Home Decisions

Decision 106/2021

Decision 106/2021: Complaints against a Council employee

Public authority: City of Edinburgh Council
Case Ref: 202001494

Summary

The Council was asked for information relating to complaints against a specified Council employee.

The Council refused to confirm or deny that it held the information, stating that - if it existed and was held - it would be exempt from disclosure and that it was not in the public interest to reveal whether the information existed.

The Commissioner found that the Council was not entitled to refuse to reveal whether the information existed or was held. He required the Council to issue a new response.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provisions as respects responses to request); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2A)(a), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal Information)

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 10 September 2020, the Applicant made a request for information to City of Edinburgh Council (the Council). The information requested was:

All correspondence and information including but not limited to documents, reports, calls logged, notes of meetings and emails relating to complaints against council employee Robert Sean Raeside Bell, known as Sean Bell, from 01/01/1997 up until today's date (10/09/2020) or more recent.

This would include incident investigations or reports.

2. The Council responded on 8 October 2020 in terms of section 18(1) of FOISA, in conjunction with sections 30(c) (Prejudice to effective conduct of public affairs) and 38(1)(b) (Personal information). It acknowledged that the fact the employee in question was under police investigation at the time of his death was a matter of public interest, and that the public would want to know what the Council knew in relation to allegations against him, and be assured whether appropriate action was taken relating to any concerns raised about his conduct. The Council stated it had already acknowledged the public interest and had initiated an investigation into these areas of concern.

3. The Council refused to confirm nor deny that it held the information requested, or if it existed, stating that to do so would be contrary to the public interest. The Council stated that, if the information did exist and were held, it would be exempt from disclosure under the exemption in section 30(c) of FOISA, as disclosure of sensitive information relating to an ongoing matter would harm any ongoing investigations and subsequent proceedings, and would discourage individuals from raising concerns for fear their information would be made public, thus inhibiting the Council's ability to scrutinise itself, identify any poor practice and make necessary improvements. The Council further stated that if the information existed and were held, it would also be exempt from disclosure under section 38(1)(b) of FOISA), as any legitimate interest in disclosure would be outweighed by the intrusion into the privacy of third parties.

4. On 4 November 2020, the Applicant wrote to the Council, requesting a review of its decision as she believed there was an overwhelming public interest in favour of this information, if held, being disclosed. The Applicant refuted that disclosure could prejudice the investigation in any meaningful sense, given it was not a live police investigation and did not enjoy the same privileges. Neither did she agree that disclosure of the information, if held, might prevent others from coming forward and damage trust in the Council, thereby prejudicing its ability to carry out its duties in future. The Applicant stated she was not seeking any information that would identify innocent victims, and such information could and should be redacted.

5. In the Applicant's view, given that the allegations centred around the fact that the Council had failed to act timeously when complaints against the employee in question were reported to it, it was in the public interest to know whether the Council had acted appropriately or had failed to act, and disclosure of the information would confirm this.

6. The Council notified the Applicant of the outcome of its review on 3 December 2020. It acknowledged there was a significant public interest in understanding whether it had acted appropriately in relation to any complaint that may have been raised about the behaviour of a senior staff member, stating the issue here was whether, in meeting this public interest, it was necessary to disclose the information requested, if held.

7. The Council referred to the independent investigations that had been commissioned - one looking at the handling of complaints against the employee in question (which was directly relevant to the public interest associated with the Applicant's request) and the other being a review of whistleblowing and organisational culture regarding concerns of wrongdoing involving the Council. The Council stated there was no public interest in the premature disclosure of information, if it existed and were held, that would either discourage individuals from engaging in these independent investigations, or undermine the Council's ability to co?operate effectively with them, thus inhibiting the inquiry's ability to scrutinise events effectively. It believed maintaining strict confidentiality from the outset gave assurance of the seriousness with which it treated such matters.

8. In the Council's view, it was important that these investigations be allowed to draw fair, reasonable and accurate conclusions. The Council acknowledged that it was unable to guarantee whether the outcomes of these investigations, when published, would meet the public interest, but noted that it had been transparent in the past where there was a clear public interest in doing so.

