Decision 073/2007 Orkney Pre-School and Play Association and Orkney Islands Council
Request for a copy of a Report relating to Orkney Pre-School and Play Association
Applicant: Orkney Pre-School and Play Association
Authority: Orkney Islands Council
Case No: 200501645
Decision Date: 23 May 2007
Kevin Dunion
Scottish Information Commissioner
Request for a copy of a report relating to Orkney Pre-School and Play Association commissioned by Orkney Islands Council ? whether report was exempt under sections 36(2) and 38(1)(b) of the Freedom of Information (Scotland) Act 2002
Relevant Statutory Provisions
The Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General Entitlement); 36(2) (Confidentiality); 38(1)(b), 38(2)(a)(i), 38(2)(b) and 38(5) (Personal information)
The Data Protection Act 1998 (DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1, Part 1, paragraph 1 (The principles) and Schedule 2 condition 6(1) (Conditions relevant for purposes of the first principle: processing of any personal data)
The full text of these sections is set out in the Appendix attached to this decision. The Appendix forms part of this decision.
Facts
Orkney Pre-School and Play Association (the Association) wrote to Orkney Islands Council (the Council) and requested sight of a report in relation to the Association commissioned by the Council from Cannigall Assistance (the Report). The Council refused to supply the Report, on the basis that it was confidential and contained personal information.
The Association subsequently asked the Commissioner to decide whether the Council had dealt with its information request in line with FOISA. Following an investigation, the Commissioner found that the Council had failed to comply with Part 1 of FOISA in withholding the Report and ordered the Council to release the Report to the Association.
Background
1. On 13 January 2005, the Association wrote to the Council requesting a copy of the Report.
2. The Council refused to supply the Association with a copy of Report on the basis that it was confidential information and classed as personal data.
3. The Association requested that the Council carry out a review of its decision to withhold the information on 11 March 2005.
4. The Association subsequently contacted me on 29 April 2005 and requested that I investigate whether the Council had responded to its request in line with the provisions of FOISA. The case was allocated to an investigating officer and the application validated by establishing that the Association had made a request for information to a Scottish public authority and had applied to me only after asking the authority to review its response to its request.
Investigation
5. The officer formally contacted the Council on 11 May 2005 in terms of section 49(3)(a) of FOISA, asking it to comment on the application.
6. In response, the Council upheld its claim that all of the information in the Report was exempt from disclosure under FOISA. At this stage it became clear that the Council was relying on the exemptions contained section 36 (Confidentiality) and section 38 (Personal information) to withhold the information, although the Council had incorrectly referred to section 30 of FOISA rather than section 38.
7. The Council withheld information under the exemption in section 38 on the basis that information contained in the report was personal data and release of the data would breach the data protection principles.
8. Later in the investigation, my Office contacted the Council again, requesting further information relating to its reliance on the exemptions in sections 36 and 38 of FOISA, given that the response from the Council was unclear as to which specific provisions of these exemptions the Council wished to rely on. At the same time, the Council was asked to supply a copy of the Report. When no response was received, an Information Notice was served on the Council in terms of section 50 of FOISA, ordering the Council to provide me with the information I required. (Where a public authority fails to comply with an Information Notice, I have the right to refer the matter to the Court of Session. The Court of Session may choose to investigate the matter and can treat the failure to comply with the notice as contempt of court.)
9. The Council responded to the Information Notice, clarifying that it believed that the exemptions in section 36(2) and 38(1)(b) of FOISA applied to the information requested. It also commented further on why it believed the information to be exempt from disclosure under FOISA.
10. In considering the exemption in section 36, the Council argued that the information was exempt from disclosure because, by disclosing the information requested, it would be laying itself open to an action for breach of confidentiality. The Council said that this was because the information was obtained by the Council from a third party, marked "private and confidential" and "not for publication." The Council therefore took the view that the release of the information by the Council would constitute a breach of confidence actionable by the third party.
