Decision 063/2016: Mr Alasdair Mackay and the City of Edinburgh Council
Surveyors involved in projects
Reference No: 201502144
Decision Date: 15 March 2016
|
Summary
On 14 April 2015, Mr Mackay asked the City of Edinburgh Council (the Council) for a list of contracts carried out by Capital Stone Ltd. on behalf of the Council and the name of the surveyors involved in each job.
The Council disclosed the list of contracts and withheld the surveyors' names under regulation 11(2) of the EIRs, on the basis that it was personal data, the disclosure of which would breach the first data protection principle. Following an investigation, the Commissioner accepted this.
|
Relevant statutory provisions
Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation) (paragraphs (a), (c) and (f) of definition of "environmental information") and (3) (paragraphs (b) (meaning of "the data protection principles") and (d) (meaning of "personal data")); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (b) (Personal data)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I - the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Conditions 1 and 6)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 14 April 2015, Mr Mackay made a request for information to the Council. Amongst other requests, not subject of this investigation, he asked for a list of contracts carried out by Capital Stone Ltd. on behalf of the Council and for the surveyor involved in each job.
2. The Council responded on 13 August 2015. The Council disclosed a list of Capital Stone contracts, but withheld the names of the surveyors under regulation 11(2) of the EIRs (Personal data).
3. On 20 August 2015, Mr Mackay emailed the Council requesting a review of its decision. He could not see any reason to withhold the surveyors' names.
4. The Council notified Mr Mackay of the outcome of its review on 17 September 2015. The Council upheld its previous response without amendment.
5. On 15 November 2015, Mr Mackay applied to the Commissioner for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr Mackay made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
7. On 9 December 2015, the Council was notified in writing that Mr Mackay had made a valid application. The Council was asked to send the Commissioner the information withheld from him. The Council provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of the EIRs it considered applicable to the information requested.
9. Both the Council and Mr Mackay provided submissions to the Commissioner during the investigation.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Mackay and the Council. She is satisfied that no matter of relevance has been overlooked.
Application of the EIRs
11. The Commissioner is satisfied that the information covered by this request is environmental information, as defined in regulation 2(1) of the EIRs (see paragraphs (a), (c) and (f) of the definition, in particular: the text of each paragraph is reproduced in Appendix 1). The information relates to building repairs. Mr Mackay has not disputed the Council's decision to handle the request under the EIRs and the Commissioner will consider the information solely in terms of the EIRs in what follows.
Regulation 11(2) of the EIRs - personal data
12. The Council withheld the names of the surveyors under regulation 11(2) of the EIRs. It confirmed that these surveyors are, or were, Council employees.
13. In order for a Scottish public authority to rely on this exception, it must show (i) that the information is personal data for the purposes of the DPA, and (ii) that making it available would contravene at least one of the data protection principles laid down in the DPA. In this case, the Council argued that the first data protection principle would be contravened if the information was disclosed.
Is the withheld information personal data?
14. "Personal data" are defined in section 1(1) of the DPA as:
"data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possessions of, the data controller" (the full definition is set out in Appendix 1).
15. The Council stated that the withheld information comprises the names and identities of Council officers, which constitutes "personal data" for the purposes of the Data Protection Act 1998 ("DPA").
16. The Commissioner accepts that living individuals would be identified from this information. The information relates to the individuals in a biographical sense and is their personal data.
The first data protection principle
17. The first data protection principle states that the processing of personal data (in this case, making those data publicly available in response to a request made under the EIRs) must be fair and lawful and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and does not consider any of the withheld information to be sensitive personal data.
18. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be made available, it is likely that disclosure will also be fair and lawful.
19. The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be made available. If any of these conditions can be met, she must then consider whether the disclosure of these personal data would also be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
20. Following discussions with its Property Conservation team, the Council told the Commissioner that none of the data subjects had given their consent for the information to be disclosed. The Council provided a copy of a letter from one of the employees, confirming that consent had been withheld. In the circumstances, the Commissioner is satisfied that condition 1 of Schedule 2 to the DPA cannot be met.
21. The Commissioner has considered all the conditions in Schedule 2 and considers that condition 6 is the only one which might be relevant in this case. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. the individuals to whom the data relate). The processing in this case would be making the data publically available in response to Mr Mackay's request.
22. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
(i) Is Mr Mackay pursuing a legitimate interest or interests?
(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?
(iii) Even if the processing is necessary for Mr Mackay's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
Is Mr Mackay pursuing a legitimate interest or interests?
23. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In the Commissioner's published guidance[1] on regulation 11(2) of the EIRs, it states:
"In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."
24. The Council accepted that Mr Mackay had a legitimate interest in the withheld information. It noted that Mr Mackay has raised concerns regarding the statutory notice invoices for his property and it considered that he has a legitimate interest in determining that the statutory notice process was correctly followed by the Council, and that he has been invoiced for the correct amount. In this respect, he has a legitimate interest in obtaining the fullest possible information about the Council's investigation into the Statutory Notice works and the complaints that have arisen. The Council took the view that this gave Mr Mackay a legitimate interest in the disclosure of personal data of the surveyors, where this would improve his understanding of the work carried out by Capital Stone and their interaction with Council officers.
