Decision 065/2017: Mr Lindsay Clark and the Scottish Fire and Rescue Service Job evaluation Reference No: 201602284 Decision Date: 4 May 2017 Summary Mr Clark asked the SFRS for information relating to his job evaluation. The SFRS withheld some of the information requested on the basis that it was exempt in terms of section 33(1)(a) and 36(2) of FOISA. The Commissioner found that while the SFRS had identified all of the information requested, it was not entitled to withhold information under the exemptions applied originally (which it withdrew during the investigation). She accepted, however, that the SFRS was entitled to withhold the information as the applicant's own personal data.

  Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), 1(4) and (6) (General entitlement); 2(1)(a) and (2)(e)(i) (Effect of exemptions); 33(1)(a) (Commercial interests and the economy); (36)(2) (Confidentiality); 38(1)(a) (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data")

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

All references in this decision to "the Commissioner" are to Margaret Keyse, who has been appointed by the Scottish Parliamentary Corporate Body to discharge the functions of the Commissioner under section 42(8) of FOISA.

  Background

1. On 29 September 2016, Mr Clark made a request for information to the Scottish Fire and Rescue Service (the SFRS). He stated that following receipt of a letter providing him with the outcome of his job evaluation appeal, he was writing to request information held regarding the appeal. He specified:

(a) sifting notes from panels;

(b) reasons for any rejection of factors to be heard at hearing;

(c) individual panel members' notes at hearing;

(d) typed minutes of hearing;

(e) reasons for rejected factors following hearing;

(f) system software audit trail of question/answer;

(g) all notes in relation to decision making on answer set;

(h) any other information & emails held with regard to my role within the process.

2. The SFRS responded on 8 November 2016. It explained that it had responded separately regarding those aspects of his request it had treated as a Subject Access Request under the DPA. Within that SAR response, the SFRS explained that as some of the information requested was considered to be Mr Clark's own personal data, it was considered exempt from disclosure in terms of section 38 of FOISA.

3. The SFRS stated that it had treated parts (c), (d), (f) and (h) of his requested under FOISA, as the information requested there was not considered to be his personal data. It provided information covered by parts (c), (d) and (h) and informed Mr Clark that it considered the information held in relation to part (f) to be exempt from disclosure in terms of sections 33(1)(a) and 36(2) of FOISA. It provided reasons for applying these exemptions.

4. On 12 December 2016, Mr Clark wrote to the SFRS requesting a review of its decision, on the basis that he did not accept that all the information covered by part (f) should be withheld. He also submitted that had not been provided with all the information held In relation to parts (d) and h) of his request.

5. The SFRS notified Mr Clark of the outcome of its review on 14 December 2016. It upheld the original response without modification.

6. On 14 December 2016, Mr Clark wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Clark stated he was dissatisfied with the outcome of the SFRS's review because he disagreed that the information should be withheld and believed not all the information requested had been provided.

  Investigation

7. The application was accepted as valid. The Commissioner confirmed that Mr Clark made a request for information to a Scottish public authority and asked the authority to review its response to parts (d), (f) and (h) of that request (the only parts whose handling he challenged under FOISA) before applying to her for a decision.

8. On 19 January 2017, the SFRS was notified in writing that Mr Clark had made a valid application. The SFRS was asked to send the Commissioner the information withheld from Mr Clark. The SFRS provided the information withheld, entitled. "Overview Question Trace" and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SFRS was invited to comment on Mr Clark's application, and to answer specific questions in relation to its handling of his request, focusing on identifying and locating of information held and the application of sections 33(1)(a) and 36(2) of FOISA.

10. The SFRS responded on 30 March 2017. It informed the Commissioner that in considering part (f) of Mr Clark's request, it had initially interpreted it as a request for the entire question and answer bank contained within the relevant software. It explained that it had withheld this information to protect the intellectual property rights of the company which had provided the system

11. The SFRS now accepted that Mr Clark had only requested the questions and answers held within the system as they related to his personal appeal and the evaluation of his own post.

12. The SFRS informed the Commissioner that it no longer wished to rely on sections 33(1)(a) or 36(2) of FOISA. It now considered the withheld information comprised Mr Clark's own personal data and so fell within section 38(1)(a) of FOISA. It confirmed the information had been provided to Mr Clark on a personal basis. Mr Clark acknowledged receipt of the information.

  Commissioner's analysis and findings

13. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Clark and the SFRS. She is satisfied that no matter of relevance has been overlooked.

Interpretation of the request and information held

14. The Commissioner notes that in submitting his request for information, Mr Clark made reference to the outcome of his own job evaluation appeal, requesting information relating to that appeal.

15. The Commissioner is satisfied that Mr Clark did not seek the entire question and answer bank contained within the software system, as the SFRS understood originally, but only the questions and answers in the system as a result of the job evaluation exercise pertaining to him.

16. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable in this case.

17. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information an applicant believes the authority should hold, although the applicant's reasons may be relevant to the investigation of what is actually held.

18. In its submissions to the Commissioner, the SFRS confirmed where any information held in relation to parts (d), (f) and (h) of Mr Clark's request was held. It explained the searches and enquiries it undertook to ascertain whether it held any information falling within the scope of Mr Clark's request, detailing the places searched and the scope of the searches. These included searches of relevant electronic and paper records by the staff members responsible for the information in question. The SFRS provided supporting evidence confirming the outcomes of its searches.

19. Having considered all relevant submissions and the terms of Mr Clark's request, the Commissioner is satisfied that the SFRS carried out adequate searches with a view to identifying and locating the information requested by Mr Clark. She is satisfied that Mr Clark was provided with all of the relevant information located by the SFRS which fell within parts (d) and (h) of his request. Consequently, the Commissioner is satisfied that, in regard to the matters raised in Mr Clark's application regarding parts (d) and (h) of his request, the SFRS complied with section 1(1) of FOISA.

20. In relation to part (f) of Mr Clark's request, the SFRS explained the process required to extract the required information from the job evaluation system. Doing so in relation to Mr Clark's appeal produced the Overview Question Trace report relative to his appeal. This includes the questions asked and the answers provided and, having compared it with the information contained in the outcome of Mr Clark's job evaluation appeal, the Commissioner is satisfied that it contains all the information covered by part (f) of his request.

Section 33(1)(a) - Commercial interests and the economy

21. Section 33(1)(a) of FOISA is set out in full in Appendix 1. As mentioned above, the SFRS withdrew its reliance upon section 33(1)(a) of FOISA. In the absence of submissions from the SFRS, the Commissioner must conclude that the information in question was not exempt from disclosure under section 33(1)(a) of FOISA.

Section 36(2) - Confidentiality

22. Section 36(2) of FOISA is set out in full in Appendix 1. As mentioned above, the SFRS withdrew its reliance upon section 36(2) of FOISA. In the absence of submissions from the SFRS, the Commissioner must conclude that the information in question was not exempt from disclosure under section 36(2) of FOISA.

Section 38(1)(a) - Personal information

23. Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject. The fact that it is absolute means that it is not subject to the public interest test set out in section 2(1) of FOISA.

24. This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a "Subject Access Request") under section 7 of the DPA. The DPA will therefore usually determine whether a person has a right to their own personal data, and govern the exercise of that right. Crucially, it provides for access by the data subject (the person to whom the data relate) alone, rather than (as under FOISA) to the world at large. Section 38(1)(a) of FOISA does not deny individuals a right to access to information about themselves, but ensures that the right is exercised (subject to appropriate safeguards) under the DPA and not under FOISA.

25. Personal data are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified: a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

26. In its submissions to the Commissioner, the SFRS acknowledged that it considered the information requested by Mr Clark (in part (f) of the request) to be his own personal data.

27. The Commissioner has considered the submissions received from both the SFRS and Mr Clark. She has also considered the content and context of the request and the information identified, located and provided during the investigation. It is apparent that any information held and falling within the scope of part (f) of the request would relate to Mr Clark and his own personal circumstances, and therefore would be his own personal data. In all the circumstances, therefore, the Commissioner is satisfied that the SFRS was entitled to withhold the information under section 38(1)(a) of FOISA.

28. It is apparent, however, that the SFRS did not restrict its interpretation of part (f) to that information in responding to Mr Clark. The broader interpretation it applied failed to identify the correct information as covered by the request and led to the inappropriate application of other exemptions as detailed above. This was a failure to comply fully with section 1(1) of FOISA in responding to the request.

29. The Commissioner does not require the SFRS to take any action in relation to this application.

Decision The Commissioner finds that the Scottish Fire and Rescue Service (the SFRS) partially failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Clark. She is satisfied that in responding to parts (d) and (h) of Mr Clark's request, the SFRS complied with Part 1. She finds, however, that the SFRS wrongly applied section 33(1)(a) and 36(2) of FOISA to the information it withheld from Mr Clark, as a result of interpreting part (f) of the request too broadly. In these respects, the SFRS failed to comply with section 1(1) of FOISA. Given that the Commissioner accepts that the information held falls to be exempt from disclosure under section 38(1) (a) of FOISA, she does not require the SFRS to take any action in respect of these failures, in response to Mr Clark's application.

Appeal

Should either Mr Clark or the SFRS wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Acting Scottish Information Commissioner
4 May 2017

 Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

...

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

(i) paragraphs (a), (c) and (d); and

…

33 Commercial interests and the economy

(1) Information is exempt information if-

(a) it constitutes a trade secret; or

…

36 Confidentiality

…

(2) Information is exempt information if-

(a) it was obtained by a Scottish public authority from another person (including another such authority); and

(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…