHR believed the public interest in disclosure of this information to be outweighed by that in maintaining this exemption.

28. The Commissioner has considered very carefully where the public interest lies here, noting the submissions of relevance and the nature of the withheld information. He accepts there is a general interest in transparency and accountability, particularly involving holders of public office and their public duties. He also recognises there is some public interest in disclosure of the withheld information to Mr Ross and the wider public here, given the primary concerns identified in his submissions. The extent to which the withheld information would address these is, however, limited.

29. The Commissioner also recognises the strong public interest in maintaining confidentially and the privacy of investigatory work while it is ongoing or while enforcement work remains under consideration or assessment, as is the case here. The Commissioner is mindful of the accountability of SHR to Parliament and notes the extent of the information it currently publishes on its website. The published information may not directly address the detail of Mr Ross' own lines of enquiry, but it does go some way to informing the public about the regulatory work it carries out.

30. On balance, the Commissioner is satisfied that the public interest in disclosure of the withheld information under consideration here is outweighed by that in maintaining this exemption.

31. Consequently, the Commissioner finds that SHR was entitled to withhold this information under section 30(c) of FOISA.

32. Given this finding, the Commissioner need not go on consider SHR's application of other exemptions to information which he has already considered under this exemption.

Section 38(1)(b) - Personal information

33. In his application, Mr Ross was dissatisfied with the application of all the exemptions applied by SHR. Mr Ross clarified during the investigation he intended to capture names when framing his request and it is clear he expects that staff can be identified in the correspondence he has requested.

34. The Commissioner notes that, during this investigation, SHR stated it was content for certain of the names and contact details (mainly of its own staff, but not exclusively) to be disclosed. It may be helpful to clarify that if any personal data was caught within the correspondence considered above under section 30(c), it need not be considered again here.

35. The Commissioner will now consider the redactions to email 2 and emails 7-10 inclusive under section 38(1)(b).

Is this information "personal" data?

36. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

37. In considering whether this exemption applies, the Commissioner will first consider whether the information in question is personal data, as defined in section 1(1) of the DPA. If it is, he will go on to consider whether disclosure of the information would breach the first data protection principle, as claimed by SHR. This particular exemption is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

38. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

39. The information under consideration here as personal data comprises contact and other personal details of the senders and recipients of emails in both Viewpoint (including its representatives) and SHR. The Commissioner is satisfied that all of the information redacted here is personal data for the purposes of section 1(1) of the DPA, being information from which living individuals can be identified and which (in the context in which it appears here) can be said to relate to them. The Commissioner will therefore go on to consider whether disclosure would breach the first data protection principle in the DPA.

Would disclosure breach the first data protection principle?

40. SHR submitted that it applied this exemption originally to the personal data in question because it believed disclosing these details would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully. "Processing" here means putting the personal data into the public domain, in response to the information request. The principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.

41. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for him to consider the conditions in Schedule 3.

Can any of the conditions in Schedule 2 be met?

42. SHR considered condition 6 of Schedule 2 in relation to the remaining withheld personal data. It did not consider any other condition to be relevant.

43. Condition 6 allows personal data to be processed where that processing is necessary for the purposes of a legitimate interest pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the person(s) to whom the data relate).

44. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does Mr Ross have a legitimate interest or interests in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve these legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could the legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr Ross' legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

45. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Mr Ross must outweigh the rights and freedoms or legitimate interests of the data subjects before conditions 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that SHR was correct to refuse to disclose the personal data to Mr Ross.

Does Mr Ross have a legitimate interest in obtaining the personal data?

46. In his application, Mr Ross identified what he considered to be a clear public interest. He considered there to be a wide public interest in transparency regarding fire safety information in the aftermath of the Grenfell Tower fire. He accepted that he might have confused matters by requesting "all" communication on this occasion, but believed that knowing about fire safety and ongoing concerns around Viewpoint to be in the public interest, and certainly in the interest of tenants. While subsequent communications from Mr Ross may have suggested interest in a broader range of information, the Commissioner does not believe them to have added anything of substance by way of expressing a legitimate interest in obtaining the withheld personal data.

47. SHR questioned Mr Ross' legitimate interest, noting that Mr Ross' ability to communicate with Viewpoint would not be prejudiced in any way by withholding the personal data.

48. The Commissioner has considered both Mr Ross' and SHR's arguments carefully. In part, the withheld personal details are personal rather than business-related. Clearly when a requester frames their request for the content of correspondence on a topic, it is not always immediately apparent what personal data may be captured. Mr Ross may not have intended to capture non-business details and has not suggested at any time that he required such data but he still appears to have intended to identify who all the senders and recipients of the relevant correspondence were. The Commissioner is not satisfied that Mr Ross has a legitimate interest in any non-business email addresses. Nor can he accept that there is any need, based on the submissions before him, for Mr Ross to have any additional business contact email addresses, given he is already able to communicate freely by email (on the matters of current concern and others) with Viewpoint and SHR. It is difficult to see why he would need every business email address used in correspondence when he already has adequate means of emailing the SHR.

49. There remains the question of whether Mr Ross, and indeed tenants or the wider public, have a legitimate interest in knowing any other identifying data captured in these emails. As Mr Ross has himself indicated, he may have cast his net wider than intended: his primary focus in making this request appears to be fire safety and the performance of Viewpoint, not individuals. Fire safety in social housing is clearly a matter of pressing public concern, but the Commissioner can identify no basis for finding that it would be advanced to any significant extent by access to the personal data withheld here.

50. On balance, therefore, the Commissioner is not persuaded that Mr Ross has a legitimate interest here in obtaining the personal data withheld from emails 2 and 7 to 10 inclusive. Therefore, he must conclude that condition 6 cannot be satisfied here and that there is no other condition in Schedule 2 which would permit disclosure of these data. In the absence of a condition permitting disclosure, that disclosure would be unlawful and, therefore, contrary to the first data protection principle.

51. In light of all the relevant submissions here, the Commissioner is satisfied that SHR correctly withheld the redacted personal data from the emails in question, under section 38(1)(b) of FOISA.

Other comments

52. SHR is to be commended for providing a well explained schedule of information in its review outcome and for recognising that providing redacted documents often gives better context and understanding than the provision of "isolated" excerpts. Equally, Mr Ross recognised during this investigation that in specifying "all" correspondence, he may have cast his net a little wider than was needed, given his comments on where his primary focus lies in relation to this matter. This is a case where there appear to be learning points for both parties.

Decision The Commissioner finds that the Scottish Housing Regulator partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Ross. The Commissioner finds that, by disclosing some information to Mr Ross at the outset, SHR complied with Part 1. He is also satisfied that SHR: (i) correctly applied the exemptions under section 30(c) of FOISA, and (ii) was correct to withhold personal data in emails 2 and 7 to 10 inclusive under the exemption in section 38(1)(b) of FOISA. However, the Commissioner also finds that SHR failed to comply with section 1(1) by not disclosing information earlier in email 8.

Appeal

Should either Mr Ross or SHR wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

25 April 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

…

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

…

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.