Decision 092/2008 Mr Frank French and the Scottish Parliamentary Corporate Body
Re-appointment of the Scottish Public Services Ombudsman
Reference No: 200701687
Decision Date: 7 August 2008
Summary
Mr Frank French (Mr French) asked the Scottish Parliamentary Corporate Body (SPCB) for a copy of the information considered by the panel which dealt with the re-appointment of the Scottish Public Services Ombudsman (SPSO).In addition, he asked for copies of the correspondence between MSPs and the panel in respect of the re-appointment, and a copy of the objections from members of the public to the re-appointment. The SPCB withheld the information on the basis of a number of different exemptions in Part 2 of FOISA.
Following an investigation, the Commissioner found that the SPCB had partially failed to deal with Mr French's request for information in accordance with Part 1 of FOISA, by misapplying section 30(c), 36(2) and 38(1)(b) to some of the information withheld from Mr French. He required the SPCB to provide redacted copies of some of the correspondence to Mr French which would show him the basis of the objections without identifying the individual members of the public.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA): sections 1(1) (General entitlement); 2(1), (2)(c) and (e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 36(2) (Confidentiality) and 38(1)(b), (2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 (the DPA): sections 1(1) (Basic interpretative provisions) (definition of "personal data"); 2(e) (Sensitive personal data); Part 1 of Schedule 1 (The data protection principles) (the first and second data protection principles) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1))
The full text of each of these statutory provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Information Commissioner's Office (ICO) Freedom of Information Act Awareness Guidance No 1:
http://www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/awareness_guidance%20_1_%20personal_information_v2.pdf
Background
1.The Scottish Public Services Ombudsman Act 2000 makes provision for the appointment of the SPSO, who is to be nominated by the Scottish Parliament and appointed by the Queen.
2.SPCB Members sat as a re-appointment panel on 21 March 2007 to consider whether Professor Alice Brown should be nominated to the Parliament for re-appointment as SPSO.Following this, the SPCB published a report to inform the debate on the re-appointment.The SPCB's report can be viewed at http://www.scottish.parliament.uk/corporate/spcb/publications/ReporttoParliament.pdf.
3.The Parliament debated Professor Brown's re-appointment on 28 March 2007, following which she was nominated for re-appointment.The report on the debate can be viewed at http://www.scottish.parliament.uk/business/officialReports/meetingsParliament/or-07/sor0328-02.htm#Col33664.
4.On 21 April 2007, Mr French wrote to the SPCB requesting the following information:
a.all information reviewed by the panel which considered the re-appointment of Professor Brown (as detailed at paragraph 14 of the SPCB report);
b.all correspondence between MSPs and the re-appointment panel in respect of Professor Brown's re-appointment; and
c.a copy of the 20 complaints referred to by John Scott MSP during the debate in Parliament (during the debate, Mr Scott referred to the fact that the Ombudsman has dealt with more than 14,000 complaints and enquiries since she took up office and that the SPCB has received 20 complaints about the SPSO)
5.The SPCB responded to Mr French on 18 May 2007 and supplied the information which had been reviewed by the panel which had considered the re-appointment of Professor Brown, with the exception of Part B of her application form and a redacted version of the SPCB Papers Overview.The SPCB also provided Mr French with all the correspondence falling under the second heading of his information request and two complaints made to Mr Scott (most of this had originated from Mr French).The SPCB withheld the remaining information on the basis that it was exempt under section 38(1)(b) of FOISA as it constituted personal data, the disclosure of which would contravene the first data protection principle (which states that personal data must be processed fairly and lawfully).
6.Mr French wrote to the SPCB on 9 June 2007 requesting a review of its decision.
7.On 20 July 2007, the SPCB notified Mr French of the outcome of its review. The SPCB released the SPCB Papers Overview in full, which the review panel considered, on reflection, did not contain personal data. The SPCB apologised for this oversight.
8.However, the SPCB review panel upheld the earlier decision to withhold the remaining complaint letters, on the basis that they were exempt from disclosure under sections 30(b)(ii) and 36(2) of FOISA, in addition to section 38(1)(b), which had been cited earlier.The review panel commented that since the complaint letters contain sensitive personal data about the complainants and other third parties, disclosure would be unfair. The panel also advised Mr French that the information would have been supplied in confidence with no expectation of its release under FOISA, and disclosure could amount to an actionable breach of confidence. In addition, the SPCB considered that release of this information would substantially inhibit persons from corresponding with the SPCB in relation to similar complaints in the future and that this would be to the detriment of the effective conduct of public affairs. (In this instance, the SPCB considered that the public interest in maintaining the effective conduct of public affairs outweighed the public interest in disclosing the information on the basis that it was important that people could continue to communicate sensitive information to the SPCB on a confidential basis.)
