Decision 064/2009 Mr Robert Henderson and the University of Edinburgh

Termination of an individual's tenure

Reference No: 200801777
Decision Date: 3 June 2009

Summary

Mr Henderson requested from the University of Edinburgh (the University) information relating to the termination of a named individual's tenure by the University.The University provided Mr Henderson with certain information and with explanations of certain matters.It also relied on the exemption in section 38(1)(b) of FOISA for withholding other information from him.Following a review, Mr Henderson remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the University of Edinburgh had dealt with Mr Henderson's request for information in accordance with Part 1 of FOISA by relying on section 38(1)(b) for withholding certain informationHe was satisfied that the University had provided Mr Henderson with all the information it held in response to his request.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and 6 (General entitlement); 2 (Effect of exemptions); 17 (Notice that information is not held); 38(1)(b) and 2 (b) (Personal information).

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions); section 33A(1); Schedules 1 (The data protection principles: the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data - condition 6).

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 3 September 2008, Mr Henderson wrote to the University seeking information relating to the termination of the tenure of a specified lecturer in 1997.The University provided him with information in response, some of it subject to redaction.On 4 October 2008, Mr Henderson wrote to the University again, asking for clarification as to why an Anti Nazi League petition was kept by the University among the information considered to fall within the scope of his request.In addition to a number of other questions on this point, he asked on what grounds the petition signatories' details had been deleted, and also on what grounds details of the senders of specified hand written letters to Professor Sutherland and a typewritten message had been deleted.

2.The University responded on 13 October 2008.In its response, the University provided comments on certain points Mr Henderson had raised.It also explained that it was relying on the exemption in section 38(1)(b) of FOISA for withholding the petition signatories' details, and those of the senders of the letters and typewritten message he had identified.The University explained to Mr Henderson that it was of the view that release of this information in response to his request would breach the first data protection principle.It apologised for not providing its explanation of its use of the exemption in its initial response to his request.

3.Mr Henderson wrote to the University on 20 October 2008 requesting a review of its decision. In particular, Mr Henderson drew the University's attention to his view that the Data Protection Act could not protect the details of the signatories to the petition, arguing that a petition which is raised publicly is by definition not confidential.Mr Henderson also indicated that as the Information Commissioner had ruled that any senior public servant should be identified in response to requests where the information was relevant to the request (as he believed to be the case here), he did not agree that the individual's details which were redacted from the letters and typewritten message should be exempt.Within his request for a review, Mr Henderson also highlighted his surprise at the quantity of information which had been supplied to him, as had expected more information would have been found relating to certain specified events and individuals.He sought an explanation for the absence of such information, requesting in respect of any further relevant information held by the University that it either be provided to him or that he be notified of the exemption(s) under which it was being withheld. .

4.The University notified Mr Henderson of the outcome of its review on 17 November 2008. The University upheld its decision to rely on section 38(1)(b) of FOISA for withholding the details of the signatories to the petition, together with those of the senders of the letters and typewritten note.In responding to Mr Henderson's query regarding the apparent lack of information provided, the University advised that it had undertaken a further search of its record holdings, including files that had already been checked and areas Mr Henderson had mentioned in his review request, including areas not directly related to the specified lecturer or his case.It identified and provided further relevant information, some of it subject to redaction under sections 38(1)(b) and 39(1) of FOISA.

5.On 2 December 2008, Mr Henderson wrote to the Commissioner's Office, stating that he was dissatisfied with the outcome of the University's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr Henderson had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 8 January 2009, the University was notified in writing that an application had been received from Mr Henderson and asked to provide the Commissioner with any information withheld from the applicant. The University responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted the University, on 28 January 2009, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the University was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested, with particular reference to section 38(1)(b).The University was also asked to comment on Mr Henderson's concern that further relevant information should be held by it.

9.A full response was received from the University on 18 February 2009.Further correspondence followed in respect of the information falling within the scope of Mr Henderson's request and the searches conducted to locate it.Submissions were also obtained from Mr Henderson.The arguments of both parties will be considered in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

10.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Henderson and the University and is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) ? Personal information

11.As mentioned above, the University has relied on the exemption in section 38(1)(b) of FOISA, read in conjunction with section 38(2)(b), for withholding the information redacted from the petition, letters and typewritten note.The information to which the University had applied section 39(1) of FOISA did not fall within the scope of Mr Henderson's application.In making its submissions to the Commissioner, the University has provided combined submissions for its reliance on section 38(1)(b) for the redacted information in all of these documents.The Commissioner will therefore consider all of this information together.