11. Further correspondence was entered into with the Council, and the Association clarified a number of points relating to the scope of the request. The Association also provided information as to why it felt the information should be disclosed. I shall address its concerns in my analysis and findings.
12. The Council was contacted again for details of its application of the exemptions contained with sections 36(2) and 38(1)(b) on 18 August 2006. As no response was received, the Council was served with a second Information Notice under section 50 of FOISA on 19 October 2006 compelling it to provide the information.
13. The Council responded to the Information Notice on 9 November 2006. The Council considered that the individuals who had contributed to the report through a series of diagnostic interviews held with Cannigal Assistance would have a right to sue the Council for breach of confidence if the information in the report were to be disclosed. The Council stated that these individuals had been assured that the information which they provided would remain confidential. As evidence of this the Council cited the fact that the Best Value Review was marked "private and confidential" and "not for publication". However, the Council could offer no evidence to show that the individuals had been assured of confidentiality at the time of the interviews.
14. The Council also argued that Cannigall Assistance would have the right to sue the Council for breach of confidence if the Council were to disclose the information. It provided me with the contact details of a representative of Cannigall Assistance to verify whether this was the case. However, the Council was unable to provide any evidence to show that the Council had commissioned the Best Value Review on the basis that it was to remain confidential.
15. Cannigal Assistance was contacted on 13 November 2006 for its comments on whether the information was confidential in nature. In response, it stated that the diagnostic interviews had been carried out on the assumption of confidentiality and that damage would be caused to it as a result of disclosure in that it would not be able to assure interviewees of confidentiality in the future. This would lead to contributors to its work being unable to be candid with it in future, damaging its business interests.
16. Throughout the course of my investigation, the Association has indicated that it believes that it would be in the public interest to release information which the Council hold relating to the Association's functions. It has stated that it believes the report was carried out in an atmosphere of secrecy and that it had no input into its remit or findings. The Association is of the view that as the report in effect determined whether the Association would continue to receive funding from the Council, there is a public interest in knowing its contents.
The Commissioner's Analysis and Findings
Section 38(1)(b) of FOISA: Personal Information
17. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (b) of FOISA, exempts information if it constitutes personal data and the disclosure of the information would contravene any of the data protection principles set down in the Data Protection Act 1998 (DPA). This is an absolute exemption.
18. "Personal data" is defined in section 1(1) of the DPA (see the Appendix for the full definition of personal data). My first task is therefore to consider whether the Report contains any personal data.
19. As noted above, the Council commissioned Cannigal Assistance to review the Association using the principles of a best value review; to examine the functioning of the Association; to identify the future role for the Association in the changing world of voluntary service provision and funding and to make recommendations as to the best way forward for the future. I understand that the Council was one of the main sources of the Association's funding but that, following the publication of the Report, the Council ceased to provide funding for the Association. According to the Association, this has contributed to the eventual demise of the Association's operations in Orkney.
20. In justifying its use of the exemption in section 38(1)(b), the Council has stated that the Report contains personal information relating to individuals, and that to disclose that information would constitute a breach of the data protection principles. Despite having been asked to clarify which of the principles of the DPA would be breached should the information be disclosed, the Council have provided me with no further clarification on the matter. Additionally the Council has not applied this exemption on a partial basis. That is, it has not suggested that any personal data contained within the document are redacted and the remainder of the information released.
21. Cannigall Assistance, the authors of the report, are also concerned about the release of what it views as the personal information in the report. It stated that because the population of Orkney is so small, identification of individuals within that community is much easier than in a larger area. Although Cannigall Assistance considered whether it was possible to redact the Report in order to remove confidential personal information, it had come to the conclusion that this was impossible because, due to the size of the community and the relatively small number of people who had contributed, identification of individuals would be possible.