9.The review confirmed that the application form submitted by Professor Brown continued to be withheld under section 38(1)(b) of FOISA.
10.On 30 November 2007, Mr French wrote to the Commissioner, stating that he was dissatisfied with the outcome of the SPCB's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
11.The application was validated by establishing that Mr French had made a request for information to a Scottish public authority (i.e. to the SPCB) and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
12.On 7 December 2007, the SPCB was notified in writing, as required by section 49(3)(a) of FOISA, that an application had been received from Mr French and was asked to provide the Commissioner with specified items of information required for the purposes of the investigation.The SPCB responded with the information requested on 17 January 2008 and the case was then allocated to an investigating officer.
13.The investigating officer contacted the SPCB, providing it with an opportunity to provide comments on the application and asking it to respond to specific questions. In particular, the SPCB was asked to comment on its reliance on the exemptions in sections 30(b), 36(2) and 38(1)(b) of FOISA and to explain how it had balanced the public interest test in relation to the exemption in section 30(b).Submissions were received from the SPCB on 3 April 2008.
Commissioner's analysis and findings
14.In coming to a decision in this matter, the Commissioner has considered all of the information and submissions presented to him by the SPCB and Mr French and is satisfied that no matter of relevance has been overlooked.
15.The SPCB has withheld the following information from Mr French: a copy of Professor Brown's application form for re-appointment as SPSO and copies of complaints made to the SPCB about Professor Brown in her role as Ombudsman and objections in relation to her re-appointment as Ombudsman.The application form is being withheld under the exemptions in section 36(2) and 38(1)(b) of FOISA.The complaints and objections are also being withheld under section 30(c) (after consideration, the SPCB decided that the relevant exemption in section 30 was section 30(c) and not section 30(b)(ii)).
16.The submissions from the SPCB are set out below in relation to each of the exemptions.Mr French has submitted that release of the information which informed the re-appointment of Professor Brown would enhance scrutiny of this procedure and improve accountability, and ensure that a public authority with regulatory responsibilities, such as the SPSO, was adequately discharging its functions. Given that Mr French was willing to receive the complaints/objections with personal data redacted, the investigating officer asked the SPCB whether it thought that this would be a viable way forward.However, it considered that this approach would not be viable and that, if personal data were to be redacted, the remaining words would serve no useful purpose for Mr French.
Professor Brown's application form
17.As noted above, the SPCB has withheld Professor Brown's application form under the exemptions in section 38(1)(b) and section 36(2) of FOISA.
Section 38(1)(b) ? personal information
18.Section 38(1)(b) of FOISA, read with section 38(2)(a)(i) or (b), exempts personal data from release, if its disclosure would contravene any of the data protection principles contained in the DPA.Section 1(1) of the DPA defines personal data as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (see the full definition in the Appendix).
19.It should be noted that the exemption in section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (b) of FOISA, is an absolute exemption in that it is not subject to the public interest test required by section 2(1)(b) of FOISA.
20.In order for a public authority to rely on this exemption it must show that the information which has been requested is personal data for the purposes of the DPA, and that disclosure of the information to a member of the public would contravene at least one of the data protection principles laid down in the DPA.
21.The Commissioner is satisfied that the information contained in Professor Brown's completed application form is personal data within the meaning of section 1(1) of the DPA. It is clear that this information is data which relate to a living individual (i.e. Professor Brown), who can be identified from the data.
22.The SPCB submitted that release of the completed application form would breach the first data protection principle. The first data protection principle requires that personal data be processed fairly and lawfully and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met).
23.In considering whether disclosure of such information would be fair and lawful, the Commissioner has taken into consideration the following factors:
Professor Brown's expectations about what would happen to her application form;
The fact that Professor Brown is the SPSO (the Commissioner considers that persons holding a senior position in an organisation or a position of regulatory authority should expect a greater degree of public scrutiny where public money is being spent);
The fact that the personal data requested relates partly to Professor Brown's professional life and partly to her personal life; and
Whether Mr French has a legitimate interest in knowing the content of Professor Brown's application form.