12.The exemption in section 38(1)(b) (read with section 38(2)(a)(i) or, as appropriate, section 38(2)(b)) of FOISA exempts personal data from disclosure, if the disclosure of the information otherwise than under FOISA would contravene any of the data protection principles contained in the Data Protection Act 1998 (the DPA). This particular exemption is an absolute exemption in that it is not subject to the public interest test set down in section 2(1)(b) of FOISA.

13.In order to rely on this exemption, therefore, the University must show firstly that the information being withheld is personal data for the purposes of the DPA, and secondly that disclosure of the information into the public domain (which is the effect of a disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.

14.In considering the application of the exemption, the Commissioner will therefore first consider whether the information which has been withheld is personal data as defined in section 1(1) of the DPA.

Is the information personal data?

15.Section 1(1) of the DPA defines personal data as data which relate to a living individual who can be identified (a) from those data or (b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

16.Firstly, the applicant has raised a point which requires the Commissioner to consider whether the withheld information can be considered "data" for the purposes of the DPA.He has indicated that he believes the DPA to require that data be held in a "qualifying filing system", and questioned whether any of the withheld information was held in such a system.

17.The Commissioner acknowledges that information recorded in a relevant filing system is one of the categories of information which qualifies as "data" in terms of section 1(1) of the DPA, by virtue of paragraph (c) of that definition.He also acknowledges that the definition of a "relevant filing system" (also to be found in section 1(1)) is a restrictive one, into which the withheld information would be unlikely to fall under normal circumstances.Equally, it would be unlikely to fall within any of the other categorise of data listed in paragraphs (a), (b) or (d) of the definition.There is, however, a final category of data, inserted by the Freedom of Information Act 2000 as paragraph (e) ("category 'e' data").This is recorded information held by a public authority and not falling within any of the other paragraphs.The definition of "public authority" includes a Scottish public authority as defined by FOISA.

18.Having considered the withheld information, the Commissioner is satisfied that it is recorded information held by a Scottish public authority (the University) and therefore that it qualifies as "data" for the purposes of the DPA.

19.Ordinarily category 'e' data would not be covered by all of the eight data protection principles, because of the terms of section 33A(1) of the DPA.However, section 38(2)(b) of FOISA allows the exemptions in section 33A(1) to be disregarded for the purposes of the section 38(1)(b) exemption, with the result that category 'e' data can be exempt if it is personal data and its disclosure would contravene any of the data protection principles.The Commissioner will now go on to consider whether the withheld information is personal data.

20.In its submissions to the Commissioner, the University has argued that the withheld information is sufficient to identify certain individuals and that applying the criteria in the Information Commissioner's Data Protection Technical Guidance Determining What is Personal Data (the Technical Guidance) (http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/personal_data_flowchart_v1_with_preface001.pdf, at page 7 onwards), the information relates to those individuals.

21.The information redacted from the petition comprises the names, addresses and matriculation numbers of the students who signed the petition.The information redacted from the handwritten letters comprises the name, address and qualifications of the writer, while the name, address and qualifications of the recipient (not the sender, as indicated in correspondence between Mr Henderson and the University) have been redacted from the typewritten note.

22.Having considered the information which has been withheld, the Commissioner is satisfied that living individuals (i.e. those who signed the petition, the writer of the letters and the recipient of the note) can be identified from it.In reaching this conclusion, he has been mindful of the reference in the Technical Guidance (at pages 6 and 7) to Recital 26 of the European Data Protection Directive (Directive 95/46/EC, which the DPA implements in the United Kingdom), which states that consideration of whether a person is identifiable from data should take account of "all means likely reasonably to be used either by the controller [in this case, the University] or by any other person to identify the said person".In the Technical Guidance, the Information Commissioner takes the view that this should lead to consideration not just of "the means reasonably likely to be used by the ordinary man in the street, but also the means that are likely to be used by a determined person with a particular reason to want to identify individuals". While noting that (as the University admits) more than 10 years have passed since the University received the information, the Commissioner accepts the University's contention that it would still be at least a starting point for locating the individuals concerned (who are likely still to be living) and that it would not be beyond the resources reasonably available to a determined person (the Information Commissioner gives as examples "investigative journalists, estranged partners, stalkers, or industrial spies") to use the information successfully for this purpose.

