Decision 086/2013 Dr David Johnston and Angus Council
Correspondence relating to Balintore Castle
Reference No: 201300571
Decision Date: 9 May 2013
Summary
On 18 December 2012, Dr Johnston asked Angus Council (the Council) for any correspondence it held between members of the public and the Council concerning Balintore Castle over a defined period. The Council withheld this information under regulation 38(1)(b) of FOISA, on the grounds that it was the personal data of the correspondent(s) and that its disclosure would breach the first data protection principle. Following an investigation, the Commissioner accepted this reasoning, although she also found that the information was environmental information subject to the EIRs (and was excepted from disclosure under regulation 11(2) of the EIRs).
Relevant statutory provisions
Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation - paragraphs (a), (c) and (f) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (b) (Personal data)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles: Part I - the principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. By way of background to this case, Dr Johnston is restoring Balintore Castle, a Category A listed building, having purchased it from the Council. The Council has been monitoring the restoration, in accordance with the sale agreement and as Planning Authority, and followed up concerns about the restoration work in the summer of 2012. Dr Johnston sought to determine whether complaints from members of the public might have prompted the Council's intervention.
2. On 18 December 2012, Dr Johnston wrote to the Council, asking it to provide him with copies of any correspondence between members of the public and the Council concerning Balintore Castle, from 31 January 2012 to 31 July 2012.
3. The Council responded the same day, withholding the information on the grounds that it was personal data and therefore section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA) applied. (Section 38(1)(b) of FOISA, as read with section 38(2)(a)(i) or (b) exempts personal data from disclosure if disclosure would breach any of the data protection principles set out in the DPA.) It provided Dr Johnston with a summary of the nature of third party observations received on alleged breaches of planning control.
4. On 28 January 2013, Dr Johnston wrote to the Council requesting a review of its decision. He asked why the Council could not provide him with the correspondence with the name(s) of any correspondent(s) redacted. Dr Johnston stated that the Council had provided him with similar information previously, and that he had also received similar information from another agency.
5. The Council notified Dr Johnston of the outcome of its review on 20 February 2013. The Council upheld its reliance on section 38(1)(b) of FOISA and informed Dr Johnston it was of the view that the detail of the correspondence would be sufficient to identify the correspondent(s), even with any name(s) redacted. It could not comment on disclosures by other agencies and did not believe it had sufficient information to identify any previous disclosure it might have made.
6. On 28 February 2013, Dr Johnston wrote to the Commissioner's office, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to certain specified modifications.
7. The application was validated by establishing that Dr Johnston made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
8. On 6 March 2013, the Council was notified in writing that an application had been received from Dr Johnston and was asked to provide the Commissioner with the information withheld from him. The Council responded with this information and the case was then allocated to an investigating officer.
9. The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA). The Council was asked to respond to specific questions. In particular, the Council was asked to comment on whether it considered the information requested by Dr Johnston to be environmental information as defined in regulation 2(1) of the EIRs. It was also asked to justify its reliance on any provisions of FOISA or the EIRs it considered applicable to the information requested.
10. In its submissions, the Council accepted that the withheld information was environmental information and confirmed that it wished its submissions under 38(1)(b) of FOISA to be considered as submissions under regulation 11(2) of the EIRs.
11. Dr Johnston provided the investigating officer with further submissions, including submissions on previous disclosures of information he considered similar in nature to that he was seeking here (with copies of the information disclosed previously).
12. The relevant submissions received from both the Council and Dr Johnston will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
13. In coming to a decision on this matter, the Commissioner has carefully considered all of the withheld information and the submissions made to her by both Dr Johnston and the Council. While the respective submissions have not been reproduced here in full, the Commissioner is satisfied that no matter of relevance has been overlooked.
FOISA v EIRS?
14. The Commissioner's thinking on the relationship between FOISA and the EIRs is set out in some detail in Decision 218/2007 Professor A D Hawkins and Transport Scotland[1] and it does not need to be repeated full here. The central point of the Commissioner's reasoning is that when a person requests information which would fall within the definition of environmental information set out in regulation 2(1) of the EIRs, that request should be considered and responded to in line with the EIRs.
15. In this case, the Council initially handled Dr Johnston's request for information in terms of FOISA. During the investigation, the Council accepted that the information requested by Dr Johnston was environmental information as defined in regulation 2(1).