24.In considering the question of whether the release of this information would be fair to Professor Brown, the Commissioner has taken into account guidance issued by the (UK) Information Commissioner (ICO), who is responsible for regulating and overseeing the DPA and, in particular, his guidance note "Freedom of Information Act Awareness Guidance No 1."
25.This guidance suggests that, in considering fairness, it is likely to be helpful to ask whether the information relates to the private or public life of the individual. It also suggests that information which is about a person's home or family life or consists of personal references is likely to deserve protection. By contrast, information which is about someone acting in their official or work capacity could be provided on request.
26.Firstly, the Commissioner agrees with the SPCB that Professor Brown will have had an expectation that the content of her application form would be regarded as highly confidential and would not be circulated or disclosed more widely than was absolutely necessary for the purposes of the re-appointment process.The application form stated "In Confidence (when completed)".
27.Secondly, the Commissioner agrees with the SPCB that disclosure of such a completed application form ? which would include in these circumstances a lengthy and detailed self-evaluation exercise ? is likely to cause distress to the data subject.
28.The Commissioner recognises that Professor Brown holds a position of seniority in Scottish public life.The Commissioner has commented in previous decisions, for example Decision 025/2008 Mr George Gebbie and the Scottish Legal Aid Board, that the more senior a position an individual holds in an organisation, the more likely they are to expect that information relating to their position should be made available to the public. It will normally be the case that the higher the position and the greater the authority of an individual, the greater is the argument for openness, transparency and accountability. As a person's position becomes more high profile, their expectations of privacy, in relation to information concerning their professional lives, are likely to diminish.
29.Although the Commissioner recognises Mr French's arguments for transparency and accountability for persons of seniority, he also recognises the weight of the SPCB's submission that there is a strong expectation of privacy attached to an application form which is made in a private capacity, albeit it by the holder of a public position for re-appointment to that public position.
30.Taking into account all of the above, the Commissioner is of the view that to disclose the details of Professor Brown's application would constitute unfair processing and would therefore contravene the first data protection principle. (Given that the Commissioner has found that the processing would be unfair, he does not intend to go on to consider whether it would otherwise breach the first data protection principle.)
31.The Commissioner is therefore of the opinion that Professor Brown's completed application form is exempt from disclosure under section 38(1)(b) of FOISA.
32.Having decided that the application form is exempt in terms of section 38(1)(b) of FOISA, he does not propose to consider whether the application form is also exempt under section 36(2) of FOISA.
Complaints and objections to the re-appointment of Professor Brown
33.As noted above, the SPCB has withheld the complaints or objections under exemptions contained in sections 30(c), 36(2) and 38(1)(b) of FOISA.Although the report in Parliament refers to 20 complaints or objections (and 20 sets of papers were forwarded to the Commissioner by the SPCB), the Commissioner notes that one of these is a sub-set of a complaint made by the same individual and he has not treated it as a separate complaint.
34.The SPCB explained that it had received a number of complaints from members of the public about the performance of Professor Brown and her office. As the SPCB had no locus to act on these complaints, it informed the SPSO that they had been received and retained these complaints (and associated material).In addition, the SPCB received a number of objections when it became known that Professor Brown was being considered for re-appointment.
35.As noted above, Mr French asked for a copy of the objections/complaints from members of the public referred to by Mr Scott in the debate in Parliament on 28 March 2008.In providing information to the Commissioner for the purposes of the investigation, the SPCB provided not only the complaint letter but other correspondence associated with the complaint or objection.The Commissioner considers that this associated correspondence does not fall within the scope of Mr French's information request and will not be considered further in this decision.
Section 38(1)(b) ? personal information
36.As noted above, section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (b), exempts personal data from release if the disclosure of the data to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in the DPA. The DPA defines personal data in section 1(1) as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (see the full definition in the Appendix).
37.This particular exemption is an absolute exemption in that it is not subject to the public interest test required by section 2(1)(b) of FOISA.
38.Any public authority relying on this exemption must therefore show that the information is personal data for the purposes of the DPA, and that disclosure of the information to a member of the public would contravene at least one of the data protection principles laid down in the DPA.
