Decision 068/2010 Mr Ellis Thorpe and Aberdeenshire Council Information relating to the actions of a Councillor Reference No: 200901322 Decision Date: 17 May 2010

Summary

Mr Thorpe requested from Aberdeenshire Council (the Council) information relating to an incident involving a named Councillor.The Council responded by stating that the information was exempt from disclosure under sections 38(1)(b) (Personal information) and 30(b) and (c) (Prejudice to effective conduct of public affairs). Following a review, Mr Thorpe remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, during which the Council withdrew its previous reliance upon sections 30(b) and (c) of FOISA, the Commissioner found that the Council had failed to deal with Mr Thorpe's request for information in accordance with Part 1 of FOISA.He concluded that the Council had incorrectly applied the exemption in section 38(1)(b) of FOISA to the information withheld, and required disclosure of that information to Mr Thorpe.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of " the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles - the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 1 May 2009, Mr Thorpe wrote to the Council requesting all relevant information regarding an incident involving Councillor Ian Tait (the Councillor), which was referred to in an enclosed press report.

2.The incident had led to a complaint being submitted to the Council regarding the behaviour of the Councillor at a meeting of Fraserburgh Community Development Group.A report was subsequently made to and considered by the Council's Conduct Committee, resulting in the Councillor receiving a six month suspension which prevented him from attending Council meetings other than the full Council for that period.

3.What was said by the Councillor, and the nature of the complaint, is not publicly known as a standing order prevents anyone involved in the incident, including the Councillor, from revealing the details.

4.The Council sought clarification of Mr Thorpe's request on 13 May 2009.Mr Thorpe provided clarification on 22 May 2009, stating that the information he sought was what the Councillor was alleged to have said to Council staff and voluntary workers, and whether the same was said to both of these groups.

5.The Council responded on 9 June 2009. In this response, the Council informed Mr Thorpe that the information was exempt from disclosure under sections 30(b) and (c) and 38(1)(b) of FOISA.

6.On 11 June 2009, Mr Thorpe wrote to the Council, requesting a review of its decision. Mr Thorpe was not satisfied that the information in question was personal data or that the Council had applied the exemptions correctly.

7.The Council notified Mr Thorpe of the outcome of its review - which was to uphold the original decision without amendment - on 7 July 2009.

8.On 22 July 2009, Mr Thorpe wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

9.The application was validated by establishing that Mr Thorpe had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

10.On 27 July 2009, the Council was notified in writing that an application had been received from Mr Thorpe and was asked to provide the Commissioner with any information withheld from him. The Council responded with the information requested as it appeared within documents held by the Council and the case was then allocated to an investigating officer.

11.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested by Mr Thorpe.

12.In response, the Council provided submissions with respect to the application of the exemption in section 38(1)(b) of FOISA.It advised that it no longer sought to apply any other exemptions to the information under consideration.

13.The Council's initial submissions considered the information withheld insofar as it was the personal data of the Councillor.Since most of the information it held relating to what the Councillor was alleged to have said was contained within witness statements from attendees at the meeting concerned, the Council was asked during the investigation to comment also on this information insofar as it was considered to be the personal data of the third parties concerned.

14.Mr Thorpe was also invited to provide comments on this case, particularly to assist the Commissioner's consideration of his legitimate interests in respect of the requested information.

Commissioner's analysis and findings

15.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Thorpe and the Council and is satisfied that no matter of relevance has been overlooked.

16.As noted above, when clarifying his request, Mr Thorpe indicated that he wished to know what the Councillor was alleged to have said to workers at a meeting where the relevant incident occurred.The withheld information in this case is contained within the Council's Conduct Committee report and consists of three separate excerpts from this report which indicate what was said by the Councillor in:

an excerpt from the original letter of complaint to the Council

excerpts from two witness statements from people who attended that meeting.

17.As noted above, the Council submitted that it wished to rely on section 38(1)(b) of FOISA in withholding this information.

Background information

18.The Council provided background information about the incident involving the Councillor.A complaint was made by a member of a local community development group about the Councillor's behaviour at a public meeting of that group.This complaint was investigated by the Council's Director of Law and Administration, whose investigations included taking witness statements in line with the Council's procedures.This investigation informed the report submitted to the Council's Conduct Committee.

19.The Council submitted that the Conduct Committee proceedings are analogous to an employee being taken to a disciplinary hearing by their line manager, and that there is an expectation that details of such a hearing would remain personal and private.In addition, the Council submitted that the witness statements taken (which contain the only record of what was alleged to be said by the Councillor in question) are, in effect, examples of whistleblowing.It argued that such statements need to be protected from disclosure to avoid discouraging others from coming forward in the future.