9. The Council further stated, given the intrinsically personal nature of the information requested, it might not be capable of being redacted to avoid the identification of individuals.

10. On 11 December 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated she was dissatisfied with the outcome of Council's review because she believed there was a clear public interest in disclosure of this information, if held. The Applicant refuted that disclosure would prejudice the investigation, given it was being carried out independently by external auditors, who would still be able to communicate in a private setting. The Applicant did not believe the outcomes of these investigations would be likely to meet the public interest (noting the Council's inability to guarantee this) and therefore disclosure under FOISA was the only way of satisfying the public interest in knowing whether the Council's actions had been appropriate. The Applicant confirmed she was happy for information which would identify alleged victims to be redacted.

Investigation

11. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

12. On 13 January 2021, the Council was notified in writing that the Applicant had made a valid application and the case was subsequently allocated to an investigating officer.

13. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. These focused on the Council's justification for neither confirming nor denying if it held the information requested.

14. The Applicant was also invited to comment on the public interest in the Council revealing whether the information existed.

15. Both parties provided submissions to the Commissioner.

Commissioner's analysis and findings

16. In coming to a decision on this matter, the Commissioner has considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 18 - "neither confirm nor deny"

17. Section 18 of FOISA allows Scottish public authorities to refuse to reveal whether they hold information (or whether it exists) in the following limited circumstances:

(i) a request has been made to the authority for information which may or may not be held by it;

(ii) if the information were held by the authority (and it need not be), the authority could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and

(iii) the authority considers that to reveal whether the information exists or is held would be contrary to the public interest.

18. In this case, in both its initial and review responses, the Council stated that, if it did hold any information falling within the scope of the request, it could be withheld under the exemptions in section 30(c) (Prejudice to effective conduct of public affairs) and section 38(1)(b) (Personal information) of FOISA.

19. The Commissioner must ensure that this decision does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that he is unable to comment in any detail on the authority's reliance on section 30(c) or section 38(1)(b), or on other matters which could have the effect of indicating whether or not the information sought by the Applicant exists or is held.

Section 38(1)(b) - Personal information

20. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.

21. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Would the information, if held, be personal data?

22. The Applicant sought information relating to complaints made to the Council about a senior employee. The Commissioner must firstly address whether the information requested, if it existed and were held, would be personal data for the purposes of section 3(2) of the DPA 2018.

23. "Personal data" is defined in section 3(2) as any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 ? see Appendix 1. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.) Information which could identify individuals will only be personal data if it relates to those individuals. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

24. The Council acknowledged that, if it existed and were held, the information captured by the request would relate to allegations made by individuals against the employee in question. Its nature would be such that individuals could be identified from that information, and would therefore be assessed to fall within the definition of personal data.

25. The Commissioner is satisfied that, if it were held and if it existed, any information captured by this request would "relate to" the individuals who made the complaints, as a minimum, and might also relate to other individuals involved in some other way, for example individuals who might have witnessed the alleged incidents. He is satisfied, in the light of the submissions from the Council, that the information would relate to identified or identifiable individuals. The Commissioner therefore accepts that the information, if it were held and if it existed, would be personal data for the purposes of section 3(2) of the DPA 2018.

26. The Commissioner will now go on to consider whether disclosure would contravene one of the data protection principles in Article 5 of the UK GDPR.

Would disclosure contravene one or more of the data protection principles?

27. The Council argued that disclosing the personal data, if they existed and were held, would breach the first data protection principle. This requires personal data to be processed lawfully, fairly and in a transparent manner in relation to the data subjects (Article 5(1)(a) of the UK GDPR).

28. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018), "disclosure by transmission, dissemination or otherwise making available". In the case of FOISA, personal data are processed when disclosed in response to an information request. This means that the personal data could only be disclosed if disclosure would be both lawful and fair.

29. The Commissioner must now consider whether disclosure of the personal data, if they existed and were held, would be lawful and fair (Article 5(1)(a)). In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed. The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

30. In the Council's view, disclosure of the information, if it existed and were held, would contravene Article 5(1)(a) (Fair and lawful processing) by breaching assurances which would have been given to individuals on how their personal data would be handled by the Council. In the Council's view, disclosure of the information, if it existed and were held, would not be supported by a lawful basis for processing.