39.The Commissioner is satisfied that the information under consideration is personal data within the meaning of section 1(1) of the DPA. Although the complaints/objections are very different in tone and content, they all contain personal data, whether it is the personal data of the person making the complaint or of the person complained of, or of the third parties referred to or mentioned within the documents.Individuals can be identified from the information and the information clearly relates to them.
40.As noted above, the SPCB has argued that the release of the information would breach the first data protection principle which requires that personal data must be processed fairly and lawfully and, in particular, that personal data must not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
41.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (of the DPA) is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 3 (again, of the DPA) is also met.'Processing' is defined broadly and includes disclosure of the information requested in response to an information request made under FOISA.
Sensitive personal data
42.The SPCB withheld six items (referred to in this Decision Notice as items A to F) which it stated were sensitive personal data, in terms of section 2(e) of the DPA: that is, personal data consisting of information as to the data subject's physical or mental health or condition.
43.As noted above, sensitive personal data cannot be disclosed unless there is a condition in each of Schedule 2 and 3 of the DPA which can be fulfilled. The conditions in Schedule 3 are the more restrictive.
44.Having studied the letters falling within the scope of Mr French's request, the Commissioner is satisfied that, to a varying degree, items A to F do contain sensitive personal data as defined by section 2(e) of the DPA.
45.The Commissioner has considered Schedule 3 of the DPA and is unable to find any condition in this schedule which would permit the processing of the sensitive personal data in this case.Without a Schedule 3 condition, the sensitive personal data cannot be disclosed without breaching the first data protection principle.As a result, the Commissioner is satisfied that the disclosure of the sensitive personal data would breach the first data protection principle and that its disclosure is therefore exempt under section 38(1)(b) of FOISA.
46.However, much of the information contained in items A to F does not comprise sensitive personal data and the Commissioner will go on to consider whether this can be disclosed.
47.The SPCB has not made any submission which suggests that disclosure of the information requested by Mr French would be unlawful in terms of the first data protection principle, other than by contravening the principle.In what follows below, the Commissioner will consider whether disclosure would be fair, and if any of the conditions in Schedule 2 of the DPA can be met.
Is it fair to release the non-sensitive personal data?
48.The SPCB submitted that data subjects would have a reasonable expectation that their personal data would not be disclosed and that, as a consequence, disclosure would be unfair.
49.The Commissioner notes the following about the information withheld:
The information varies in character.Much of the correspondence contains detailed information about aspects of an individual's private life, which may have been the subject of an application to the SPSO (one letter, however, comes from a statutory organisation which has complained about the SPSO, rather than an individual);
Also included in the correspondence is personal data relating to others, such as the SPSO, her (then) Deputy Ombudsmen and other members of her staff; information which is the personal data of MSPs also appears;
While some correspondence is clearly written in the expectation that it remain confidential (for example, by being marked "In Confidence' or 'Strictly confidential') the majority is not so explicit.Indeed, in some cases, it appears that the person making the complaint or objection wished the content to be publicised widely (for example, by sending the complaint to a large number of MSPs, or by copying it to organisations which may refer or use the information publicly).
50.The Commissioner acknowledges that a data subject may have an expectation of some personal data being disclosed in a limited way, but not of all of the data being disclosed into the public domain (which would be the effect of a disclosure under FOISA). For example, it may appear from the language used in the communication that the data subject (the writer) intended the content of the communication to be used, but it is not necessarily clear that they intended the content of that communication to be attributed personally to them.
51.It may also be the case that the writers of the objections intended the content of their correspondence to be disclosed only to those involved in the re-appointment process (for example the parts of item A which do not contain sensitive personal data but which appear to have been communicated with the expectation that it not be disclosed), yet there are documents withheld where this is not obviously the case.
52.Given the varying content of the correspondence, the Commissioner considers that it would be helpful to look at the correspondence under separate categories.
Individual members of the public
53.Having considered the personal data of the individual members of the public in detail, the Commissioner is of the view that there is a reasonable expectation by the data subjects that some of the personal data will not be disclosed.Even in the cases where the information has been copied to other recipients, the Commissioner does not consider that this necessarily shows an intention or expectation that the information is put into the general public domain, which would be the effect if the information were to be disclosed under FOISA.