23.Having concluded that the individuals in question could be identified from the withheld information, the Commissioner is also satisfied that the information relates to those individuals and therefore is their personal data as defined in section 1(1) of the DPA: It clearly focuses on them and is biographical of them in a significant sense.

24.The fact that information is personal data is not enough, however, to make it exempt from disclosure under section 38(1)(b) of FOISA.For the exemption in section 38(1)(b) (read in conjunction with section 38(2)(b)) to apply, the Commissioner must be satisfied that disclosure would breach one or more of the data protection principles contained in the Data Protection Act.The University has argued that disclosure of the information would breach the first data protection principle, by being both unfair and unlawful.

Would disclosure breach the first data protection principle?

25.The first data protection principle requires personal data to be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 (of the DPA) is met, and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (again, of the DPA) is also met.

26.The conditions in Schedule 3 are very restrictive and it therefore makes sense, before going on to consider whether the conditions in Schedule 2 of the DPA would permit the information to be disclosed, to look at whether the information falls into the definition of sensitive personal data.The Commissioner has considered the categories of sensitive personal data set out in section 2 of the DPA, but does not consider the withheld information to fall into any of them.Therefore, he is satisfied that it is not sensitive personal data.As a result, he need only consider whether any of the conditions in Schedule 2 can be met, along with (as required) any wider considerations of fairness and lawfulness.

27.Part II of Schedule 1 to the DPA provides assistance in defining "fairness" for the purposes of the first data protection principle.As Lord Hope notes in the case of Common Services Agency v Scottish Information Commissioner 2008 SLT 901 (the Collie judgement) "fairness" is concerned essentially with the method by which data is obtained, and in particular with whether the person from whom the data were obtained was deceived or misled as to the purpose or purposes for which the data are to be processed.

28.As Lord Hope also notes in the Collie judgement, the concept of lawfulness cannot sensibly be addressed without considering the conditions set out in Schedule 2 (and Schedule 3 also, where it is applicable), because any disclosure which fails to meet at least one of the necessary conditions would be contrary to section 4(4) of the DPA (which provides that it shall be the duty of the data controller to comply with the data protection principles).There may also be other reasons as to why the disclosure of information is unlawful, for example because disclosure of the information would be a breach of confidence, or because there is a specific law forbidding disclosure.In this case the University has not put forward any arguments as to why the disclosure of the personal data would be unlawful, otherwise than as a result of failing to meet condition 6 in Schedule 2.

29.When considering the conditions in Schedule 2, the Commissioner has also noted Lord Hope's comment in the Collie judgement that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.

30.Having considered the conditions in Schedule 2 and taken account of the University's submissions, the Commissioner has concluded that condition 6 is the only one which might permit disclosure in this case.Condition 6 permits personal data to be processed if the processing (which in this case would be by disclosure in response to Mr Henderson's information request) is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).It is clear from the wording of this condition that each case will turn on its own facts and circumstances.

31.There are, therefore, a number of tests which must be considered before condition 6 can be met.These are:

Does Mr Henderson have a legitimate interest in obtaining the withheld personal data?

If yes, is disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the individuals in question?

Even if the processing is necessary for Mr Henderson's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or the legitimate interests of the signatories of the petition, the writer of the handwritten letters or the person to whom the typewritten note was addressed?As noted by Lord Hope in the Collie judgement, there is no presumption in favour of release of personal data under the general obligation laid down in FOISA.Accordingly, the legitimate interests of Mr Henderson must outweigh the rights and freedoms or legitimate interests of those individuals before condition 6(1) will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the personal data to Mr Henderson.

Does Mr Henderson have a legitimate interest?

32.In his submissions to the Commissioner, Mr Henderson has set out what he considers to be his legitimate interests in receiving the withheld information.He argues that there is a very strong public interest involved in this case, as (in his words) "it is no small thing for a tenured academic to be driven from his post".He believes there to be clear evidence that the petition would have influenced (and arguably was the prime driver in) the University's proceedings against the specified lecturer, contending that there was a widespread movement within the University to remove this individual simply because of his views.In his opinion, the proceedings followed in the course of the individual's removal were "tainted" either by undue influence from his opponents or by an active desire to remove him.