16. Given the subject matter of the information covered by the request, the Commissioner is satisfied that this information would meet the definition of environmental information in regulation 2(1) of the EIRs (see in particular paragraphs (a), (c) and (f) of the definition, as set out in the Appendix below). The Commissioner considers this to be a reasonable approach to take to information on a major programme of restoration to a significant listed building.
17. While the Commissioner notes that the Council accepted this in the course of the investigation, she must also note that it did not do so (and act accordingly under the EIRs) when dealing with Dr Johnston's information request. Consequently, the Commissioner must find that in this respect the Council failed to comply with regulation 5(1) of the EIRs.
18. The Council did not choose to apply the exemption in section 39(2) of FOISA, which provides (in effect) that environmental information is exempt from disclosure under FOISA and allows such information to be considered solely in terms of the EIRs. Strictly speaking, therefore, the Commissioner is required to consider the handling of this case under both FOISA and the EIRs. However, given that the tests for applying regulation 11(2) of the EIRs (as applied by the Council during the investigation) and section 38(1)(b) of FOISA are to all intents and purposes the same, the Commissioner will not find it necessary to consider the application of section 38(1)(b) if she is satisfied that regulation 11(2) applies.
Regulation 11(2) of the EIRs - personal data
19. The Council argued that the information requested by Dr Johnston was excepted from disclosure under regulation 11(2) of the EIRs. Regulation 11(2) excepts personal data of which the applicant is not the data subject, where either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies.
20. The Council's arguments relate to those parts of the first condition which apply where making the information available would contravene the data protection principles. In order for a Scottish public authority to rely on this exception, it must show (i) that the information is personal data for the purposes of the DPA and (ii) that making it available would contravene at least one of the data protection principles laid down in the DPA. In this case, the Council argued that the first data protection principle would be contravened.
21. "Personal data" are defined in section 1(1) of the DPA as:
data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
22. The Commissioner has considered the content of the withheld information and the context in which it is held. She is satisfied that the correspondent(s) would be identifiable, in accordance with the requirements of section 1(1), even with the redaction of the name(s) and other details of the correspondent(s). The information is biographical in relation to the correspondent(s) and, in all the circumstances, the Commissioner is satisfied that it relates to (and is therefore the personal data of) the correspondent(s).
23. At this point, the Commissioner would note that she does not consider it possible to comment on the similarity or otherwise of information disclosed to Dr Johnston previously to that withheld in this case, without disclosing more about the withheld information than would be appropriate (or indeed permissible). In any event, what she is required to consider here is the application of the first data protection principle to the information requested by Dr Johnston on 18 December 2012: whether the Council (or another agency) may have disclosed other, similar information on earlier occasions is not relevant to that determination.
Would disclosure of the information breach the first data protection principle?
24. The first data protection principle states that the processing of personal data (in this case, making those data available in response to a request made under the EIRs) must be fair and lawful and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.
25. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and does not consider any of the withheld information to be sensitive personal data.
26. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be made available, it is likely that disclosure will also be fair and lawful.
27. The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be made available. If any of these conditions can be met, she must then consider whether the disclosure of this personal data would also be fair and lawful.
Can any of the conditions in Schedule 2 of the DPA be met?
28. In its submissions, the Council considered that only condition 6 of Schedule 2 of the DPA could potentially be applicable in this instance. The Commissioner has considered all of the conditions in Schedule 2 and agrees that condition 6 is the only one which might be considered relevant in this case.
29. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individual(s) to whom the data relate).
30. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
Does the applicant (Dr Johnston) have a legitimate interest in obtaining the personal data?
If yes, is making the information available necessary to achieve these legitimate aims? In other words, is it proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject(s)?
Even if making the information available is necessary for the legitimate purposes of the applicant, would it nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s)? This will involve a balancing exercise between the legitimate interests of the applicant and those of the data subject(s). Only if (or to the extent that) the legitimate interests of the applicant outweigh those of the data subject(s) can the personal data be made available.
Does the applicant have a legitimate interest?
31. Dr Johnston expressed concerns about his ability to complete the restoration works, unless he had access to the correspondence and was thus in a position to consider (and, where appropriate, address) any concerns raised. He identified various reasons why he believed completion of the works to be in the public interest. The Council acknowledged that there was a legitimate interest, given the subject matter of the correspondence
32. Having considered the submissions made by both Dr Johnston and the Council, the Commissioner accepts that Dr Johnston has a legitimate interest in knowing the content of the correspondence.