54.The Commissioner is of the opinion that fully to disclose such information without the consent of the individuals involved would be unfair and would therefore breach the first data protection principle. The Commissioner therefore finds that, for all communications, it would be unfair to disclose the personal data comprising of the name, address or equivalent contact details (email, telephone, fax, etc) and other information which would identify the individual members of the public.
55.Given that he has found the processing for such information would be unfair, he does not intend to go on to consider whether the processing would otherwise breach the first data protection principle.
56.The Commissioner does not consider that the entire content of the correspondence needs to be withheld, however, provided that all of the information identifying the individual members of the public is redacted.The Commissioner disagrees with the SPCB's submission that to release the information with the redaction of certain details would not result in any meaningful information for the applicant.
57.The Commissioner is of the view that there is information in the documents which can be supplied to Mr French which is indicative of the nature of the objection or complaint, but which can be disclosed in a way in which it is not linked with an identifiable person.By redacting all of the information which would identify any of the applicants, the information would be rendered fully anonymous and would no longer, in effect, fall within the definition of personal data.
The SPSO, her Deputy Ombudsmen, staff etc.
58.However, the Commissioner does not consider that the disclosure of a small percentage of the personal data in the correspondence would breach the first data protection principle. In the main, the Commissioner is considering here the question of the personal data which identifies the SPSO, her (then) Deputy Ombudsmen, her staff and the MSPs who were involved in the correspondence.
59.FOISA received Royal Assent in May 2002 and from that date onwards, public authorities and those who do work for or with those authorities, were aware that they might in future be identified in connection with the work they carry out in a professional capacity. The SPCB raised no submission that there was unfairness in terms of the processing on the personal data of the Professor Brown in respect of the objections.
60.As the Commissioner has commented previously, individuals who are employed at a senior level are acting in a professional capacity. Disclosing information about those individuals would reveal information only about activities that they have carried out in their professional capacities.The same can be said for the MSPs who were involved in the correspondence.
61.As a person's position becomes more high profile, their expectations of privacy, in relation to information concerning their professional lives, are likely to diminish. Similarly, the less senior a person's position in an organisation, the less likely they are to expect information relating to their professional lives (such as complaints made about the way in which they carried out a particular piece of work) to be made available to the general public.
62.Taking into account all of the above, the Commissioner is of the view that to disclose the details of the Ombudsman or the (then) Deputy Ombudsman or a senior member of staff of the SPSO, where they are named in any complaint or objection (or an MSP who was involved in the correspondence), would not be unfair.
63.However, the same cannot be said for information which relates to more junior members of the SPSO staff, which the Commissioner accepts it would be unfair to disclose.As such, the Commissioner finds that the disclosure of the information would breach the first data protection principle and the SPCB was correct to withhold it under section 38(1)(b) of FOISA.
64.Having concluded that disclosure of information relating to the SPSO etc. in this case would be fair, the Commissioner must go on to consider whether any of the conditions set out in Schedule 2 of the DPA might be met in this case.
65.It is his view that condition 6(1) of Schedule 2 of the DPA is the only condition which might be considered to apply in this case. Condition 6(1) allows personal data to be processed (in this case, disclosed in line with an information request made under section 1(1) of FOISA) if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
66.Application of condition 6 involves a balance between competing interests broadly comparable, but not identical, to that which applies when considering the public interest test in section 2 of FOISA. Condition 6 requires a consideration of the balance between (i) the legitimate interests of those to whom the data would be disclosed, and prejudice to the rights, freedoms and legitimate interests of (ii) the data subjects, which, in the case of the personal data under consideration here, are any persons named within the content of the objection/complaint. However, because the processing must be "necessary" for the legitimate interests of members of the public to apply, only where (i) outweighs or is greater than (ii) should the personal data be disclosed.
67.In considering the legitimate interests of those to whom the data would be disclosed, the Commissioner accepts that there is a legitimate and significant interest in being aware of matters surrounding the re-appointment of the SPSO, given the high profile of the SPSO and the role she and her office play in Scottish society, and given that the report of the SPCB to Parliament specifically made reference to the objections and complaints it had received. Again, the same can be said for the MSPs involved in the correspondence.The Commissioner is satisfied that this interest legitimately extends beyond simply knowing the number of objections and that this additional information would allow understanding of the nature of that objection or complaint.