33.In his support, Mr Henderson has referred to a decision of the Information Commissioner, who is responsible for the enforcement of the (United Kingdom) Freedom of Information Act 2000 (FOIA) and of the DPA.While in his decision FS50086626 the Information Commissioner accepted the withholding of similar details of the signatories of a petition submitted to a public authority, Mr Henderson suggests that the circumstances were different in that he does not understand there to have been any evidence in that other case of the petition having influenced the relevant decision of the public authority.

34.The University concedes that Mr Henderson might have a legitimate interest in disclosure.Having considered the submissions of both parties, the Commissioner accepts that Mr Henderson has a legitimate interest (as indeed do the wider public) in being satisfied that the decision-making processes of a public authority (in this case the University) are open to scrutiny and influenced only by relevant considerations.Without commenting on whether it had any bearing on the decision in question, the Commissioner acknowledges that the withheld information has at least some connection to the removal of the specified lecturer and in the circumstances he accepts Mr Henderson's legitimate interest in it.

Is disclosure necessary to achieve these legitimate aims?

35.In its submissions to the Commissioner, the University stated that it had given Mr Henderson the text of the petition, letters and typewritten note, the petition being redacted in such a way that Mr Henderson could see how many people had signed it.The only withheld information was that which might identify the authors of the documents.Having considered the withheld information, the Commissioner acknowledges this to be the case.

36.Taking account of Mr Henderson's arguments as outlined above, in particular those relating to influence on the removal process, the Commissioner considers disclosure of the withheld information to be necessary to achieve Mr Henderson's legitimate interests.While a considerable amount of information on the matter has been released to Mr Henderson already, the Commissioner understands the identities of the individual signatories and correspondent(s) to be at least partly at the root of his concerns as to undue influence, which he would require to address if his legitimate interests are to be fulfilled.In the circumstances, the Commissioner cannot identify a means of meeting these legitimate interests which would be less intrusive than disclosure of the withheld personal data.

Would disclosure of information cause unwarranted prejudice to the rights and freedoms or legitimate interests of the signatories of the petition, the writer of the handwritten letters or the person to whom the typewritten note was addressed?

37.Mr Henderson has argued that the character of the petition in this case differs from that considered by the Information Commissioner in decision FS50086626, in being politically motivated: he does not believe there to be a general expectation of privacy in relation to petitions raised for a political end.The University, on the other hand, highlights similarities to that other case, the petition having been submitted against a person rather than in support of a general cause and therefore being more likely to have been submitted in confidence.They took the view that the circumstances of its submission suggested it was intended for University officials only, arguing that the information had been provided by the individuals in a private capacity and that they would have had no expectation of its disclosure.Pointing out that the individuals concerned might not wish to reopen an issue in which they had taken an interest more than 10 years earlier, they argued that disclosure would cause unwarranted prejudice to their rights, freedoms and legitimate interests.

38.The Commissioner accepts and agrees with the submission made by the University on this point.Whatever expectations might be in respect of the submission of such a petition today, it appears clear to the Commissioner that in 1996 or 1997, well before Freedom of Information legislation was even in contemplation, the petitioners and correspondent(s) involved in this matter would have had no reasonable expectation that their personal data, as contained in the petition and correspondence under consideration here, would be disclosed into the public domain.Consequently, the Commissioner would regard disclosure in response to Mr Henderson's request as wholly contrary to their legitimate interests and expectations.

39.On balance, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfil Mr Henderson's legitimate interests (at least in part), he does not agree that this outweighs the unwarranted prejudice that would be caused to the data subjects' rights, freedoms and legitimate interests (which must be viewed in the light of their reasonable expectations at a time well before the introduction of Freedom of Information legislation).The Commissioner is therefore satisfied that condition 6 of Schedule 2 to the DPA cannot be met in this case.

