Decision 060/2017: Mr T and City of Edinburgh Council Report by Safecall relating to whistleblowing allegation Reference No: 201602186 Decision Date: 27 April 2017 Summary Edinburgh City Council was asked for information in a report produced by Safecall, following a whistleblowing allegation, together with a rebuttal of that report. The request was the same as one the requester had previously made. The Council refused to disclose information in response to that request; a position upheld by the Commissioner. The requester now believed circumstances had changed sufficiently and that the information should be disclosed. The Council withheld all the information requested in this later request. This was because it regarded it as exempt under various provisions in FOISA. The Commissioner found that the Council had correctly withheld the information, and so did not require the Council to take any action.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) and (2)(2)(e)(Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(a), (1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 28 June 2016, Mr T requested from City of Edinburgh Council (the Council) a report by Safecall (produced in response to whistleblowing allegations) and a rebuttal letter from the Council's Director of Children and Families. He believed both documents might contain references to him.

2. The Council responded on 25 July 2016, withholding all the information requested. It cited exemptions in sections 30(b), 30(c), 35(1)(g), 38(1)(a) and 38(1)(b) of FOISA.

3. On 27 July 2016, Mr T wrote to the Council requesting a review of its decision. He believed he should be able to access the report, on the basis that it contained allegations about him which he should be able to challenge. He submitted that withholding the information was contrary to natural justice.

4. The Council notified Mr T of the outcome of its review on 24 August 2016. It did not uphold its earlier reliance on section 30(b) of FOISA but otherwise upheld its original decision without modification.

5. On 30 November 2017, Mr T wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr T stated he was dissatisfied with the outcome of the Council's review because he believed he was entitled to challenge the content of the report and withholding it was contrary to natural justice.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr T made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 23 December 2016, the Council was notified in writing that Mr T had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr T. The Council provided the information and the case was allocated to an investigating officer.

8. The investigating officer sought more detailed comments from Mr T on the circumstances which he believed had changed since he requested the withheld information previously (that previous request being considered by the Commissioner in Decision 181/2016: Mr T and City of Edinburgh Council[1]). He did so on 18 February 2017 and these submissions are considered further below.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application, and on Mr T's further comments. The Council was asked specific questions, focusing on the application of exemptions applied in its review outcome. To clarify how exemptions had been applied to each document, it was also asked to provide marked-up copies of the withheld information (which it did).

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr T and the Council. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(a) of FOISA - Personal data of the applicant

11. The Council marked the withheld information in the report and the letter which it had already disclosed to Mr T (5 August 2016) in response to a subject access request (SAR) under the DPA. The Council confirmed that it considered this information was exempt from disclosure under FOISA, applying the exemption in section 38(1)(a).

12. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject. As it is absolute, it is not subject to the public interest test set out in section 2(1)(b) of FOISA.

13. This exemption exists under FOISA because individuals have a separate right to request their own personal data (commonly known as a "subject access request") under section 7 of the DPA. The DPA will therefore usually determine whether a person has a right to request their own personal data, and govern the exercise of that right. Crucially, it makes provision for access solely by the data subject (the person to whom the data relate) and not to the world at large (as with FOISA). Put simply, the DPA is the correct route of access when someone asks for their own data: it affords the data a level of protection and privacy which FOISA does not.

14. Section 38(1)(a) of FOISA does not, therefore, deny individuals a right to access to information about themselves, but ensures that the right is exercised properly, under the DPA and not under FOISA.

15. Personal data are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

16. Having considered the withheld information and the submissions received from the Council, the Commissioner is satisfied that the information withheld under this exemption comprises Mr T's own personal data, as the information relates to him (as one involved in the whistleblowing allegations) and he is identifiable from that information. Having reached that conclusion, the Commissioner must conclude that the information is properly withheld under the exemption: she cannot take into consideration any reasons cited by Mr T for seeking the information.

Section 38(1)(b) - Personal data of third parties

17. The Council applied the exemption in section 38(1)(b) of FOISA to information in both documents which it considered to be personal data of third parties (and not of Mr T).

18. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it comprises "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

19. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

20. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Schedule 1.

Is the information under consideration personal data?