68.The Commissioner has considered whether these interests might be met equally effectively by a means other than by disclosure of the information requested by Mr French. Whilst the Commissioner has noted some information which is already in the public domain in respect of the re-appointment of Professor Brown, the Commissioner concludes that the legitimate interests in question cannot be met without disclosure of some of the content of the withheld information.
69.Turning to consider any prejudice to the rights, freedoms and legitimate interests of the data subjects, the Commissioner notes that disclosure of the information would not lead to the identification of any of the complainants. The only information under consideration here is personal data relating to persons acting in an official capacity - such as an MSP, an official in the SPCB who is the addressee, Professor Brown herself or one of her (then) Deputy Ombudsmen. The Commissioner is satisfied that any such intrusion following from this disclosure would be likely to affect that person's professional life only, and would be of a nature and extent which would be expected by those working at a high level in public life.
70.Having balanced the two competing interests in this case, the Commissioner concludes that any prejudice to the rights, freedoms and legitimate interests of the data subjects here is outweighed (and so is not unwarranted) in this instance by the legitimate interests of those to whom the data will be disclosed.
71.The Commissioner therefore finds that condition 6(1) of Schedule 2 of the DPA is met in this case.
72.As noted above, no separate arguments have been submitted to the Commissioner as to why disclosure of this information would be unlawful and he is therefore entitled to proceed on the basis that the disclosure would be lawful.
73.Having found disclosure to be both fair and lawful in line with condition 6(1), the Commissioner does not accept that disclosure of the information under consideration would breach the first data protection principle, and so does not accept that this information is exempt under section 38(1)(b).
Complaint from a statutory organisation
74.The Commissioner has already noted that one of the complaints comes from a statutory organisation (item 8).He does not consider that this type of complaint should be treated in the same way as a complaint from a member of the public.While the complaint does contain personal data (such as the names of two of the office bearers of the organisation and the contact details of one of them), the Commissioner considers that other information ? such as the basis of the complaint ? is not personal data given that it relates to the organisation itself and not to a living individual.
75.The Commissioner considers that the office bearer writing the letter would have had lower expectations of privacy in writing in an official capacity on behalf of the organisation than a member of the public writing such a letter.He is therefore satisfied that disclosure of the names of the office bearers to be fair (subject to redaction of the personal contact details of one the authors of the letter, which he considers would be unfair).
76.Having considered condition 6 of Schedule 2 of the DPA, the Commissioner is satisfied, that there is a legitimate interest in knowing which statutory organisation made a complaint about the SPSO.The Commissioner has weighed this against the rights, freedoms and legitimate interests of the office bearers mentioned in the correspondence and finds it difficult to think of any situation where these rights, freedoms and interests would be prejudiced by the disclosure of the information, given that they are acting in an official capacity on behalf of the organisation.He is therefore satisfied that condition 6 permits the disclosure of the names of the two office bearers.
77.Again, no separate arguments have been made to the Commissioner as to why disclosure of this information would be unlawful.
78.He therefore considers that the disclosure of item 8 (subject to the redaction of contact details) would not in fact breach the first data protection principle and that the information is not therefore exempt under section 38(1)(b) of FOISA.
Section 30(c) ? Prejudice to effective conduct of public affairs
79.The SPCB submitted that section 30(c) applied to the withheld material in its entirety. However, given that the Commissioner has accepted that much of the information withheld by the SPCB is exempt under section 38(1)(b), he will only consider whether the information which he has identified as not falling within that exemption falls within section 30(c).If he finds that any of the information does, he will then go on to consider the public interest test in respect of that information.
80.This means that, in considering the exemption under section 30(c), the Commissioner is considering only a limited amount of information, i.e. the basis of the complaints or objections and the names of the SPSO, senior officials, etc.It should also be noted that the submissions from the SPCB on the exemption relate to the information in its entirety.However, they are noted here for completeness.
81.Information is exempt under section 30(c) of FOISA if its disclosure would "otherwise" (i.e. otherwise than under the exemptions in section 30(a) or section 30(b)) prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
82.The SPCB explained that the SPSO holds a very senior and influential public office and the selection of an appropriate candidate is of considerable significance for the conduct of public administration throughout Scotland. It is important in the re-appointment that the SPCB should have as much information as possible available to it on the performance of the incumbent officeholder.The SPCB held the view that the prospect that any complaints and objections submitted to the SPCB might subsequently be disclosed would tend to discourage those contemplating submitting complaints, objections or other comments.This would be likely to prejudice substantially the effective conduct of public affairs by limiting the information available to the SPCB.