25. Mr Mackay explained that he does not require any personal details of the surveyors other than to find out if the surveyor who worked on his property was associated with other projects carried out by Capital Stone Ltd. He stated if the information was disclosed, he intended to visit the addresses and enquire from the residents if non-essential work was carried out.
26. Having considered the submissions from both Mr Mackay and the Council, the Commissioner accepts that Mr Mackay is (and was, in making his request) pursuing a legitimate interest in relation to the planning process.
Is the processing necessary for the purposes of those legitimate interests?
27. In all the circumstances of this case, the Commissioner can identify no viable means of meeting Mr Mackay's legitimate interests which would interfere less with the privacy of the data subjects than the provision of the withheld personal data. In the circumstances, she is satisfied that making those personal data available is necessary to meet the legitimate interests in question.
Is the processing unwarranted in this case by reason of prejudice to the rights, freedoms or legitimate interests of the data subjects?
28. The Commissioner must now consider whether the processing is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the individuals concerned. This test involves a balancing exercise between the legitimate interests of Mr Mackay and the rights, freedoms and legitimate interests of the individuals in question (the surveyors). Only if the legitimate interests of Mr Mackay outweigh those of the individuals concerned can the information be made available without breaching the first data protection principle.
29. In the Commissioner's guidance on regulation 11 of the EIRs, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
(ii) the potential harm or distress that may be caused by the disclosure
(iii) whether the individual objected to the disclosure
(iv) the reasonable expectations of the individual as to whether the information should be disclosed.
30. The Council submitted that the personal data relates to Council officials who worked its Property Conservation department (the surveyors). The Council explained that, at the time when it responded to Mr MacKay, the concerns surrounding the activities of the Property Conservation Service had been investigated. This investigation had led to the suspension or dismissal of some staff, but the appeal period for some or all of these decisions had not yet expired.
31. The Council recognised and acknowledged the concerns of individuals in relation to their Statutory Notice works. The Council explained that it had set up specific complaints processes to address these concerns: 607 projects involving 986 complaints had been reviewed by the Council's Resolution Team and were subsequently considered by the Complaints Resolution Panel. The Council explained that it had engaged Deloitte to conduct reviews into the projects to determine that the owners were only invoiced for the correct amounts for works undertaken by Statutory Notice.
32. The Council considered that the disclosure of individual Council officers' names was not required to determine that invoices were for the correct amount, or for owners to submit complaints or raise concerns about the works undertaken at their property.
33. The Council submitted that the officers who conducted the surveys for the Statutory Notice projects were not of such seniority that they would reasonably expect their personal data to be disclosed into the public domain, outwith the normal course of business.
34. The Council considered that disclosure might not cause the data subjects actual harm, but that it was reasonable to conclude that disclosure of their names into the public domain would cause them distress when there remains much public speculation and comment about the investigation into the activities of the Property Conservation Service.
35. The Council concluded that Mr Mackay's interest in the identities of the surveyors did not outweigh their legitimate interests in their personal data not being placed in the public domain by the Council.
36. The Commissioner recognises that the investigation into the activities of the Property Conservation Service has moved on since the date of Mr Mackay's request, but she must consider and make a determination on the situation as it existed at the time of the Council's review response to Mr Mackay in September 2015, and decide whether the exception in regulation 11(2) of the EIRs was correctly applied in the circumstances existing at that time.
37. Having considered the submissions made by the Council and Mr Mackay, the Commissioner accepts that disclosure of the withheld information in response to this information request would be likely to cause distress to the data subjects, given that Mr Mackay intends to contact the property owners who had work undertaken by the same surveyor. This in turn could lead to publication of allegations about individual surveyors.
38. In all the circumstances, having considered the arguments made by both Mr Mackay and the Council, and having weighed Mr Mackay's legitimate interests against the legitimate interests, rights and freedoms of the data subjects, the Commissioner has concluded that the legitimate interests of the data subjects outweigh those of Mr Mackay. As a result, she has determined that disclosure would be unwarranted in this case. In reaching this decision, she has taken into account that the Council has made considerable efforts to resolve complaints resulting from the activities of some of its employees in the Property Conservation Service, and has put in place a mechanism for dealing with those complaints.
39. The Commissioner has concluded that condition 6 in Schedule 2 to the DPA is not met in this case in relation to the withheld personal data. As no schedule 2 conditions can be met, the personal data cannot be disclosed without contravening the first data protection principle.
40. The Commissioner therefore accepts that the names of the surveyors were correctly withheld under the exception in regulation 11(2) of the EIRs.
|
Decision
The Commissioner finds that the City of Edinburgh Council complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr Mackay.
|
Appeal
Should either Mr Mackay or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
15 March 2016
Appendix 1: Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations -
?
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
?
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
?
(f) the state of human health and safety, including the contamination of the food chain, where relevant, conditions of human life, cultural sites and built structures inasmuch as they are or may be affected by the state of the elements of the environment referred to in paragraph (a) or, through those elements, by any of the matters referred to in paragraphs (b) and (c);
?
(3) The following expressions have the same meaning in these Regulations as they have in the Data Protection Act 1998], namely-
?
(b) "the data protection principles";
?
(d) "personal data".
?
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
?
(b) is subject to regulations 6 to 12.
10 Exceptions from duty to make environmental information available-
?
(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.
?.
11 Personal data
?
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.
(3) The first condition is-
(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
1. The data subject has given consent to the processing.
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
[1]
http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