21. The Commissioner will firstly consider whether the information withheld comprises personal data. The definition of "personal data" in section 1(1) of the DPA has been considered above, in paragraph 15, in relation to section 38(1)(a) of FOISA.

22. The Commissioner is satisfied that the Council has been correct in identifying information as personal data for the purposes of section 38(1)(b). The information relates to the activities of individuals (and therefore to those individuals) and the individuals in question can be identified from the information. The question she must consider next is whether these data can be provided to Mr T under FOISA.

23. The Council commented that the withheld information, falling within a number of different exemptions, was mostly indelibly linked and mixed together in such a way that was often impossible to meaningfully separate. The Commissioner acknowledges this, which is due to the nature of the events covered and the way in which the documents are written. As a result, the Commissioner accepts that it would not be practicable to redact the third party data in such a way as to render what was left anonymous (and thus deprive it of its character as personal data).

Would disclosure contravene the first data protection principle?

24. The Council submitted that disclosing the withheld personal data would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. The processing in this case would be making the information publicly available in response to Mr T's request.

25. The Commissioner notes that elements of the withheld personal data fall within the definition of sensitive personal data in section 2 of the DPA. In this case, she will consider the application of the Schedule 2 conditions (to all of the personal data withheld under section 38(1)(b)) first, going on to consider the application of the Schedule 3 conditions thereafter if she finds it necessary.

Can any of the conditions in Schedule 2 be met?

26. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2], that the conditions require careful treatment in the context of a request for information under FOISA. They were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).

27. Condition 1 in Schedule 2 permits processing (in this case, disclosure) for which the data subject has given his or her consent. The Council submitted that the data subjects involved in this case had not given their consent. The Commissioner accepts this, and that it would not be appropriate in the circumstances for such consent to be sought. Condition 1 cannot, therefore, apply.

28. Condition 6 in Schedule 2 was also considered in the Council's submissions. It is the only other Schedule 2 condition the Commissioner considers to be of potential relevance.

29. Condition 6 allows personal data to be processed where that processing is necessary for the purposes of legitimate interests pursued by the data controller, or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.

30. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

(i) Does Mr T have a legitimate interest in obtaining the personal data?

(ii) If so, is disclosure necessary to achieve those legitimate interests? In other words, is disclosure proportionate as a means and fairly balance as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject(s)?

(iii) Even if disclosure is necessary for these purposes, would it nevertheless be unwarranted by reason of prejudice to the rights, freedoms or legitimate interests of the data subject(s)? As noted by Lord Hope in the above judgment, there is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Mr T must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.

31. There is no definition in the DPA of what constitutes a "legitimate interest." The Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance on section 38 of FOISA[3] states:

In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

32. In the Commissioner's view, Mr T has a legitimate interest in obtaining the withheld personal data. The Council recognised this in its review decision and also in its submissions. The Commissioner is satisfied that Mr T has demonstrated that he has a personal interest (extending beyond mere curiosity) in the content of the withheld information, specifically in informing himself about allegations in which he may (or may not) have been named.

Is disclosure necessary to achieve those legitimate aims?

33. Having concluded that Mr T has a legitimate interest in obtaining the personal data under consideration, the Commissioner must now consider whether disclosure of the personal data is necessary to achieve those legitimate aims, or whether these legitimate aims can be achieved by means which interfere less with the privacy of the data subjects.

34. Having reviewed the withheld information, the Commissioner cannot identify any other viable means of meeting Mr T's interests in full which would interfere less with the privacy of the data subjects than providing the withheld personal data. As indicated above, the data cannot practicably be rendered anonymous. Consequently, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mr T's legitimate interests.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

35. The Commissioner must now consider whether disclosure would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. This involves a balancing exercise between the legitimate interests of Mr T and those of the data subjects. Only if the legitimate interests of Mr T outweigh those of the data subjects can the data be disclosed without breaching the first data protection principle.

36. In the Commissioner's briefing on the personal information exemptions, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

· whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

· the potential harm or distress that may be caused by disclosure;

· whether the individual objected to the disclosure; and

· the reasonable expectations of the individual as to whether the information should be disclosed.