22. Having read the Report, I take the view that the amount of personal information contained in the Report is exceptionally limited (e.g. paragraph 7 of the foreword lists a number of names and/or job titles of the people who were interviewed by Cannigall Assistance ? although even within that paragraph not all of the descriptions would allow individuals to be identified). The actual report is made up of comments and recommendations from Cannigall Assistance. Given that it does not attribute the reason for making these recommendations to individuals who could be identified from the report, I do not consider that it contains any personal data (except where recommendations are made in relation to a particular person or named post).
23. However, given that I have found that some of the information contained in the Report is personal data, I must now go on to consider whether disclosure of that information would breach any of the data protection principles.
Would release of the information breach the first data protection principle?
24. As noted above, the Council failed to clarify which of the data protection principles it considered would be breached if the Report were to be disclosed to the Association. Having examined the information in question, I am satisfied that the only principle of the DPA which might be relevant to the information withheld is the first principle, which relates to the fair and lawful processing of data. (The first data protection principle is set out in full in the Appendix to this decision.)
25. Having read the report, I am satisfied that none of the personal data in the report is "sensitive personal data" as defined by section 2 of the DPA. I am therefore only required to consider whether the release of the information to the Association would be fair and lawful and whether the release is permitted by a condition contained in Schedule 2 of the DPA.
Fairness
26. In considering the question of whether the release of the personal information would be fair, I have taken into account guidance issued by the Information Commissioner, who is responsible for regulating and overseeing the DPA, and, in particular, his guidance note "Freedom of Information Act Awareness Guidance No 1". This guidance can be read at http://www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/awareness_guidance%20_1_%20personal_information_v2.pdf.
27. As I have noted in previous decisions, this guidance suggests that, in thinking about fairness, it is likely to be helpful to ask whether the information relates to the private or public lives of the individual. Except in the case of one single interviewee, I am satisfied that the personal data in the Report is the personal information of people acting in their professional capacity. In the majority of cases, the people who have been interviewed were employed by or worked for either the Council or the Association.
28. The guidance from the Information Commissioner referred to in paragraph 26 suggests that information which is about the home or family life or an individual, his or her personal finances, or consists of personal references is likely to deserve protection. By contrast, information which is about someone acting in their official or work capacity should normally be provided on request unless there is some risk to the individual concerned.
29. Having taken into account the actual information which has been withheld, the fact that they were acting in a professional capacity and the fact that comments have not been attributed to any individual, I find that the release of the personal information is fair.
Lawfulness
30. The first data protection principle also states that the release of information must be lawful. Disclosure of the information would be unlawful if the release would lead to a breach of confidence or there is a law forbidding disclosure.
31. Both the Council and Cannigal Assistance have argued that the release of the information would lead to a breach of confidence. I consider these arguments in some below when I consider the Council's reliance on the exemption in section 36(2). However, for the reasons given below, I do not consider that the disclosure would be a breach of confidence. Nor am I aware of any other law which forbids disclosure (and no such law has been brought to my attention by the Council in any event). Consequently, I am satisfied that the release of the personal information would be lawful.
32. Although I have found that the release of the information would be both fair and lawful, I must also consider whether there are any conditions in Schedule 2 to the DPA which would permit the processing. I take the view that in this case condition 6 is the only such condition which could be considered to apply. Condition 6 is set out in full in the Appendix to this decision.
33. I must apply a number of tests to establish whether condition 6 supports disclosure of the limited personal data in this case. The first test is whether it can be established that the third party/parties to whom the data would be disclosed has/have a legitimate interest in the processing of the personal data (in this case by disclosure to a member of the public) to which the request relates. The second is whether the processing is necessary for the purposes of those legitimate interests. The third is whether that processing can be seen to be unwarranted in this particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. Both competing interests must then be balanced.
34. In considering the first test, I accept that the Association, which was after all the subject of the Report, has a legitimate interest in gaining access to the full version of the Report. As noted above, the Association has commented that, in effect, the Report determined whether it would continue to receive funding from the Council. More generally, I consider that there is a legitimate interest in people being able to find out why public authorities have made certain decisions about the funding of bodies in their area. I find, therefore, that the first test in condition 6 can be fulfilled.
