Decision 082/2015: Mr Bruce Sandison and the Scottish Ministers Names of officials who provided advice to Ministers Reference No: 201402826 Decision Date: 18 June 2015  Summary On 25 August 2014, Mr Bruce Sandison asked the Scottish Ministers (the Ministers) for information from communications between Marine Scotland and the Scottish Government relating to the effect of sea lice infestations at marine salmon farms on populations of wild salmonids. The Ministers provided some information to Mr Sandison, but withheld other information under various exceptions. In his request for review, Mr Sandison challenged the decision to withhold the names of those individuals who had provided advice to Ministers. Following a review, Mr Sandison remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that the Ministers had responded to Mr Sandison's request for information in accordance with the EIRs. This was because the Ministers correctly applied the exception in regulation 11(2) to the names being withheld. She did not require the Ministers to take any action.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation) (paragraphs (a) and (c) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (b) (Personal data)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I - the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 25 August 2014, Mr Sandison made a request for information to the Ministers. He asked for all communications from 2005 until the present day between Marine Scotland and the First Minister and the Scottish Government in connection with sea lice infestations at marine farms in Scotland and the effect of such sea lice infestations on wild salmonids.

2. The Ministers sought clarification of the request on 1 September 2014. Mr Sandison responded on 9 September 2014 and confirmed that he would narrow the range of his request from 2005 to 2010, and that he was not seeking the identification of any particular salmon farm.

3. On 10 September 2014, the Ministers contacted Mr Sandison again and sought further clarification of his request. The Ministers asked Mr Sandison to clarify whether the range of his new request was from 2005 to 2010 or from 2010 to the present day. Mr Sandison responded the same day and confirmed that he was seeking information generated between 2005 and 2010.

4. The Ministers responded on 9 October 2014. In their response, the Ministers disclosed some information but they withheld other information, including the names of officials, under the exceptions provided in regulation 10(4)(e) and 11(2) of the EIRs.

5. On 29 October 2014, Mr Sandison wrote to the Ministers requesting a review of their decision not to disclose the names of officials who gave advice to Ministers.

6. The Ministers notified Mr Sandison of the outcome of their review on 24 November 2014. In their review outcome, the Ministers upheld their previous reliance on regulation 11(2) of the EIRs to withhold the personal data of officials, but they disclosed some information they had earlier considered excepted from disclosure under regulation 10(4)(e) of the EIRs.

7. On 11 December 2014, Mr Sandison wrote to the Commissioner. Mr Sandison applied to the Commissioner for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. Mr Sandison stated he was dissatisfied with the outcome of the Ministers' review because he considered that if the public do not know the names of the individuals providing advice to Ministers, then public confidence in the decisions that Ministers make might be substantially weakened.

Investigation

8. The application was accepted as valid. The Commissioner confirmed that Mr Sandison made a request for information to a Scottish public authority and asked the authority to review their response to that request before applying to her for a decision.

9. On 22 December 2014, the Ministers were notified in writing that Mr Sandison had made a valid application. The Ministers were asked to send the Commissioner the information withheld from him. The Ministers provided the information and the case was allocated to an investigating officer.

10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Ministers were invited to comment on this application and answer specific questions, including justifying their reliance on any provisions of the EIRs they considered applicable to the information requested.

11. During the investigation, submissions were received from the Ministers and from Mr Sandison.

Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Sandison and the Ministers. She is satisfied that no matter of relevance has been overlooked.

Withheld information

13. Mr Sandison requested the name of any official at Marine Scotland who provided advice to Ministers between 2005 and 2010 on the subject of lice infestations at marine salmon farms, and the impact of such infestations on populations of wild salmonids. The Ministers have confirmed two names were being withheld.

Application of the EIRs

14. It is apparent from the Ministers' correspondence with both Mr Sandison and the Commissioner that any information falling within the scope of his request would be environmental information, as defined in regulation 2(1) of the EIRs. Having considered the terms of the request and this correspondence, the Commissioner is satisfied that it would fall within either paragraph (a) of the definition of environmental information contained in regulation 2(1) (as information on the state of the elements of the environment) or paragraph (c) of that definition (as information on measures affecting or likely to affect those elements). This being so, the Commissioner is satisfied that the names of the officials responsible for providing the advice in question should also be considered as environmental information. Mr Sandison has not disputed this and the Commissioner will consider the information in what follows solely in terms of the EIRs.

Regulation 11(2) of the EIRs

15. The Ministers submitted that the withheld names were excepted from disclosure under regulation 11(2) of the EIRs. Regulation 11(2) excepts personal data of which the applicant is not the data subject, where either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies.

16. The Minsters' arguments relate to those parts of the first condition which apply where making the information available would contravene any of the data protection principles. In order for a Scottish public authority to rely on this exception, it must show that:

(i) the information is personal data for the purposes of the DPA and

(ii) making it available would contravene at least one of the data protection principles laid down in the DPA. In this case, the Ministers argued that the first data protection principle would be contravened.

Is the withheld information personal data?