Condition (f): legitimate interests

31. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subjects which require the protection of personal data (in particular where the data subject is a child).

32. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

33. The tests which must be met before Article 6(1)(f) can be satisfied are as follows:

(i) Does the Applicant have a legitimate interest in obtaining the personal data?

(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

34. In her application to the Commissioner, the Applicant submitted that there was a strong public interest in disclosure of the information, if held.

35. In support of her position, she claimed that the Council had sat on allegations against the employee in question for more than 20 years. As set out in her request for review, given the allegations against the Council were centred around the fact it had failed to act in a timely manner on receipt of these complaints, the Applicant believed exposing any potential inaction was very much in the public interest and might help those victims, whose complaints might have been ignored, to take them further. In contrast, if the Council had acted appropriately, records held would confirm this. This, the Applicant argued, would reaffirm public faith in the Council and might encourage others to provide further evidence in this, or any other matter.

36. The Council acknowledged that the Applicant wished to understand the nature of any complaints that might have been made against the employee in question, and any pursuant actions taken by the Council. It acknowledged the wider public interest identified by the Applicant in understanding whether any complaints received had been handled appropriately, and in holding the Council to account in this regard.

37. The Commissioner accepts that disclosure of the withheld information, if it existed and were held, would facilitate transparency and accountability to the Applicant (and the wider public) regarding any complaints made to the Council about the senior employee in question, and how the Council responded to these. There is clearly a legitimate interest in the public knowing whether the Council took appropriate action in such an event, and consequently the Commissioner is satisfied that the Applicant (and, indeed, the wider public) has a legitimate interest in the disclosure of these personal data, assuming they existed and were held.

Would disclosure of the personal data be necessary?

38. Having accepted that the Applicant has a legitimate interest in the personal data, if they existed and were held, the Commissioner must consider whether disclosure of these personal data would be necessary to meet the Applicant's legitimate interests.

39. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subjects.

40. The Applicant stated she would be happy for the Council to omit or redact any information that would identify alleged victims.

41. In its submissions to the Commissioner, the Council argued that disclosure of the information, if it existed and were held, would not be necessary to satisfy the legitimate interests identified in this case. In the Council's view, the independent inquiry would serve the public interest in terms of public accountability, in a manner which would not publicly identify individuals.

42. In the Council's view, the independent inquiry would meet both the Applicant's legitimate interest and the wider public interest in this case. Recognising the Applicant's concerns (in her application to the Commissioner) that the inquiry report might not contain the level of detail she desired, the Council believed the independent investigation should be allowed to progress and issue its report, and any assessment of whether it adequately achieved the public interest in this case could only be made once that process had concluded.

43. The Council did not believe it would be possible to anonymise any information, if it existed and were held.

44. Having considered the Council's arguments carefully, the Commissioner takes the view that disclosure of the personal data, if it existed and were held, would be necessary to achieve the Applicant's legitimate interests. He notes that the Council has already stated it has initiated an investigation into the handling of any complaints that might have been made against the senior employee in question, and is to publish the outcome of this investigation once it has concluded. While the Commissioner accepts that this takes the Applicant some way towards satisfying her legitimate interest, he considers more specific details of any complaints that might have been made, and the Council's response to these, would be quite appropriate matters for transparency and accountability in this context. The Commissioner accepts the Council's submissions that, even redacting the names of individuals in any information that might be held, would still provide opportunity to allow individuals to be identified.

45. In all the circumstances, the Commissioner can identify no viable means of fully meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects other than providing the information requested, if it existed and were held. In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the information, if it existed and were held, would be necessary for the purposes of the Applicant's legitimate interests.

46. The Commissioner will now consider whether the Applicant's legitimate interest in obtaining the information requested, if it existed and were held, would outweigh the rights and freedoms of the data subjects.