Personal data ? section 38(1)(b) of FOISA

20.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)) exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

21.The Council has withheld the information under section 38(1)(b) of FOISA, arguing that it is personal data, the disclosure of which would contravene the first data protection principle.

Is the information personal data?

22.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

23.In its submissions to the Commissioner, the Council argued that the information under consideration is the personal data both of the Councillor, and of the individuals providing the information about the meeting to the Council.

24.The nature of the information withheld and under consideration falls into two distinct categories.Firstly, there is a record of what was reported to have been said by the Councillor contained within the letter of complaint to the Council and, secondly, there are two records of what was reported to have been said, contained within the witness statements.

25.The Commissioner is satisfied that the information is entirely the Councillor's personal data.The information relates to him, and he can be identified from this information and other information in the possession of the data controller.

26.The Commissioner has also considered whether the information can be considered to be the personal data of the person making the complaint, and of the two witnesses who provided this information to the Council.

27.The Commissioner has first of all noted that the writer of the letter of complaint to the Council indicated that the complaint was being made on behalf of the Community Development Group ? i.e. not as an individual.Within this context, the Commissioner does not consider this information relates to a living individual, but, rather to the Community Development Group as a body.

28.As the views that are expressed are claimed to be those of the Group and not attributed to any individual, the Commissioner does not accept that this information relates to any particular individual who can be identified from this data or from this data and other information which is in the possession, or is likely to come into the possession of the Council (which is the data controller in this case).

29.However, in the event that the Commissioner is wrong as to whether this information is the personal data of the person who sent the letter to the Council, he will go on to consider whether disclosure of the information would breach the first data protection principle insofar as the information is the personal data of that person.

30.With respect to the two excerpts from witness statements, the Commissioner notes that, when read in isolation, the information cannot be attributed to any person, nor would it necessarily indicate that this was the recollections of a person giving a statement.

31.The Commissioner does not accept that the recollections of the witnesses that are under consideration in this case are necessarily their own personal data, in that they arguably are not expressions of the opinions of the witnesses, but simply statements of (what they recall of) the events at the meeting.

32.However, whether or not this recollection should be considered to be an expression of an opinion by an identifiable individual, the Commissioner is aware that this recollection was expressed in the wider context of the witness statements, made by living individuals who are identifiable from the data therein (and other information) in the possession of the Council.

33.The Commissioner accepts that it is at least arguable that the information which has been extracted from these statements is personal data.As a result, he has proceeded on the basis that it is the personal data of the individuals who made the statements.

34.In determining whether the exemption in section 38(1)(b) of FOISA has been properly applied in this case, it will therefore be necessary to consider whether disclosure of the information would contravene the first data protection principle insofar as it relates to the Councillor, and also insofar as it relates to the witnesses.He will address these matters in turn below.

The First Data Protection Principle

35.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.

36.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and he is satisfied that the personal data in this case does not fall into this category.It is therefore not necessary to consider the conditions in Schedule 3 of the DPA in this case.

37.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

38.Given that the Commissioner has decided to proceed on the basis that the information under consideration is the personal data of more than one data subject, the tests of fairness, lawfulness and whether a schedule 2 condition applies, would need to be met in relation to each of the data subjects before processing could be judged to be compliant with the first data protection principle.

The Councillor's personal data

39.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed insofar as it is the Councillor's personal data.If any of these conditions can be met, he must then consider whether the disclosure of the Councillor's personal data would be fair and lawful.

Can any of the conditions in Schedule 2 of the DPA be met?

40.The Commissioner has first considered whether any of the Schedule 2 conditions might be met where they are considered in relation to the Councillor's own personal data.

41.The Commissioner has considered condition 1 which provides that the data subject has given his consent to the processing.The Commissioner has noted that the Councillor has been quoted in newspaper articles, declaring that he wishes all information relating to the event to be placed into the public domain.However, the Councillor's consent to disclosure has not been sought by the Council in relation to the particular information under consideration in this case.Notwithstanding the Councillor's public comments, therefore, the Commissioner has proceeded on the basis that the Councillor's consent to disclosure of this particular information, isolated from other information held by the Council about the event, has not been given and cannot be assumed.The Commissioner therefore concludes the condition 1 has not been met in this case.