17. Personal data" are defined in section 1(1) of the DPA as:

"data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possessions of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

18. The withheld information comprises the names of two individuals who provided advice to Ministers. The Ministers submitted that both names relate to living individuals who can be identified by disclosure of the requested information. The Commissioner has considered the Ministers' submissions and the withheld information and she is satisfied that it is personal data as defined in section 1(1) of the DPA, being information which relates to living individuals who can be identified from that information.

The first data protection principle

19. The first data protection principle states that the processing of personal data (in this case, making those data publicly available in response to a request made under the EIRs) must be fair and lawful and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.

20. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA. She does not consider any of the withheld information to be sensitive personal data.

21. There are three separate aspects to the first data protection principle:

(i) fairness

(ii) lawfulness and

(iii) the conditions in the schedules.

These three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be made available, it is likely that disclosure will also be fair and lawful.

22. The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be made available. If any of these conditions can be met, she must then consider whether the disclosure of these personal data would also be fair and lawful.

Can any of the conditions in Schedule 2 to the DPA be met?

23. The Ministers considered that only condition 6 in Schedule 2 could potentially apply in this instance. The Commissioner has considered all of the conditions in Schedule 2 and agrees that condition 6 is the only one which might be considered relevant in this case.

24. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individuals to whom the data relate). The processing in this case would be making the data available in response to Mr Sandison's request.

25. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr Sandison pursuing a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr Sandison's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

Is Mr Sandison pursing a legitimate interest or interests?

26. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In the Commissioner's published guidance on regulation 11(2)[1] of FOISA, it states:

In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

27. Mr Sandison argued that successive UK and Scottish governments have promoted fish farming in the West Highlands and Islands of Scotland and continue to do so, calling for the industry to double its size by 2020. Mr Sandison took the view that governments have followed this policy based upon advice they received from their scientific advisors. Mr Sandison referred to statements from various scientific experts which argued that the decline in wild sea trout populations in the West of Scotland was a direct result of sea lice infestations from marine salmon farms.

28. Mr Sandison noted that various lochs in the West of Scotland which were previously known for their large sea trout populations now barely produce more than a hundred trout in a year. It appeared to him as though a decision had been taken that the survival of wild salmonid populations in the West Highlands and Islands of Scotland was less important than the interests of largely foreign-owned, multi-national salmon farming organisations.

29. Mr Sandison noted that he has followed the rise of marine fish farming in Scotland for more than twenty years and, regardless of political persuasion, the advice given by advisors to successive governments has been consistent: the expansion of marine salmon farms. Mr Sandison argued that withholding the names of the advisors is damaging the principles of open government and transparency. Mr Sandison submitted that, given the effects that salmon farm expansion has had on populations of wild salmonids, the public have a right to know the names of those individuals who have provided advice to Ministers on this subject.

30. The Ministers acknowledged that there is a legitimate interest in understanding the processes and methods of consideration which officials and Ministers undergo when considering issues such as sea lice and other marine issues. The Ministers also acknowledged that there might be some legitimate interest in Mr Sandison knowing that Ministers are receiving advice from staff who have sufficient expertise. However, the Ministers did not accept that disclosure of this personal data is necessary in furthering that legitimate interest and they argued that disclosure of the names of officials would not enable Mr Sandison to judge the individuals' expertise or qualifications.

31. The Commissioner has considered the submissions made by both parties, and she accepts that Mr Sandison does have a legitimate interest in knowing who has provided advice to Ministers. The Commissioner acknowledges that a name on its own gives no indication of the qualifications or experience of an advisor, but knowing the names would allow Mr Sandison to research the public profiles of the advisors and assess their backgrounds and experience. The Commissioner notes that both of the advisors have an online presence and she is therefore satisfied that Mr Sandison does have a legitimate interest in knowing the names of the Ministers' advisors.

Is the processing involved necessary for the purposes of those legitimate interests?

32. The Commissioner must now consider whether the processing (i.e. disclosure) of the personal data is necessary in order to satisfy the legitimate interests identified above. In doing so, she must consider whether these interests might reasonably be met by any alternative means.

33. In all the circumstances of this case, the Commissioner can identify no viable means of meeting the legitimate interests of Mr Sandison which would interfere less with the privacy of the relevant data subjects than the provision of the withheld personal data. In the circumstances, she is satisfied that disclosure of the personal data is necessary to meet the legitimate interests in question.

Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

34. The Commissioner must now consider whether disclosure would cause unwarranted prejudice to the rights, freedoms or legitimate interests of the data subjects concerned. As noted above, this will involve a balancing exercise between Mr Sandison's legitimate interests and those of the data subjects. Only if Mr Sandison's legitimate interests outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

35. The Commissioner has issued guidance on the interpretation of the exception in regulation 11(2). This identifies a number of factors which should be taken into account in carrying out this balancing exercise. These include:

(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

(ii) the potential harm or distress that may be caused by the disclosure

(iii) whether the individual has objected to the disclosure

(iv) the reasonable expectations of the individuals as to whether the information would be disclosed.