83.Authorities seeking to rely on the exemption in section 30(c) of FOISA must be able to show that disclosure would (or would be likely to) prejudice substantially the way in which they conduct their business. They should be able to demonstrate that the risk of damage being caused by disclosing information is real or very likely, not simply a remote possibility. The harm caused or likely to be caused must be of some real and demonstrable significance, not simply marginal, which would occur in the near (certainly the foreseeable) future rather than in some unspecified distant time.
84.The Commissioner has some sympathy with the arguments put forward by the SPCB as they apply to the correspondence in its entirety.He does not accept, however, disclosure of the redacted information would invoke the exemption in section 30(c).
85.The Commissioner does not consider that the disclosure (or prospect of disclosure) of complaints and objections would discourage those contemplating submitting complaints, objections or other comments. It should be acknowledged that the opposite is also a possibility and that possible disclosure would encourage others to submit complaints or objections, particularly if they were aware that their personal details were likely to be withheld if the information was subsequently disclosed in response to a section 1 request.
86.Even if it were accepted that disclosure would cause a degree of future reticence on the part of persons providing information to the SPCB, the Commissioner concludes that the damage anticipated by the SPCB would not be as significant as feared and is unlikely to prejudice substantially (or be likely to prejudice substantially) the role of the SPCB here. Persons registering such complaints and objections have a self-interest in disclosing a broad range of information to the SPCB.
87.The Commissioner, therefore, does not accept that disclosure of the redacted information would, or would be likely to, prejudice substantially the effective conduct of public affairs as required by section 30(c)
88.Having decided that the redacted material does not fall within the terms of section 30(c), the Commissioner is not required to go on to consider the public interest test.
Section 36(2) - Confidentiality
89.The SPCB claimed this exemption in relation to three of the complaints/objections (items 6, D and E) which appear to have been communicated in the first instance to the complainers' MSPs who thereafter referred them to the member of the SPCB with portfolio responsibility for Office Holders.The SPCB submitted that communications between an MSP and a constituent give rise to an obligation of confidentiality and that the circumstances in which the SPCB received the three complaints/objections from the MSPs in question also gave rise to an obligation of confidentiality towards the complainers.
90.As noted in paragraph 35 above, the Commissioner has taken a narrower view of the information which falls within the scope of Mr French's request than the SPCB.He is therefore only considering here three separate letters of complaint/objection, two of which were sent by MSPs on behalf of their constituents and one of which was sent by the constituent to an MSP.It should also be noted that the information in these letters which would identify the constituents in question is considered to be exempt by the Commissioner in terms of section 38(1)(b).The Commissioner is therefore considering only a limited amount of information under this particular exemption.
91.Again, it should also be noted that the submissions received from the SPCB relate to the information in its entirety.
92.The SPCB submitted that the information communicated has the necessary quality of confidence and disclosure to the public of the information communicated has not been authorised by the complainer and would be likely to cause them damage and distress.The SPCB therefore considered that the disclosure of the information communicated in relation to these three complaints/objections would also constitute a breach of confidence actionable by the complainers and that the exemption in section 36(2) therefore applies.
93.Information is exempt information if it was obtained by a Scottish public authority from another person and its disclosure by the authority so obtaining it would constitute a breach of confidence actionable by that person or any other person.
94.In order to rely on section 36(2), an authority will usually need to demonstrate certain elements. Firstly, the information must have been obtained by the SPCB from another person. This is the case with all three letters.
95.The second test is that the disclosure of the information by the public authority would constitute a breach of confidence actionable either by the person or persons from whom the authority obtained the information or by any other person. The Commissioner takes the view that actionable means that the basic requirements for a successful action must appear to be fulfilled.
96.There are three main requirements, all of which must be met before a claim for breach of confidentiality can be established. These are:
the information must have the necessary quality of confidence about it. It must not be generally accessible to the public already.
the information must have been communicated in circumstances importing an obligation of confidentiality. The obligation may be express (for example, in a contract or other agreement), or implied from the circumstances or the nature of the relationship between the parties; and
there must have been unauthorised use or disclosure of the information to the detriment of the party communicating it. Detriment may be potential rather than actual and need not be financial.