The data subjects' interests or fundamental rights and freedoms

47. The Commissioner must balance the legitimate interests in disclosure of the information, if it existed and were held, against the data subjects' interests or fundamental rights and freedoms. In doing so, it is necessary for him to consider the impact of such a disclosure. For example, if the data subjects would not reasonably expect that the information, if it existed and were held, would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subjects could the information, if it existed and were held, be disclosed without breaching the first data protection principle.

48. The Commissioner's guidance[1] on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties. He notes that, although no longer applicable in the UK, Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects. These are some of the factors public authorities should consider:

(i) Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?

(ii) Would the disclosure cause harm or distress?

(iii) Whether the individual has objected to the disclosure.

49. The Commissioner acknowledges that the information, if it existed and were held, would relate to either or both the public and/or private lives of individuals. This would depend on whether or not the complainant was also a Council employee, and whether or not the allegations related to events which took place in a professional setting.

50. In the circumstances, the Commissioner concludes that the information, if it existed and were held, would relate to either or both the private and/or public lives of the data subjects.

Would disclosure cause harm or distress to the data subjects?

51. The Commissioner has also considered the harm or distress that might be caused by disclosure of the information, if it existed and were held. Disclosure, under FOISA, is a public disclosure. He has taken into account that, in this case, disclosure of the information, if it existed and were held, would publicly link the data subjects to a complaint, whether as a person who made that complaint, as being involved in responding to that complaint or as being involved in some other way. At the most general level, disclosing or alleging that an identifiable individual has made allegations, some of which may be extremely sensitive in nature, against a Council employee may, depending on the situation, cause that person distress. It might also cause some reputational damage on the public perception of those involved in responding to any such allegations, or in some other way, unless there are mitigating circumstances (which may be private) that are also made known.

52. The Commissioner has given weight to the Applicant's legitimate interests, as set out above. Having carefully balanced the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of the data subjects, the Commissioner finds that the legitimate interests served by disclosure of the information, if it existed and were held, would be outweighed by the unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subjects.

53. In the circumstances of this particular case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the withheld personal data.

Fairness

54. Given that the Commissioner has concluded that the processing of the personal data, if they were held and existed, would be unlawful, he is not required to go on to consider whether any such disclosure would otherwise be fair or transparent in relation to the data subjects.

Conclusion on the data protection principles

55. For the reasons set out above, the Commissioner is satisfied that the disclosure of any personal data, if they existed and were held, would breach the data protection principle in Article 5(1)(a) of the GDPR. Consequently, he is satisfied that such personal data, if they existed and were held, would be exempt from disclosure under section 38(1)(b) of FOISA and that the Council could give a refusal notice under section 16(1) of FOISA, on the basis that the information would be exempt information by virtue of section 38(1)(b) of FOISA.

56. As the Council has stated it also wishes to rely on section 18(1) in conjunction with section 30(c) of FOISA, the Commissioner will now go on to consider whether that exemption would apply in the event that the information existed and were held.

Section 30(c) - Prejudice to effective conduct of public affairs

57. Section 30(c) of FOISA provides that information is exempt information if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

58. The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information (in this case, if it existed and were held), and how that harm would be expected to follow from disclosure.

59. There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers the harm in question would require to be of real and demonstrable significance. The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur: therefore, the authority needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.

The Applicant's submissions

60. In her application to the Commissioner, the Applicant disagreed that disclosure of the information, if it existed and were held, would prejudice the Council's independent investigation, given that it did not enjoy the same privileges as a live police investigation or a court case. She submitted that the independent investigation was being carried out by external auditors, who were trained investigators and unlikely to be impeded by any press coverage resulting from the disclosure of any information, if held. In addition, they would still be able to communicate in private as they were outwith the scope of the request.

61. The Applicant further disagreed that, given the nature of the alleged complaints, release of this information, if held, would be "premature" as claimed by the Council, particularly given the Council's inability to provide any guarantee surrounding the level of disclosure in, or the timescale for, the published outcome of the independent investigation.