40.Having concluded that disclosure of the withheld information would lead to unwarranted prejudice, as described above, to the rights, freedoms and legitimate interests of the signatories of the petition, the writer of the handwritten letters and the person to whom the typewritten note was addressed, the Commissioner must also conclude that disclosure would be unfair.As condition 6 cannot be met, he would also regard disclosure as unlawful.In all the circumstances, therefore, he finds that disclosure would breach the first data protection principle and that the information was therefore properly withheld under section 38(1)(b) of FOISA.

Section 17 ? Notice that information is not held

41.As indicated above, Mr Henderson was not satisfied that the University had located and provided all of the information it held falling within the scope of his request.

42.In its submissions to the Commissioner, the University explained that since the individual in question had been dismissed by the University it had undergone extensive reorganisation.It advised that the case of the individual in question had been dealt with at the time by the University HR Department and the University Secretary.

43.The University has provided full details of the areas it searched to try to locate any other relevant information.Searches were made in the files of the HR department and the University Secretary.However, it is the University's submission that any relevant information from these files (in particular files relating directly to the employment of the individual concerned) has been destroyed in line with its records retention schedule.

44.The University has provided the Commissioner with a copy of the relevant records retention schedule which was applicable to these records.The schedule states that information relating to an employee's termination of employment should be destroyed 6 years after the termination.

45.The University has also advised that searches were carried out of records held by the University Principal, Central Records Registry, HR personal files, HR disciplinary/grievance proceedings files, HR staff database, College Office of the College of Humanities and Social Science, Head of College of Humanities and Social Science, School of Philosophy, Psychology and Language Sciences, Head of Psychology, University Archives, Head of Court Services and Payroll.Staff Committee meeting minutes and Joint Consultation and Negotiating Committee minutes were also searched for any relevant information.The University also checked with current and past staff members of the University identified by Mr Henderson, to ascertain if they held any other relevant information.The University advised that any information that they did find and which was relevant to Mr Henderson's request had been provided to him.

46.The University explained that records were only held by its Payroll section for 7 years: as the named individual's tenure had been terminated in 1997, no relevant information was held there.

47.Further submissions which were received from the University contained emails demonstrating the breadth of the searches that were carried out and the areas of the University which were checked.

48.When the Commissioner is considering what information a Scottish public authority held within the scope of a particular request for information, he is not investigating whether the requested information ever existed, or whether the public authority ever held it, or whether it was under an obligation to hold it.He is instead required to consider whether, as a matter of fact, the public authority held the information at the time of the applicant's request.

49.Having considered the submissions received from the University, including the relevant retention schedule and details of the searches carried out, the Commissioner is satisfied that the University carried out thorough and adequate searches in order to determine whether any other relevant information was held which would address Mr Henderson's request.The Commissioner is also satisfied that any information that was identified during the further searches that were carried out has been provided to Mr Henderson.

50.The Commissioner is satisfied therefore that the University was correct to provide Mr Henderson with a notice under section 17(1) of FOISA in this case, as he is satisfied that the University did not at the time of Mr Henderson's request (and indeed does not) information which would address his request, with the exception of the information located and provided to (or withheld from) him.

DECISION

The Commissioner finds that the University of Edinburgh acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Henderson.

Appeal

Should either Mr Henderson or the University of Edinburgh wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
3 June 2009

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?..

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

?.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

?.

38Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(2) The first condition is-

?

(b)in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires ?

"data" means information which ?

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,

(b) is recorded with the intention that it should be processed by means of such equipment,

(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system,

(d) does not fall within paragraphs (a), (b) or (c) but forms part of an accessible record as defined in section 68; or

(e) is recorded information held by a public authority and does not fall within any of paragraphs (a) to (d);

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

"public authority" means a public authority as defined by the Freedom of Information Act2000 or a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002;

"relevant filing system" means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.

33A Manual data held by public authorities

(1) Personal data falling within paragraph (e) of the definition of "data" in section 1(1) are exempt from ?

(a) the first, second, third, fifth, seventh and eighth data protection principles,

(b) the sixth data protection principle except so far as it relates to the rights conferred on data subjects by sections 7 and 14,

(c) sections 10 and 12,

(d) section 13, except so far as it relates to damage caused by a contravention of section 7 or the fourth data protection principle and to any distress which is also suffered by reason of that contravention,

(e) Part III, and

(f) Section 55.

Schedule 1 ? The data protection principles

Part I ? The principles

1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a)at least one of the conditions in Schedule 2 is met, and

(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?