42.The Commissioner considers that only condition 6(1) of Schedule 2 of the DPA might otherwise be considered to apply in this case.Condition 6(1) allows personal data to be processed (in this case, disclosed in response to Mr Thorpe's information request) if disclosure of the data is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.

43.There are therefore a number of tests which must be met before condition 6(1) can apply:

Does Mr Thorpe have a legitimate interest in having this personal data?

If so, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?

• Even if disclosure is necessary for Mr Thorpe's legitimate interests, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?This will involve a balancing exercise between the legitimate interests of Mr Thorpe and those of the data subjects.Only if the legitimate interests of Mr Thorpe outweigh those of the data subjects can the personal data be disclosed.

44.Mr Thorpe submitted that it is in the public interest that what was alleged to have been said by the Councillor, which resulted in the suspension of an elected member, to be placed into the public domain.Mr Thorpe submitted that until the public know what the Councillor said they are unable to exercise any democratic judgement, and openness and accountability are undermined.

45.The Commissioner is satisfied that the events surrounding the complaint against the Councillor are a matter of public interest, and that Mr Thorpe has a legitimate interest in obtaining the information he has requested.

46.The Commissioner then considered whether disclosure of the information was necessary to achieve Mr Thorpe's legitimate interests and concluded that, given the nature of the information requested and the circumstances of the case, there was no other way of achieving these.Therefore he is satisfied that processing (via disclosure) would be necessary for the legitimate interest identified.

47.The Commissioner finally considered whether disclosure of the personal data requested would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the Councillor.

48.The Council has indicated that it considers that it would be unfair to disclose into the public domain information which some people might consider would reflect badly upon the Councillor.The Commissioner accepts that disclosure in this case would reveal what was said by the Councillor in events that led to him being censured by the Council, and might be expected to lead people to consider whether the Councillor's behaviour was appropriate or not.

49.However, given that the Councillor has publicly declared that he wishes all information relating to the event to be placed into the public domain, the Commissioner has difficulty in concluding that such a disclosure would be contrary to his wishes or expectations, or would cause unwarranted prejudice to his rights and freedoms or his legitimate interests.

50.Furthermore, the Commissioner notes that the events that led to the complaint against the Councillor took place in a public meeting and so any person who chose to attend could have witnessed what was said.

51.In the circumstances, the Commissioner has concluded that Mr Thorpe's legitimate interest (which is shared by the general public) in understanding the circumstances that led to the suspension of the Councillor outweighs those of the Councillor in this case.

52.The Commissioner has therefore found that condition 6 can be met in this case insofar as the information under consideration is the personal data of the Councillor.

53.Having reached this conclusion, the Commissioner has gone on to consider whether (as required by the first data protection principle) disclosure would also be fair and lawful insofar as it is the personal data of the Councillor.

54.The Commissioner considers that disclosure would be fair, for the reasons already outlined in relation to condition 6.The Council has not put forward any arguments as to why the disclosure of the information would be unlawful (other than in terms of a breach of the data protection principles) and, in any event, the Commissioner can identify no reason why disclosure should be considered unlawful.

55.The Commissioner therefore finds that the Council was wrong to withhold the information under consideration insofar as it is the personal data of the Councillor under the exemption in section 38(1)(b) of FOISA.

Personal data of the witnesses

56.The Commissioner will now consider whether the information was correctly withheld in terms of section 38(1)(b) of FOISA insofar as it is the personal data of other third parties.Again, this involves considering whether disclosure would contravene the first data protection principle.

57.As noted above, the Commissioner is proceeding on the basis that the information provided within witness statements is the personal data of the witnesses.

58.Determining whether disclosure would contravene the first data protection principle again requires consideration of its three separate aspects: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.

59.The Commissioner will therefore now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed insofar as it is (or is here being considered as if it is) the personal data of a witness or the person who made the complaint.If any of these conditions can be met, he must then consider whether the disclosure of the information would be fair and lawful.

Can any of the conditions in Schedule 2 of the DPA be met?

60.The Commissioner has first considered whether any of the Schedule 2 conditions might be met where they are considered in relation to the witnesses and the person who made the complaint to the Council.

61.The Commissioner notes that consent to disclosure has not been sought by the Council from any of the individuals concerned, and so the first condition cannot be met.

62.The Commissioner again considers that only condition 6(1) of Schedule 2 of the DPA might be considered to apply.