62. The Applicant refuted the contention that disclosure of the information, if held, might prevent others from coming forward with similar complaints and damage trust in the Council, thus preventing it from carrying out its duties in future. In her view , given that disclosure would reveal what action, if any, the Council took in response to any complaints it had received, doing so would reaffirm public faith in the Council and might encourage others to approach it with further evidence in this, or any other public matter.

The Council's submissions

63. In its submissions to the Commissioner, the Council confirmed its view that, if the information were held and if it existed, it would be exempt from disclosure under section 30(c) of FOISA. In support of its position on this, the Council referred to previous decisions issued by the Commissioner which had upheld section 30(c) for information relating to whistleblowing complaints and investigations (namely Decision 181/2016[2], Decision 060/2017[3] and Decision 093/2017[4]). The Council also highlighted its obligations under the Public Interest Disclosure Act 1998 (PIDA), which provides protections for workers (including employees) who "blow the whistle" on wrongdoing at work by incorporating protections in the Employment Rights Act 1996 (the ERA) (specifically sections 43A-H pertaining to qualifying protected disclosures). These provisions, the Council submitted, were reflected in its whistleblowing policy[5].

64. The Council submitted that disclosure of any information relating to this matter into the public domain (if it existed and were held) before the inquiry panel had a chance to collate all relevant information and encourage witnesses to come forward, might harm the effectiveness of the inquiry, as a result of media interest and discourse discouraging witnesses and decreasing public confidence in the impartiality of the inquiry.

65. The Council took the view that disclosure of any information obtained via protected disclosures, if it existed and were held, would contravene its obligations under PIDA and associated employment law, and would also likely deter individuals from making such disclosures in future for fear that confidentiality would not be assured. In support of its position on the need for confidentiality to support the efficacy of the independent investigation, the Council provided a link to the webcast[6] of the full Council meeting held on 15 October 2020, with specific reference to the input of Tom Stalker from Pinsent Masons.

66. The Council further submitted that the disclosure of any information, if it existed and were held, which revealed concerns raised through a protected disclosure and the subsequent actions and decisions taken by the Council in response, would be a direct breach of the trust underpinned by its whistleblowing policy and associated legislation. It further believed that disclosure of the information, if it existed and were held, would risk casting doubt on the outcome of the independent inquiry, for example through media spin, influencing public expectation on the likely outcome.

The Commissioner's views on section 30(c)

67. The Commissioner has taken account of all of the relevant submissions.

68. In assessing whether the exemption in section 30(c) would apply to the information, if it existed and were held, the Commissioner has taken account of a number of factors, including the timing of the request. He must make his decision based on the Council's position at the time it issued its review outcome.

69. It is clear, in this case, that the information requested, if it existed and were held, would relate to matters which would not appear to have been resolved. Disclosure of information under FOISA is disclosure into the wider public domain, and not just to the person who has asked for it. In the Commissioner's view, anyone providing information under the Council's whistleblowing process (which would include any protected disclosure made) would have a reasonable expectation that it would not be used for any purpose other than those covered by the Council's whistleblowing policy and the relevant legislation (PIDA and the ERA).

70. In relation to the information requested, the Commissioner acknowledges that, if it existed and were held, anyone who had provided any such information to the Council, or who was involved in the matters covered by it in some way, was entitled to confidentiality. He can see nothing in the Council's submissions to evidence that such confidentiality would not have been maintained.

71. In the Commissioner's view, disclosure of the information, if it existed and were held, would undermine the expectations inherent in the Council's whistleblowing process and the relevant legislation, and he therefore accepts the Council's views on the wider harm in this regard. He is also satisfied that disclosure of any information, if it existed and were held, would have a prejudicial impact on the ability of the independent investigation to continue in a confidential and impartial setting, without undue external influence.

72. Therefore, in all the circumstances of the case, the Commissioner accepts that disclosure of the information, if it were held and if it existed, would substantially prejudice the effective conduct of public affairs, thereby engaging the exemption in section 30(c) of FOISA.

The public interest

73. As noted above, the exemption in section 30(c) is subject to the public interest test in section 2(1)(b) of FOISA. The Commissioner must, therefore, now consider whether, in all the circumstances of the case, the public interest in disclosing the information, if it existed and were held, would be outweighed by that in maintaining the exemption.

