Decision 077/2011 Dr Sandy Spowart and the Scottish Ministers SPUR and SMART: SCOTLAND grants Reference No: 201001676 Decision Date: 20 April 2011

Summary

Dr Spowart requested from the Scottish Ministers (the Ministers) specified information relating to certain SPUR and SMART: SCOTLAND grants. While providing an explanation in relation to one point, the Ministers withheld the majority of the requested information under exemptions in section 33(1)(b) of FOISA (which relates to commercial interests) and section 38(1)(b) of FOISA in relation to personal data.Following a review, Dr Spowart remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, during which the Ministers indicated they also considered the withheld information to be confidential and therefore exempt under section 36(2) of FOISA, the Commissioner found that the Ministers were entitled to withhold the information under the exemptions in sections 36(2) and 38(1)(b) of FOISA.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1), (2)(c) and (2)(e)(ii) (Effect of exemptions); 36(2) (Confidentiality) and 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of (the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles - Part I: The principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.

Background

1.SMART: SCOTLAND is a Government Initiative which provides financial assistance to individuals and to small to medium-sized enterprises to help support development projects which represent a significant technological advance for the relevant UK sector or industry.SPUR grants were among the predecessors to the current SMART: SCOTLAND grants.

2.The information requested in this case relates in part to the process of payment of the grant, which involves the submission of claims and relative reports as the project progresses to completion.These are assessed, with a view to payment of the grant by instalments.

3.On 22 June 2010, Dr Spowart wrote to the Scottish Ministers requesting the following information:

a) Copies of all claims and reports submitted under SPUR 04/037 and SPUR 06/024

b) In relation to each of three specified SMART awards:

full technical abstract

all claims and reports

CVs of all staff involved in these projects, both within the companies concerned and any partner companies

CVs of Scottish Government staff involved in approving these awards

the External Technical and Market Appraisal, or equivalent documentation

c) In relation to the third company specified for the purposes of request b), an explanation (with relevant paperwork) of the grounds on which a Scottish Government SMART award had been given to what he described as "a London company".

4.The Ministers responded on 20 July 2010, confirming that it held the information requested in requests a) and b), but explaining it was withholding this information under the exemptions in sections 33(1)(b) and 38(1)(b) FOISA.It also responded to request c), explaining the basis on which the award had been made.

5.On 21 July 2010, Dr Spowart wrote to the Ministers, requesting a review of their decision in respect of requests a) and b).He provided reasons why he did not consider the exemptions claimed to apply in the circumstances and why he considered the public interest to favour disclosure.

6.The Ministers notified Dr Spowart of the outcome of their review on 18 August 2010.They upheld their original decision to withhold the information under sections 33(1)(b) and 38(1)(b) of FOISA, providing reasons for doing so.

7.On 23 August 2010, Dr Spowart wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Scottish Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

8.The application was validated by establishing that Dr Spowart had made requests for information to a Scottish public authority (i.e. requests a) and b) above) and had applied to the Commissioner for a decision only after asking the authority to review its response to those requests.

Investigation

9.On 25 August 2010, the Ministers were notified in writing that an application had been received from Dr Spowart and were asked to provide the Commissioner with any information withheld from him. The Scottish Ministers responded with the information requested and the case was then allocated to an investigating officer.

10.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions.In particular, the Ministers were asked to justify (with particular reference to the requirements of the exemptions claimed earlier) their reliance on any provisions of FOISA they considered applicable to the information requested.

11.The Ministers responded on 11 November 2010 with their submissions for this case, confirming that they wished to continue to rely upon the exemptions in sections 33(1)(b) and 38(1)(b), but also providing arguments as to why they considered certain of the information to be exempt under section 36(2)of FOISA.

Commissioner's analysis and findings

12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Dr Spowart and the Ministers and is satisfied that no matter of relevance has been overlooked.

13.The Commissioner notes that Dr Spowart has various concerns about the subject matter of the SPUR and SMART applications to which his requests relate.He would also note that he can take these concerns in to account only insofar as they are relevant to whether the Ministers acted in accordance with the requirements of Part 1 of FOISA in dealing with the requests under consideration in this decision.