37. Much of the Council's submissions outlined the harm to the third parties who had participated in the whistle-blowing process which had resulted in the report and subsequent rebuttal letter. It stressed the confidentiality inherent in the whistleblowing process, which would be breached by disclosure. In that context, disclosure (effectively, to the world under FOISA) would be contrary to the reasonable expectations of the third parties. The Council highlighted the impossibility of anonymisation, noted above.

38. In assessing this data, the Council indicated that it had followed the UK Information Commissioner's guidance and considered the rights of all involved. (The UK Information Commissioner is responsible for regulating and enforcing the DPA throughout the UK.)

39. Mr T's submissions recognise that others are mentioned in the report. His main focus is on challenging its content, and on allowing others (named in the report) to do the same, in the interests of natural justice. He articulated concerns as to whether allegations in the report could be substantiated. He believed there was a relationship (which cannot be more fully described here, without risking the disclosure of personal data) between allegations in the report and others affecting him made more recently.

40. The Commissioner has considered all of the submissions made to her when balancing the legitimate interests in this case.

41. The Commissioner remains concerned as to the impact disclosure of these personal data would have on the interests of those who took part in the whistleblowing process. The assurance of confidentiality is an inherent part of such participation. The Commissioner also recognises that Mr T, and potentially others, may have legitimate concerns about the content of the withheld personal data, which may also impact on their own respective interests. The Commissioner must balance these competing interests, bearing in mind that disclosure under FOISA is to the public as a whole and not just to Mr T or others directly affected by the content of the withheld information. In doing so, she has considered all relevant submissions made to her.

42. The Commissioner has considered Mr T's current concerns, but is not satisfied that the arguments he has presented carry sufficient weight to outweigh the reasonable expectations of the data subjects referred to in the withheld information that their data would be processed in confidence. Mr T's concerns are undoubtedly deeply held, but disclosure would engage significant privacy rights, established for an important public purpose. In that context, the Commissioner is not persuaded that Mr T's rights outweigh those of the third parties.

43. Given her conclusions above, the Commissioner finds that there is no condition in Schedule 2 to the DPA which would permit disclosure of the personal data withheld under section 38(1)(b) of FOISA. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and has been properly withheld) under section 38(1)(b) of FOISA. In the circumstances, she does not find it necessary to consider the application of Schedule 3 of the DPA to any sensitive personal data falling within the data withheld under section 38(1)(b)

44. The Commissioner will now go on to consider the Council's application of the exemption in section 30(c) of FOISA to the remaining withheld information (i.e. that information which does not comprise the personal data of any individuals).

Section 30(c) - Prejudice to effective conduct of public affairs

45. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs". The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure. The exemption (if found to be engaged) is also subject to the public interest test in section 2(1)(b) of FOISA.

46. As noted in previous decisions, there is a high threshold to be crossed in applying the tests contained in the section 30(c) exemption. The prejudice must be substantial, and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case-by-case basis, taking into account the actual content of the information and all other relevant circumstances (which may include the timing of the request).

47. This is not the first time this particular information has been considered by the Commissioner. The Safecall report, with rebuttal letter, has already been the subject of Decision 181/2016, in which the Commissioner accepted the application of section 30(c) to all of the withheld information. The Council did not consider circumstances to have changed significantly since the exemption was upheld in that previous decision.

48. Mr T contended that the existence of an ongoing court case had a significant bearing on the previous decision on section 30(c). He submitted that there was no longer the same risk of substantial prejudice following the conclusion of that case.

49. With regard to the court case now being complete, and Mr T's assertion that this changed the position sufficiently to allow disclosure, the Council noted that there could be circumstances in which issues covered in the report and rebuttal could be relevant in future proceedings. It denied that the ongoing court case was a significant factor in its previous decision to withhold the information, although it confirmed that the case's conclusion had been taken into account when it carried out its review in relation to the current request. The review also revisited the arguments on prejudice considered in the previous case and concluded that they remained valid.

50. Mr T submitted that the report was shared with a number of individuals within the Council. This point has been considered previously, in Decision 181/2016. The investigator asked the Council whether the withheld information had been shared further since the previous investigation. The Council provided confirmation that it had not, with the exception of disclosure of Mr T's own personal data to him. It referred to non-disclosure arrangements it had put in place. The Commissioner is satisfied that the position is as described by the Council.