74. The Applicant submitted there was an overwhelming public interest favouring disclosure of the information, if held. She submitted that the allegations against the Council were that it had failed to act timeously when complaints against the employee in question were reported to it. As such, it would be very much in the public interest to expose any potential inaction (which might help victims to take their complaints further) or, conversely, to confirm whether the Council had acted appropriately.

75. Further, given the Council had not made clear if or when the findings of the independent investigation would be made public, the Applicant disagreed with the Council's view that the public interest was met solely by that investigation.

76. The Council recognised the public interest in disclosure of the information, if it existed and were held, which was supported by the following factors:

There is a general presumption in favour of disclosure built into FOI legislation.
The general public interest in transparency would be advanced by confirming the nature and/or timing of any complaints that may have been raised regarding the actions of the employee in question, and would also provide clarity around the Council's actions in response to these.

77. In contrast, the Council provided the following factors favouring non-disclosure of the information, if it existed and were held:

Disclosure would breach the Council's responsibilities under PIDA and would undermine the basic level of trust and assurance as to confidentiality provided to individuals making protected disclosures.
Disclosure would undermine the independent investigation.
The independent investigation provided an alternative method to serve the public interest, and so disclosure under FOISA was not necessary to meet the public interest.
Disclosure would fundamentally undermine wider processes relating to complaint handling and whistleblowing.

78. In balancing the public interest arguments, the Council submitted its main consideration was to assess the harm likely to be caused to the impartiality of, and public confidence in, the independent investigation, and its own processes for complaint handling and protected disclosures.

79. The Council considered the matters raised in the information request to be of such importance that it had invested significant time and resource into conducting an independent inquiry. The public interest in allowing that inquiry to continue impartially was, in the Council's view, of over-riding public interest.

80. The Council also considered confidentiality was paramount to ensuring a robust and effective whistleblowing process. It submitted that the existence of legislation addressing the protection of whistleblowers demonstrated the level of public interest in this area and the importance of having effective processes in place to encourage and protect those raising concerns. In the Council's view, there was no public interest in disclosing any information, if it existed and were held, which would, in any way, inhibit its ability to operate an effective whistleblowing policy.

The Commissioner's view on the public interest

81. The Commissioner has carefully considered the submissions from both parties.

82. The Commissioner acknowledges there is a general public interest in transparency and accountability involving holders of public office and their public duties. In this case, having considered the Applicant's submissions, he accepts there would be a public interest in knowing whether or not the Council acted appropriately in response to any complaints it might have received regarding the conduct of a senior employee (a factor which, he notes, the Council has also recognised). He also takes the view that, while the outcome of the independent investigation is to be published following its conclusion, there is no way of knowing, at this stage, whether its content will, in fact, meet the public interest in this case: any assessment surrounding this could only be made once that process had concluded.

83. That said, the Commissioner recognises there is a clear public interest in any whistleblowing process being allowed to function effectively, ensuring trust between the parties involved, and maintaining the confidentiality of any information disclosed (which would include any protected disclosures, and the identities of those involved in any way). He considers there would be no public interest in the disclosure of any information which, if it existed and were held, would prevent individuals from engaging in this process, in fear that their information would not remain confidential, and thus undermine the Council's ability to exercise its public functions in relation to complaints handling and whistleblowing.

84. On balance, therefore, the Commissioner considers the public interest in maintaining the exemption would outweigh that in disclosing any information falling within the scope of this request, if it existed and were held.

85. Consequently, the Commissioner is satisfied that the information requested, if it existed and were held, would be exempt from disclosure under section 30(c) of FOISA and that the Council could give a refusal notice under section 16(1) of FOISA, on the basis that the information would be exempt information by virtue of section 30(c).

Section 18(1) - The public interest

86. The Commissioner must now consider whether the Council was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

The Council's submissions

87. The Council believed it was not in the public interest to reveal whether the information existed or was held.

88. In its submissions to the Commissioner, the Council recognised there was a public interest in transparency, specifically in knowing whether or not it held any complaints against a senior employee. It also acknowledged that confirming whether or not any relevant complaint information was held would not, on the face of it, reveal the content of any such complaints.