Is making the information available necessary to achieve those legitimate interests?
33. The Commissioner must now consider whether disclosure is necessary for Dr Johnston's legitimate interests. In doing so, she must consider whether these interests might reasonably be met by any alternative means.
34. The Commissioner has considered the submissions received form all parties on this point. Having accepted a legitimate interest in knowing the content of the correspondence, she can identify no means of meeting that interest which would not involve access to the correspondence. In the circumstances, she accepts that making the information available is necessary for that legitimate interest.
Would making the information available cause unwarranted prejudice to the legitimate interests of the data subject(s)?
35. The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms or legitimate interests of the data subject(s) concerned (the correspondent(s)). As noted above, this will involve a balancing exercise between the legitimate interests of Dr Johnston and those of the data subject(s). Only if the legitimate interests of Dr Johnston outweigh those of the data subject(s) can the information be disclosed without breaching the first data protection principle.
36. The Commissioner has issued guidance on the interpretation of the exceptions in regulation 11[2]. This identifies a number of factors which should be taken into account in carrying out this balancing exercise. These include:
whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
the potential harm or distress that may be caused by the disclosure
whether the individual has objected to the disclosure
the reasonable expectations of the individuals as to whether the information would be disclosed.
37. The Council submitted that the correspondent(s) would have a reasonable expectation of being able to express their views to the Council without details of those views being made public (which would be the effect of making the information available under either FOISA or the EIRs), and would expect that their information would be treated in a confidential manner. It argued that the correspondent(s) might not have submitted the correspondence to the Council had it been known that it might be made available publicly. It believed such disclosure was likely to cause distress to the correspondent(s). The Council also submitted that that the information deserved greater protection as information relating to the private (as opposed to public) life of the correspondent(s).
38. In reaching a conclusion, the Commissioner has taken account of the submissions made by both the Council and Dr Johnston. She accepts that this is information of a private, rather than a public, nature, and that the correspondent(s) would not reasonably expect it to be made available publicly. She accepts that it would be reasonable to conclude that disclosure might cause distress to the correspondent(s).
39. On balance, the Commissioner does not accept Dr Johnston's legitimate interests in this case are sufficient to outweigh the prejudice that would be caused to the rights, freedoms or legitimate interests of the correspondent(s). In the circumstances, the Commissioner finds that prejudice to the rights, freedoms or legitimate interests of the correspondent(s) would be unwarranted. The Commissioner is therefore satisfied that condition 6 in Schedule 2 to the DPA cannot be met in this case.
40. Having concluded that making the withheld information available would lead to unwarranted prejudice, as described above, to the rights, freedoms or legitimate interests of the data subject(s), the Commissioner must also conclude that such disclosure would be unfair. In the absence of a condition permitting disclosure, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that making the information available would breach the first data protection principle. Consequently, she finds that the information was properly withheld under regulation 11(2) of the EIRs.
41. As indicated above, having concluded that the Council was entitled to withhold the information under regulation 11(2) of the EIRs, the Commissioner does not find it necessary to consider separately whether it was properly withheld under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that Angus Council (the Council) partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by Dr Johnston.
The Commissioner finds that the Council should have dealt with Dr Johnston's information request under the EIRs and that, in initially failing to do so, it failed to comply with regulation 5(1) of the EIRs.
However, the Commissioner also finds that the Council was entitled to withhold the information requested by Dr Johnston under regulation 11(2) of the EIRs.
Appeal
Should either Dr Johnston or Angus Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
9 May 2013
Appendix
Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations -
?
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on-
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
?
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
?
(f) the state of human health and safety, including the contamination of the food chain, where relevant, conditions of human life, cultural sites and built structures inasmuch as they are or may be affected by the state of the elements of the environment referred to in paragraph (a) or, through those elements, by any of the matters referred to in paragraphs (b) and (c);
?
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
?
(b) is subject to regulations 6 to 12.
?
10 Exceptions from duty to make environmental information available
?
(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.
?
11 Personal data
?
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.
(3) The first condition is-
(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-
(i) any of the data protection principles;
?
(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - the principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2007/200600654.asp
[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