63.The tests which the Commissioner is required to consider in respect of this information are set out in paragraph 43 above.The Commissioner concluded in paragraphs 44 and 45 (when considering the withheld information insofar as it is the personal data of the Councillor) that, firstly, Mr Thorpe has a legitimate interest in obtaining this information and, secondly, this processing (via disclosure) is necessary for the legitimate interests identified.These conclusions are applicable also when the information is considered insofar as it is the personal data of the witnesses and the person who wrote the letter of complaint to the Council.

64.The Commissioner must now consider whether disclosure of the personal data requested would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the witnesses who provided the statements and of the person who wrote the letter of complaint to the Council.

65.The Council advised the Commissioner that the witnesses' statements were recorded as part of a Conduct Committee report and that there was an expectation implicit in the proceedings that such information would remain confidential.It maintained that disclosure would cause damage or distress to the data subjects.

66.When asked for further evidence as to the expectations of confidentiality, the Council submitted that its whistleblowing policy assures employees that confidentiality will be respected as far as practical, and that the witnesses concerned would therefore have expected the statements to have limited circulation in the context of the Council's investigation of the case, and would certainly not have expected them to be made available to the general public.

67.The Council also argued that its whistleblowing policy assures employees that it is safe and acceptable for them to raise concerns and that there will be respect of confidentiality as far as practicable, allowing the possibility that material may have to be disclosed as part of a legal action, but the default position is to assure confidentiality.

68.The Council confirmed during the course of the investigation that it had not sought consent for disclosure from the parties in question on the basis that it believed strongly that it is important to preserve the principle of confidentiality in relation to whistleblowing and it does not want that principle watered down.

69.The Commissioner acknowledges and accepts the importance of the principle of confidentiality in relation to a whistleblowing policy.However, having reviewed the Council's policy, he notes that it does not relate to general complaints, particularly those made by a third party, but relates to circumstances in which employees report malpractice or maladministration within the Council.The Commissioner does not accept that either the person making the complaint, or those persons who were asked to provide witness statements as part of the investigation of the complaint, were acting as "whistleblowers" in line with this policy.

70.Nonetheless, the Commissioner does accept that the witnesses and the writer of the letter of complaint were likely to have expected that the content of their correspondence and statements would be held in confidence by the Council, irrespective of whether they were invoking or acting in line with the Council's whistleblowing policy.

71.The Commissioner accepts that disclosure of this information would involve a degree of intrusion into the lives of these individuals, but considers this to be limited by the fact that disclosure would not reveal with any certainty which person had reported what had been said by the Councillor - Mr Thorpe requested only the record of what was allegedly said by the Councillor rather than the names of those who recounted the event.

72.After weighing Mr Thorpe's legitimate interests against those of the witnesses, the Commissioner has found that Mr Thorpe's legitimate interest and the wider general interest in accountability and transparency in the information outweighs the rights and freedoms or legitimate interests of the witnesses (which he considers to be minimal in this case, given the non-attributable form in which the information can be provided to Mr Thorpe).He therefore accepts that disclosure in this case would not be unwarranted.

73.The Commissioner has therefore found that condition 6 can be met in this case insofar as the information under consideration is the personal data of the witnesses.He also considers condition 6 could be met in relation to the information provided within the letter of complaint to the Council if this information were found (contrary to the Commissioner's views) to be the personal data of the writer of that letter.

74.Having reached this conclusion, the Commissioner has gone on to consider whether (as required by the first data protection principle) disclosure would also be fair and lawful insofar as it is the personal data of the witnesses and the writer of the letter of complaint.

75.The Commissioner considers that disclosure would be fair, for the reasons already outlined in relation to condition 6.The Council has not put forward any arguments as to why the disclosure of the information would be unlawful (other than in terms of a breach of the data protection principles) and, in any event, the Commissioner can identify no reason why disclosure should be considered unlawful.

76.The Commissioner therefore finds that the Council was wrong to withhold the information under consideration insofar as it is the personal data of the witnesses and of the writer of the letter of complaint under the exemption in section 38(1)(b) of FOISA.

DECISION

The Commissioner finds that Aberdeenshire Council (the Council) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Thorpe.The Commissioner found that the Council wrongly applied the exemption in section 38(1)(b) of FOISA to the information withheld, and, in doing so, breached section 1(1) of FOISA.

The Commissioner requires the Council to supply Mr Thorpe with the information contained in the Conduct Committee Report, insofar as it falls within the scope of Mr Thorpe's request, by 2 July 2010.

Appeal

Should either Mr Thorpe or Aberdeenshire Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
17 May 2010

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6)This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?