Section 36(2) - Confidentiality

14.The Ministers claimed that all of the withheld information was exempt under section 36(2) of FOISA, with the exception of that in the CVs referred to in request b) (see consideration of section 38(1)(b) of FOISA below).

15.Section 36(2) of FOISA provides that information is exempt if it was obtained by a Scottish public authority from another person (including another such authority) and its disclosure by the authority so obtaining it to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or any other person.Section 36(2) is an absolute exemption and is not, therefore, subject to the public interest test in section 2(1)(b) of FOISA.However, it is generally accepted in common law that an obligation of confidence will not be enforced to restrain the disclosure of information which is necessary in the public interest (this is commonly known as "the public interest defence").

16.The exemption contains a two-stage test, both parts of which must be fulfilled before it can be relied upon.The first is that the information must have been obtained by a Scottish public authority from another person."Person" is defined widely and means another individual, another Scottish public authority or any other legal entity, such as a company or partnership.

17.The Ministers explained the circumstances in which the information had been obtained from other persons.Having considered these submissions, along with the relevant information held by the Ministers and falling within the scope of Dr Spowart's requests, the Commissioner is satisfied that the information was obtained by the Ministers from other persons and that the first part of the section 36(2) test has therefore been fulfilled.

18.The second part of the test is that the disclosure of the information by the public authority must constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person.The Commissioner takes the view that "actionable" means that the basic requirements for a successful action must appear to be fulfilled.

19.There are three main requirements which must be met before a claim for breach of confidence can be established to satisfy the second element to this test. These are:

a.the information must have the necessary quality of confidence;

b.the public authority must have received the information in circumstances which imposed an obligation on it to maintain confidentiality; and

c.unauthorised disclosure must be to the detriment of the person who communicated the information.

Necessary quality of confidence

20.Both parties in this case provided submissions as to why the withheld information should, or should not, be considered to possess the necessary quality of confidence.The Commissioner has difficulty accepting that it follows necessarily from the Ministers' submissions that the information has this quality, or that it follows necessarily from Dr Spowart's submissions that it does not.

21.However, having considered the information to which the Ministers seek to apply section 36(2), the Commissioner is satisfied in the circumstances that it is not common knowledge and could not readily be obtained by Dr Spowart through any other means.Consequently, he is satisfied that it has the necessary quality of confidence.

Obligation to maintain confidentiality

22.The Ministers referred to specific undertakings as to confidentiality given to applicants for funding of this kind, noting in particular a declaration setting out with whom the applicants' information would be shared and for what purposes.They also explained that any sharing of information with the third parties designated in that declaration was done subject to explicit confidentiality agreements, which they described.They further submitted that an obligation of confidence was implicit in the nature of the relevant appraisal processes.

23.The Commissioner notes (as the Ministers confirmed) that certain information from the original application forms is routinely published for successful grants, in accordance with the declaration referred to in the preceding paragraph.He has considered this published information and is satisfied that it does not include anything falling within the scope of Dr Spowart's requests.

24.In all the circumstances, the Commissioner is satisfied that the withheld information was received by the Ministers in circumstances which imposed upon them an obligation to maintain confidentiality. While the declaration highlighted by the Ministers is not directly relevant to all of the information under consideration here, the Commissioner notes that the absence of any indication to applicants that such information will be made available to the public, and also that it is not in fact published at any point in the process.Given the context in which the information is obtained and thereafter processed by the Ministers, the Commissioner is of the view that those providing it would have a reasonable expectation that it would be held in confidence.

Unauthorised disclosure which would cause detriment

25.The third requirement is that unauthorised disclosure of the information must be to the detriment of the person who communicated it.The damage need not be substantial, and indeed could follow from the mere fact of unauthorised use or disclosure in breach of confidence (in that respect, the test of detriment is different from establishing whether, for example, disclosure would prejudice substantially the commercial interests of any person when considering the exemption in section 33(1)(b) of FOISA).