35. In considering the second test, with regard to whether disclosure is necessary for the purposes of the legitimate interests identified above, I have considered whether these interests might be met equally effectively by any alternative means. In all the circumstances, I have concluded that the legitimate interests in question cannot be met without disclosure of the Report and therefore that disclosure of this data is necessary for the purposes of the legitimate interests.
36. In considering the third test, I am required to balance what I consider to be a legitimate interest in accessing the information against the rights of those individuals named in the Report (or in many cases against the rights of those individuals whose job titles have been included in the Report).
37. As I have made clear above, any personal information in the Report is extremely limited. Most of the individuals are referred to by their job titles, rather than by name. In all but one case, the individuals are acting in their professional capacity. Comments have not been attributed to individuals. I have also considered that statement from Cannigall Assistance that the individuals who were interviewed would not have expected the Report to be made public. However, while Cannigall Assistance may have assured interviewees that comments would not be directly attributed to them (this much is clear from the Report), I have been to uncover any proof that the interviewees were told that the Report itself would not be made public.
38. In weighing up these two competing issues, I have therefore come to the conclusion that the processing is necessary for the purposes of legitimate interests pursued by the third parties to whom the information data is to be disclosed and that the processing is not unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. those people named in or referred to in the Report).
Section 36(2) of FOISA: Confidentiality
39. The Council also argued that the whole of the Report was exempt In terms of section 36(2) of FOISA. In terms of section 36(2), information is exempt if it was obtained by a Scottish public authority from another person and if disclosure by the authority to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or any other person.
40. There is a two stage test which must be fulfilled before this exemption can be relied upon. Firstly, the information must have been obtained by a Scottish public authority from another person. "Person" is defined widely and means another individual, another Scottish public authority or any other legal entity, such as a company or partnership: since the report was provided to the Council by an independent consultant, the first part of this test can be fulfilled.
41. The second part of the test is that disclosure of the information by the public authority must constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person. Although there was no discussion about the meaning of the word "actionable" when the Freedom of Information (Scotland) Bill was being considered in Parliament, I take the view that actionable means that the basic requirements for a successful action must appear to be fulfilled.
42. There are three main requirements which must be met before a claim for breach of confidentiality can be established. These are:
- the information must have the necessary quality of confidence;
- the public authority must have received the information in circumstances from which an obligation on the authority to maintain confidentiality could be inferred; and
- there must be a disclosure which has not been authorised by the person who communicated the information but which would cause damage to that person.
Necessary quality of confidence
43. Having considered the terms of the Report, I am satisfied that it the information contained in the report is not common knowledge. Indeed, it could not be readily obtained by the Association through any other means. However, the fact that the Report was being compiled was common knowledge and I understand that the draft report was discussed with members of the Board of the Association. While I accept that the final Report expresses views and makes recommendations which would be sensitive, I am not satisfied that the Report itself has the necessary quality of confidence.
Obligation to maintain confidentiality
44. A public authority may be under an obligation to maintain confidentiality where the information was disclosed to the authority with an express statement that the information should be kept confidential, or where an obligation to maintain confidentiality can be inferred from the circumstances.
45. The Report consists of Cannigal Assistance's recommendations for the future of the Association. It arrived at these recommendations by conducting a series of diagnostic interviews with people who had an interest in the Association at the time. The Council argued that the individuals concerned had taken part in the interviews on the basis that the subsequent report would be confidential, and that Cannigal produced the Report on the understanding that it was confidential.
46. Both the Council and Cannigall Assistance has referred to the fact that the Report is marked "private and confidential" and "not for publication" as evidence of that there is an obligation to maintain confidentiality. Neither the Council nor Cannigall could not provide any documentary evidence to show that the Report was commissioned on the basis that its contents would remain confidential.