51. In support of its position, the Council continued to highlight the deterrent effect of disclosure on the reporting of concerns. Individuals would be less likely to co-operate if not assured of confidentiality and this would hamper its ability to investigate concerns effectively. It highlighted the effective protection of whistleblowers as a matter of ongoing public debate and concluded that the harm likely to result from disclosure, as considered in Decision 181/2016, was unchanged in the present circumstances. The information remained unsuitable for general disclosure "to the world" under Freedom of Information legislation.

52. The Commissioner has considered the content of the information withheld under this exemption, along with both the Council's and Mr T's submissions on the exemption. As in Decision 181/2016, she remains satisfied that the whistleblowing process relies for its effectiveness on the assurance of confidentiality. She is satisfied that the information under consideration here retains the quality of confidence. As in Decision 181/2016, she is satisfied that disclosure of the withheld information would breach that inherent expectation of confidentiality, to the substantial prejudice of public affairs.

53. The Commissioner also accepts the Council's submission that the scope for such substantial prejudice is not affected to any significant extent by the conclusion of the Court case referred to by Mr T. In all the circumstances, the expectation of confidentiality remains. Mr T's arguments in relation to matters arising from the court case may have a bearing on the public interest, but that is another matter (see below).

54. The Commissioner is satisfied that the exemption under section 30(c) of FOISA remains engaged here and that it has been correctly applied by the Council. The Commissioner must, therefore, go on to consider whether, in all the circumstances of the case, the public interest in disclosing the withheld information is outweighed by that in maintaining the exemption.

The public interest

55. Mr T (who was given the opportunity of commenting on the Council's public interest arguments) submitted that

"The real public interest in this matter is that officers of the Council and others have faced false and malicious allegations made by a number of individuals acting in a conspiracy. They have had no right of redress, they have been forced by the Council not to comment publicly on these matters, they have not been protected from false allegations made against them by their employer - [the Council] - in breach of its duty of care. Unless we have access to these documents, it is difficult for us to formulate what further steps we can take to remedy the vicious attacks that have been made upon us."

56. The Council did not deny that Mr T had demonstrated a strong personal interest in disclosure of the withheld information. It accepted that there were also public interest arguments in favour of the Council promoting transparency and accountability through disclosure of information relating to its actions and investigations on behalf of the citizens of Edinburgh. It had acknowledged this to Mr T in its review outcome. That said, the Council remained of the view that these must be balanced against the harm that would be likely to result as a consequence of disclosure.

57. In balancing the public interest, the Council recognised that this case related to individual allegations of misconduct of a personal nature, in a discrete area of the Council's operations. The investigation did not identify systemic or broad failings across the Council on a level which would prompt public disclosure in the public interest (as had happened, for example, in relation to Property Conservation and school buildings). In the circumstances, the Council concluded that the balance of the public interest remained unchanged from that upheld in Decision 181/2016.

58. The Commissioner has considered where the balance of where the public interest lies very carefully. She has taken into account the submissions made by both parties, both in relation to this application and in relation to her previous decision. This includes the additional arguments advanced by Mr T following conclusion of the court case (which cannot be set out in detail here without the risk of disclosing information which is itself confidential).

59. The Commissioner accepts there is a general interest in transparency and accountability, particularly involving holders of public office and their public duties. She also recognises, as she did in her earlier decision that, there is some public interest in disclosure of the withheld information to Mr T. Balanced against this is the strong public interest in maintaining confidentiality and the privacy of individuals to ensure whistleblowing processes are effective.

60. On balance, the Commissioner finds that the public interest arguments for continuing to withhold the information outweigh those for its disclosure, even taking into account recent events as put forward by Mr T.

61. The Commissioner therefore finds that the Council was entitled to withhold this information under section 30(c) of FOISA.

62. The Commissioner notes that the Council identified information in the report which it wished to withhold under section 35 of FOISA. The Council applied section 30(c) to the same information. Given her findings above, she is not required to consider the application of section 35 to the same information.

Decision The Commissioner finds that the Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr T.

Appeal

Should either Mr T or City of Edinburgh Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner

27 April 2017

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

…

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

(i) paragraphs (a), (c) and (d); and

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

…

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

…

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---