36. In their submissions, the Ministers noted that they had contacted one of the officials about this case and the official had raised concerns about their name being disclosed in response to FOI requests, especially those submitted by campaigning organisations, as they were worried how such organisations would use their personal information. The Ministers noted that information which had previously been released to Mr Sandison (in response to a freedom of information request) had appeared on another sea lice campaigner's blog. The Ministers argued that it was quite possible that the officials' names could be passed to people who would then criticise or try to harass the individuals concerned.

37. The Ministers noted that, while they are not aware of Mr Sandison being involved in any action which has targeted staff members, they understand that he sometimes shares information with other groups and individuals who may publicise it on a blog or website. Once published, it is available for any unconnected third party to access it and use it to harass named staff members. The Ministers noted that as staff contact details are available on the Scottish Government website, once an official's name is known, they can be contacted regardless of whether their contact details were disclosed with their name. The Ministers argued that, in this case, as Mr Sandison is looking specifically for the names of staff who provided advice to Ministers, it is more likely that disclosure of this information would lead to those staff being publicly criticised (whether by Mr Sandison or by others he shares information with).

38. The Ministers submitted that they do not generally disclose staff names in cases where they are specifically requested unless the staff are senior civil servants or except where there are good reasons for doing so. In this case, the Ministers submitted, the advisors are junior officials who would have had no reasonable expectation when writing the advice that the Ministers would release their personal data to third parties, identifying them and allowing them to be contacted directly. The Ministers argued that processing of the information is unwarranted as it would prejudice the rights of the data subjects.

39. The Commissioner acknowledges that the decline of wild salmonid populations in Scotland is an important issue and one which has been debated in the public arena for many years. Mr Sandison has queried the continual expansion of marine salmon farms in the West of Scotland (believing this to be to the detriment of wild salmonids). He has argued that, as the Scottish Government would only pursue such a policy if it was being advised to do so, he (and the general public) has a legitimate interest in knowing who those advisors are.

40. The Commissioner notes the comments made by Mr Sandison regarding the requirement for disclosing the names of the advisors. She must balance these against matters such as the role and level of seniority of the data subjects, what their reasonable expectations would be, and any distress that may be caused to the data subjects by disclosure of the information. She notes Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2] that the conditions (in Schedule 2 of the DPA) require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject. The same arguments apply to requests made under the EIRs.

41. The Commissioner notes the Ministers' submissions that they do not "generally" disclose junior staff names except when there are good reasons to do so. While this may be a general approach, seniority alone may not be sufficient reason to withhold a name. In this case, the Commissioner recognises that the officials whose personal data has been withheld are not members of the senior civil service, but the Commissioner also notes that their grades suggest they are not amongst the most junior of staff. As the Ministers explained, the officers concerned do not (generally speaking) have public-facing roles so it is reasonable to assume that they may not automatically be associated with the information under consideration. As such, the Commissioner accepts that they would not expect their names to be routinely disclosed in connection with advice they provided to Ministers as part of their employment duties.

42. The Commissioner notes that the Scottish Government website offers a search facility through which contact details of its staff can be obtained by entering their name; she acknowledges that disclosure of the names in this case could result in the officials being contacted by third parties who may wish to blame them for their perceived role in the decline of wild salmonid populations. The Commissioner accepts that such contact may, on occasions, be unnecessarily distressing for the staff members and may be disruptive to their working life, although she would expect authorities to have procedures and policies in place to manage and minimise the impact of such behaviour as it relates to contact via workplace media such as telephone numbers, emails and written communication.

43. The Commissioner understands that the Ministers do not claim that Mr Sandison would harass the officers concerned, but she considers that, in this case, public disclosure of the names could lead to other interested parties making contact with the officials in this case.

44. Having considered the submissions made by the Ministers, the Commissioner accepts that disclosure of the withheld information in response to this information request would be likely to cause distress to the data subjects, particularly given the Ministers' concerns over the way information on this subject has previously been shared amongst campaigning organisations and individuals.

45. In all the circumstances, having considered the arguments made by both Mr Sandison and the Ministers, and having weighed Mr Sandison's legitimate interests against the legitimate interests, rights and freedoms of the officials whose personal data it is, the Commissioner has concluded that the legitimate interests of the employees outweigh those of Mr Sandison. As a result, she has determined that disclosure would be unwarranted in this case.

46. Having drawn these conclusions, the Commissioner has concluded that condition 6 in Schedule 2 (to the DPA) is not met in this case in relation to the withheld personal data.

47. As no schedule 2 conditions can be met, the personal data cannot be disclosed without contravening the first data protection principle. The Commissioner therefore concludes that disclosure of the officials' names would breach the first data protection principle, and so this information was properly withheld on the grounds of the exception contained in regulation 11(2) of the EIRs.

Decision The Commissioner finds that the Scottish Ministers complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr Sandison.

Appeal

Should either Mr Sandison or the Scottish Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner

18 June 2015

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

?

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

?

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

?

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

?

(b) is subject to regulations 6 to 12.

?

10 Exceptions from duty to make environmental information available-

?

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

?

11 Personal data

?

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998[] that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

---

[1]

[2]