89. In contrast, the Council also submitted there was no public interest in confirming whether or not a protected disclosure had been made, as doing so would undermine the basic level of trust and assurance as to confidentiality provided to individuals making such disclosures. Further, given the ongoing situation, the Council believed disclosure would also breach its responsibilities under PIDA and relevant employment legislation.

90. In the Council's view, having initiated an independent investigation which, it believed, was an alternative route to transparency and accountability, the Council believed that publicly confirming whether any relevant was held, or not, would undermine the efficacy of that investigation. Further, the Council submitted it had no way of measuring the potential impact on individuals linked with any information in some way, through publicly confirming whether or not the information existed.

91. In balancing the public interest, the Council submitted that its over-riding consideration was to assess the harm likely to be caused to the ongoing independent investigation. Noting that certain allegations had been made in the media, which the Council described as a matter of public speculation rather than knowledge, the Council considered the public interest favoured non-disclosure in order to protect the ongoing independent investigation. While it fully recognised the intense public interest surrounding this matter, the Council believed that allowing the independent investigation to progress was the best mechanism for serving the public interest at this time, with no benefit from disclosure.

92. Noting the Applicant's concerns that the independent investigation report might not fully meet the public interest in terms of transparency and accountability, the Council believed it was in the public interest to ensure the independent investigation was effective, and not undermined in any way through a level of distrust resulting from the disclosure of any information which, if it existed and were held, might have been provided with the expectation of confidentiality.

93. The Council further submitted that the PIDA placed upon it clear responsibilities to protect those who had made protected disclosures and, in the particular circumstances of this request, it did not consider it possible to reveal whether or not it held any relevant information. The Council considered that doing so, in the context and timing of the request, would represent a fundamental breach of trust which would undermine the very purposes of its whistleblowing policy.

The Applicant's submissions

94. The Applicant refuted the Council's position that confirming or denying whether it held any information, or whether it existed, would prejudice its investigation. In the Applicant's view, anyone involved would already have access to all records and, given that they were trained professionals, would be unlikely to be swayed by any media article written as a result of such a confirmation or denial. This, the Applicant believed, outweighed any concerns the Council might have concerning prejudicing the investigation.

95. The Applicant argued that the public interest lay in knowing whether the Council held any records of complaints against the employee in question and, from there, it could be ascertained when these were received and what was done about them. If the Council did not hold any information, the Applicant believed it was important to have this confirmed, so that she could make enquiries into what prompted its investigation, if not the complaints of alleged victims.

96. The Applicant submitted that, while it was encouraging to hear that the Council was now conducting an investigation, it had given no indication of if or when the outcome would be published, or any guarantee surrounding the level of disclosure. As such, she did not accept the public interest was met solely through the independent investigation, and so there was merit in speeding up the release of the information requested.

The Commissioner's views

97. The Commissioner has carefully considered the arguments by both parties. The test he must consider is whether (having already concluded that the information, if it existed and were held, would be exempt from disclosure) revealing whether the information exists or is held would be contrary to the public interest.

98. As rehearsed above, disclosure under FOISA is not simply disclosure to the person requesting the information, but rather is a public disclosure. In this case, the Commissioner is satisfied that disclosing the personal information of third parties, if it existed and were held, would breach the first data protection principle. He is also satisfied that disclosure of the information, if it existed and were held, would prejudice the effective conduct of public affairs. Doing so would not only undermine the expectations of confidentiality inherent in the Council's whistleblowing process, but would also impact on the independent investigation being allowed to continue in a confidential and impartial setting, without undue external influence caused by the disclosure of any information, if it existed and were held.

99. The Commissioner notes that the Council has initiated two independent investigations, one of which is looking into how it handled complaints received against the senior employee in question. This was confirmed by the Council in press releases dated 13 November 2020[7], and 25 November 2020[8]. It is clear that, when taking the decision to instigate such an investigation, the Council did not consider it would be contrary to the public interest to confirm that such an investigation, into the circumstances concerning that individual's death, was to take place. Having done so, the Commissioner can see no valid reason for the Council continuing to maintain its position of neither confirming nor denying it held any information, or whether the information existed, at the time it responded to the Applicant's request for review on 3 December 2020.