26.The Ministers highlighted the nature of the information, the importance of the funding in question to the companies concerned, and the potential prejudice to the SMART: SCOTLAND scheme (and by extension its advisors) should its processes be perceived as no longer confidential.In the circumstances, having considered the relevant submissions and the information withheld under section 36(2), the Commissioner is satisfied that disclosure of this information would be unauthorised by, and detrimental to, the persons from whom the information was obtained.In this connection, he would note that he finds the information under consideration here to be substantially different in character from the information (in that case, simply the overall sum paid in respect of a specified SPUR grant) he required to be disclosed to Dr Spowart in Decision 167/2010[1], where he did not accept that disclosure of the sum in question would (or would be likely to) result in substantial prejudice to the commercial interests of any person.

27.The Commissioner is therefore satisfied that the tests for an actionable breach of confidence are met in this case.As noted above, however (see paragraph 15), there may still be circumstances in which the disclosure of confidential information is required in the public interest.The courts have identified a relevant public interest defence in cases where withholding information would cover up serious wrongdoing, and where it would lead to the public being misled on, or would unjustifiably inhibit public scrutiny of, a matter of genuine public concern.In such cases the courts are required to balance the competing interests in disclosure and in maintaining confidentiality, but the public interest in confidentiality remains strong and there is no presumption in favour of disclosure.

28.In this case and in others, Dr Spowart has argued (with reasons, which the Commissioner does not consider it necessary to repeat at length here) that certain projects for which SPUR and SMART: SCOTLAND funding has been sought and approved lack commercial viability and therefore should not be funded.These arguments have been taken into account by the Commissioner in considering the public interest.While acknowledging, as he has in previous cases on the same general subject matter, that there is a clear public interest in transparency and effective scrutiny in relation to the award and payment of government funding, he is not persuaded that any of the arguments advanced in this case in support of disclosure are sufficiently compelling to outweigh the strong public interest in the maintenance of confidentiality in relation to the withheld information.

29.Having considered all the arguments, therefore, the Commissioner does not consider there to be any basis for the disclosure of confidential information on public interest grounds, and consequently he is satisfied that the Ministers were entitled to withhold the information in question under section 36(2) of FOISA.

Section 38(1)(b) - Personal information

30.The Ministers withheld the information in the CVs referred to in request b) in terms of section 38(1)(b) of FOISA, on the basis that disclosure would breach the first data protection principle.

31.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.

32.In considering the application of this exemption, therefore, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA and, if it is, whether disclosure of the information would breach the first data protection principle.

Is the information under consideration personal data?

33."Personal data" is defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller..." (the full definition is set out in the Appendix).

34.The Commissioner has considered the information in the withheld CVs, together with the relative submissions provided by the Ministers, and in the circumstances is satisfied that all of it falls within the above definition of personal data. Living individuals can be identified from the information in the CVs and that information is biographical in relation to those individuals and focuses on them. The Commissioner is therefore satisfied that the information relates to those individuals.

35.The Commissioner will now go on to consider whether disclosure of the information would breach the first data protection principle.

The first data protection principle

36.The first data protection principle states that personal data shall be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA is also met.The Commissioner is satisfied that none of the information in the CVs constitutes sensitive personal data and therefore is not required to consider whether any of the conditions in Schedule 3 can be met.

37.When considering the conditions in Schedule 2, the Commissioner has also noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner[2] (the Collie judgement) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.

38.In line with the submissions provided by the Ministers, the Commissioner considers that only condition 6 in Schedule 2 to the DPA might be considered to apply in this case. Condition 6 allows personal data to be processed (in this case, disclosed in response to Dr Spowart's information request) if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

39.There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

Does Dr Spowart have a legitimate interest in obtaining this personal data?

If so, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?

Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. the individuals to whom the data relate)?As noted by Lord Hope in the Collie judgement there is no presumption in favour of the release of personal data under the general obligation laid down in FOISA. Accordingly, the legitimate interests of Dr Spowart must outweigh the rights, freedoms or legitimate interests of the data subject before condition 6(1) will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Dr Spowart.

Does Dr Spowart have a legitimate interest?

40.Dr Spowart commented in his application on his legitimate interest in obtaining information from the CVs in question, explaining that he only wished to establish that the people submitting applications, and those involved in funding decisions, were suitably technically qualified (knowing, he submitted, from personal experience that this was not always the case). He did not believe he required names for his purposes.The Ministers acknowledged an interest in ensuring that each applicant had suitably qualified staff to achieve their proposed project, but questioned whether that interest would be furthered by disclosure of the withheld personal data to Dr Spowart.

41.Having considered all the submissions on this matter, together with the withheld information in the CVs, the Commissioner is satisfied that Dr Spowart has some legitimate interest in that information relating to the qualifications of the individuals concerned, for the purposes of carrying out the technical scrutiny he describes.

Is disclosure of the information necessary to achieve these legitimate interests?

42.The Commissioner must now consider whether disclosure of the withheld personal data is necessary for the legitimate interests identified above and in doing so he must consider whether these interests might reasonably be met by any alternative means.

43.In this case, the Commissioner can identify no viable means of meeting Dr Spowart's legitimate interests which would interfere less with the privacy of the relevant data subjects than the provision of the personal data referred to in paragraph 47 above.In the circumstances, he is satisfied that disclosure of those personal data is necessary to meet the legitimate interests in question.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

44.In considering the rights, freedoms and legitimate interests of the data subjects, the Ministers advanced certain arguments as to those individuals' expectations of privacy.They did not consider there to be any reasonable expectation of release into the public domain (which is the effect of disclosure under FOISA), given the purposes for which the information was held.They considered that the redaction of names and other biographical details would be meaningless in practice, asserting that it would still be relatively easy for Dr Spowart (with his knowledge and experience) to identify the individuals concerned from the remaining information on their technical qualifications and employers.They also highlighted what they considered to be reasonable apprehensions as to distress as a consequence of disclosure into the public domain.

45.The Commissioner has considered these arguments carefully.He has also taken into account the guidance on this point in his own briefing on the section 38 exemption [3], which identifies relevant factors as including:

whether the information relates to the individual's public or private life

the potential harm or distress that may be caused by disclosure

whether the individual has objected to disclosure

the reasonable expectations of the individual as to whether their information would be disclosed.

In the circumstances, acknowledging that these individuals would remain identifiable to Dr Spowart following the removal of names and other biographical details, he accepts as reasonable the expectations of the data subjects that their withheld personal data would not be disclosed into the public domain.

46.The Commissioner has in the past ordered the disclosure of information relating to a person's qualifications and experience where he considered that the specific nature and responsibilities of that person's post would give rise to expectations of transparency and accountability (see, for example, Decision 055/2007 Professor Ronald MacDonald and Highland Council[4], where the individual concerned was responsible for providing advice to inform decisions on questions of public safety).He must, however, consider each case on its own facts and circumstances.In this particular case, having balanced the legitimate interests of the data subjects against those identified by Dr Spowart, the Commissioner finds that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused in this case to the rights and freedoms or legitimate interests of the data subjects.The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met here.

47.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interest of the data subjects as described above, the Commissioner must also conclude that its disclosure would be unfair.As no condition in Schedule 2 to the DPA can be met, he would also regard disclosure as unlawful.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information in the withheld CVs and that this information was properly withheld under section 38(1)(b) of FOISA.

DECISION

The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Dr Spowart.

Appeal

Should either Dr Spowart or the Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
20 April 2011

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(c) section 36(2);

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

36 Confidentiality

?

(2) Information is exempt information if-

(a) it was obtained by a Scottish public authority from another person (including another such authority); and

(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(of exemptions with time), is not exempt information within the meaning of that Act".

...

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

---

[1] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2010/201001078.aspx

[2] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[3] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx

[4] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2007/200600458.aspx