47. In guidance which I have published on the exemption in section 36(2) (http://www.itspublicknowledge.info/legislation/briefings/section36.htm), I make it clear that the inclusion of such statements within a document does not automatically impose an obligation of confidentiality. A great deal of correspondence is marked "private and confidential" etc., but this does not mean that it is in fact automatically confidential. The information must still pass the three tests set out in paragraph 42 above in order for the exemption to apply.
48. As noted earlier, the confidentiality assurances given to individuals by Cannigall Assistance appears to be more to do with not attributing or identifying comments or views provided to individuals and it may well be that assurances that the Report would remain confidential may have been outwith the scope of the assurances which they could or should have given. After all, the report was commissioned by the Council and it is difficult to see how a consultant carrying out a task commissioned by the Council, paid for by the Council, could then determine who can see the Report and how it could be used.
49. Having considered the arguments put to me by both the Council and Cannigall Assistance, I cannot accept that there is an obligation to maintain confidentiality in respect of the Report.
Unauthorised disclosure which would causing damage
50. The third requirement is that there must be a disclosure which has not been authorised by the person who communicated the information, but which would cause damage to that person.
51. During the investigation, I have been advised that should the Report be published, it is likely that an action for breach of confidence will be raised against the Council either by Cannigall Assistance or by the people who ere interviewed for the Report. It was argued that Cannigall Assistance's business would be damaged because it would no longer be able to assure future contributors to its consultancy work of confidentiality. It was also argued that those who had been interviewed for the Report would sue the Council because they had been assured of confidentiality.
52. I will consider firstly Cannigall Assistance's concerns over the loss of its business as a result of disclosure of the information. While I accept that it has concerns, I do not accept that disclosure of the Report in this case would mean that its future work would be impeded as it would not be able to guarantee confidentiality to future contributors. Each piece of work undertaken should be assessed for confidentiality on its own merit. Presumably in future Cannigall Assistance will consider carefully the implications that FOISA has on its ability to ensure confidentiality to its contributors, particularly where it is working with public authorities, and make amendments to its working practices to reflect this. However, any changes to its working practices would be as a result of freedom of information legislation coming into force, and not as a result of damage caused by this review in particular being released.
53. I have also considered the question of damage or loss to the interviewees. As I have made it clear most are not identified by name and some are not identifiable. Where they are identifiable it is important to remember that most were interviewed in their official capacity. In the majority of cases, the interviewees are either employees of the Council (acting as Council employees) or people who were employed by or who worked for the Association or representatives of national organisations. I find it hard to believe that any action would be taken (and subsequent damage caused to the Council), particularly, as I have made clear above, there are no comments or opinions attributable to any of the interviewees or transcripts of interviews.
Conclusion
54. For the reasons set out above, I find that while the information was obtained by the Council from a third party, its disclosure would not constitute a breach of confidence actionable by that third party or any other person. I therefore find that the Report is not exempt in terms of section 36(2) of FOISA.
Decision
I find that the Council incorrectly applied the exemptions in sections 36(2) and 38(1)(b) of FOISA to the Report. In doing so, it failed to comply with Part 1 of FOISA in that it breached section 1(1).
I now require the Council to disclose the Report to the Association within 45 calendar days of receipt of this decision.
Appeal
Should either the Association or the Council wish to appeal my decision there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 calendar days of receipt of this notice.
Kevin Dunion
Scottish Information Commissioner
23 May 2007
APPENDIX
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
36 Confidentiality
(2) Information is exempt information if ?
(a) it was obtained by a Scottish public authority from another person (including another such authority); and
(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded ?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act ?
Data Protection Act 1998
Basic interpretative provisions
1. (1) In this Act, unless the context otherwise requires-
?
"personal data" means data which relate to a living individual who can be identified-
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
Schedule 1 The data protection principles: Part I The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 Conditions relevant for purposes of the first principle: processing of any personal data
6.(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