100. Confirming whether or not the information requested existed or was held would not, in the Commissioner's view, cause the harm envisaged by the Council. He does not agree that doing so would have any impact whatsoever on the ability of the independent investigation to continue without prejudice as a result of any such confirmation or denial. The Commissioner does not believe that such confirmation or denial would discourage individuals from engaging in the independent investigation, or in the Council's whistleblowing process more generally. In his view, it might equally have the effect of encouraging individuals who might have been affected to come forward with information. Neither is he satisfied that it would undermine the Council's ability to co-operate effectively in either investigation.

101. Further, the Commissioner does not accept that confirming or denying the information's existence (or whether it was held) would compromise the privacy of the data subjects, or cause them unjustifiable harm or distress (were the information held), in the manner described by the Council. Confirming or denying that the information exists, or is held, is simply just that - it does not extend to the disclosure of the actual content or nature of any information, if it existed and were held. No basis has been offered for concluding that simply confirming or denying would be capable of leading to either the identification of any living individual or the existence (never mind the content) of any protected disclosure.

102. In the Commissioner's view, the Council's arguments for section 18(1) focus more on the actual disclosure of any relevant information (if it existed and were held), as opposed to confirmation or otherwise of its existence and whether or not it was held.

103. Having carefully considered the submissions from both parties, the relevant circumstances and the reliable information in the public domain, the Commissioner's view is that there is a strong public interest in knowing whether or not the information existed or was held by the Council at the time of the request. This would provide clarity on whether or not, at the time of the request, the Council held any information surrounding complaints made about the behaviour of its employee and, consequently, whether this might, or might not have been the basis for the Council's decision to instigate the independent investigation into the circumstances surrounding his death.

104. On balance, therefore, the Commissioner concludes that the Council was not entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether it held the information requested, or whether that information existed.

105. The Commissioner requires the Council to issue the Applicant with a revised review outcome, otherwise than in terms of section 18(1) of FOISA. He requires the Council to confirm to the Applicant whether the information requested existed and was held by it when it received the request, and to issue a fresh review outcome in terms of section 21(4)(b) of FOISA.

Decision

The Commissioner finds that City of Edinburgh Council (the Council) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

He finds that the Council was not entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether it held the information requested, or whether that information existed.

The Commissioner therefore requires the Council to reveal to the Applicant whether the information she requested existed and was held by it when it received her request, and to provide her with a fresh review outcome in terms of section 21(4)(b) of FOISA, by 19 August 2021.

Appeal

Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement
5 July 2021

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

…

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

…

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

…

(5) In this section-

"the data protection principles" means the principles set out in -

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

…

"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

UK General Data Protection Regulation

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

…

f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -

…

(d) disclosure by transmission, dissemination or otherwise making available,

…

(5) "Data subject", means the identified or identifiable living individual to whom the personal data relates.

(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).

…

(14) In Parts 5 to 7, except where otherwise provided -

(a) references to the UK GDPR are to the UK GDPR read with Part 2;

…

(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;

(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.

…

[1] Exemptions - Personal information (section 38) (itspublicknowledge.info)

[2] https://www.itspublicknowledge.info/ApplicationsandDecisions/Decisions/2016/201600324.aspx

[3] Decision 060/2017 (itspublicknowledge.info)

[4] https://www.itspublicknowledge.info/ApplicationsandDecisions/Decisions/2017/201700436.aspx

[5] https://www.edinburgh.gov.uk/directory-record/1146244/whistleblowing-policy

[6] https://democracy.edinburgh.gov.uk/ieListDocuments.aspx?CId=150&MId=5592&Ver=4

[7] https://www.edinburgh.gov.uk/news/article/13032/leading-lawyer-to-head-council-culture-inquiry

[8] https://www.edinburgh.gov.uk/news/article/13044/inquiry-into-wider-council-culture-gets-underway