97.To have the necessary quality of confidence, the information should not be generally accessible. That is clearly the case here.
98.The information must have been communicated in circumstances importing an obligation of confidentiality. In this case, there was no express obligation in a contract or other agreement. At most the obligation may be implied from the circumstances or the nature of the relationship between the parties.
99.The SPCB must also have received the information in circumstances which imposed an obligation on it to maintain confidentiality.In this context, the SPCB has submitted that the relationship between MSP and constituent is one which would imply a duty of confidentiality, as is the relationship between MSP and SPCB.
100.Whilst the Commissioner considers that the confidentiality expected by the data subjects is overstated in certain cases, he accepts, for the purposes of this application, that both relationships are such that there may be an implied duty of confidentiality.
101.The third part of the test requires that disclosure of the information must be unauthorised by, and cause damage to, the person who communicated it.
102.While the Commissioner accepts that, if the letters were to be disclosed in full, there could be detriment (either to the MSP or the writer), he does not consider that the disclosure of redacted versions of the letters would have this effect.Given the information which the Commissioner considers should be redacted in line with section 38(1)(b), all that would be disclosed to Mr French is at most a factual narration of the complaint with no identification of the member of the public who made the original complaint. The Commissioner is therefore not satisfied that disclosure of the information, with the personal data he identified above redacted, would be actionable.
103.The Commissioner is therefore of the view that not all of the information in the correspondence is exempt in terms of section 36(2) of FOISA and that a redacted version of the documents should have been provided to Mr French.
Redaction of information
104.The Commissioner notes the concerns raised by the SPCB that it would not be viableto redact exempt information (particularly personal data) from the objections and complaints and that if personal data were to be redacted, the remaining words would serve no useful purpose to Mr French.However, the Commissioner has redacted the information which he considers to be exempt from disclosure under FOISA from the correspondence provided to him by the SPCB and finds that the basis of the complaint made to the SPSO remains clear from the non-redacted information.He considers that the disclosure of this information would serve a useful purpose.
105.The Commissioner will provide the SPSO with a copy of the correspondence showing the information which he considers requires to be redacted in line with his decision.
DECISION
The Commissioner finds that the Scottish Parliamentary Corporate Body (SPCB) partially failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr French.
While the Commissioner finds that much of the information requested by Mr French is exempt under section 38(1)(b), he found that by withholding other information from Mr French, the SPCB misapplied the exemptions sections 30(c), 36(2) and 38(1)(b).In doing so, the SPCB failed to comply with section 1(1) of Part 1 of FOISA.
The Commissioner therefore requires the SPCB to provide to Mr French redacted versions of the information (that is, minus information redacted in terms of 38(1)(b) as outlined above) that fall within the scope of Mr French's request by 21 September 2008.
Appeal
Should either Mr French or the Scottish Parliamentary Corporate Body wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
07 August 2008
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(c) section 36(2);
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
?
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
36 Confidentiality
?
(2) Information is exempt information if-
(a) it was obtained by a Scottish public authority from another person (including another such authority); and
(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2 Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to ?
?
(e)[the data subject's] physical or mental health or condition
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
Schedule of documents
Correspondence falling with the scope of the request
The references are to references used by the SPCB except for references "A" to "F".No references were used by the SPCB for these complaints, but the Commissioner introduced these references to separate the complaints containing sensitive personal data from other complaints.The letter accompanying this Decision Notice to the SPCB will include a key to these additional references.(Note that the reference "1" is not missing from this Decision Notice; it was used in relation to separate material.)
2 Email of 16 March 2007
3 Email of 22 March 2007
4 Letter of 28 December 2005
5 Letter of 9 November 2007 plus accompanying appendix
6 Letter of 13 December 2006
7 Letter of 11 November 2006
8 Letter of 21 January 2004 plus accompanying annex
9 Letters of 3 December 2003 and 22 March 2004
10 Email of 11 March 2007
11 Email of 6 March 2007
13 Letters of 31 July 2006, 5 October 2006 and 6 November 2006
14 Letter of 16 October 2004
15 Letter of 12 November 2006
A Letters of 17 October 2006 and 12 February 2007; email of 6 March 2007
B Letter of 25 August 2006
C Letter of 2 April 2006
D Letter dated 18 August 2006
E Letter dated 16 August 2006
F Letter dated 4 January 2005
