Decision 112/2016: Ms K and the Royal Conservatoire of Scotland Names of Donors / Benefactors Reference No: 201600068   Decision Date: 10 May 2016 Summary On 5 October 2015, Ms K asked the Royal Conservatoire of Scotland (RCS) for information on donations made to RCS and its predecessor body, and the names of the benefactors. RCS provided some information, but informed Ms K that it was withholding other information as it considered this to be third party personal data, disclosure of which would breach the data protection principles. Ms K sought a review, restricting the scope of her request to six-figure donations in four specified years. RCS upheld its original decision: Ms K remained dissatisfied and applied to the Commissioner for a decision. During the investigation, RCS disclosed additional information to Ms K, withholding only the identity of individual(s) who had donated sums in excess of ?100,000. The Commissioner found that RCS partially failed to respond to Ms K's request for information in accordance with Part 1 of FOISA. RCS wrongly withheld the names of organisations that had donated sums exceeding ?100,000 under section 38(1)(b) of FOISA, but correctly applied this exemption to the identity of individual(s) who had made donations of this size. She did not require RCS to take any action.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 5 October 2015, Ms K made a request for information to RCS. The information requested was:

(i) donations made to RCS and its predecessor, Royal Scottish Academy of Music and Drama, since 1999;

(ii) the names of these benefactors.

2. RCS responded on 23 October 2015, providing the total amounts of donations received annually since 1999. RCS withheld the names of the donors under section 38(1)(b) of FOISA, on the basis that disclosure would identify those individuals and would therefore contravene its obligations under the DPA.

3. On 29 October 2015, Ms K wrote to RCS, asking if it would be possible to see the individual donations, even if not named.

4. RCS responded on 11 November 2015, providing the individual donation figures for the years 2009 to 2015, explaining that its financial records only permitted the retention of such details for the current financial year, plus six years. In response to a follow-up query from Ms K regarding RCS's grounds for applying section 38(1)(b) to the second part of her request, RCS informed her that section 38(1)(b) applied as the request pertained to information relating to a third party. RCS was of the view that the names of the donor, along with the corresponding donation, constituted the personal data of the third party and would breach its obligation in regard to the fair and lawful processing of data.

5. On 13 December 2015, Ms K wrote to RCS, requiring a review of its decision to withhold the names of the donors of the six-figure donations made in 2009, 2010, 2011 and 2012. Ms K argued there was an overwhelming public interest in these names being disclosed, when the sums of money were so large.

6. RCS notified Ms K of the outcome of its review on 21 December 2015, upholding its original decision without modification.

7. On 11 January 2016, Ms K wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. Ms K stated she was dissatisfied with the outcome of RCS's decision to withhold the names of the donors under section 38(1)(b) of FOISA. While acknowledging that the information was personal data, she did not believe disclosure would contravene RCS's obligation with regard to fair and lawful processing.

Investigation

8. The application was accepted as valid. The Commissioner confirmed that Ms K made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

9. On 29 January 2016, RCS was notified in writing that Ms K had made a valid application. RCS was asked to send the Commissioner the information withheld from Ms K. RCS provided the information and the case was allocated to an investigating officer.

10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. RCS was invited to comment on this application and answer specific questions, with particular reference to its application of section 38(1)(b) of FOISA.

11. As RCS was withholding information under the exemption in section 38(1)(b), Ms K was also invited to comment on her legitimate interest in obtaining this information.

12. RCS and Ms K both provided submissions to the Commissioner.

Commissioner's analysis and findings

13. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Ms K and RCS. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal information

14. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, (2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

15. In order to rely on this exemption, RCS must show, firstly, that any such information would be personal data for the purposes of the DPA and, secondly, that disclosure of that data would contravene one or more of the data protection principles to be found in Schedule 1.

16. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

17. RCS was asked to confirm whether it wished to continue to rely upon section 38(1)(b) of FOISA in respect of the withheld information, and to explain the basis on which it was doing so. It was also brought to RCS's attention that the names of donors which were organisations, or recorded as "anonymous" (where their identity was not known), could not be considered personal data as defined by section 1(1) of the DPA.

Is the withheld information personal data?

18. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

19. In this case, the withheld information comprises the names of organisations and individual(s) who donated six-figure sums in 2009, 2010, 2011 and 2012 (13 donations in total).

20. RCS accepted that the information on donations made by organisations could not be considered personal data. It disclosed this information to Ms K.

21. The Commissioner must agree with this revised position. The information in question does not relate to living individuals and therefore does not meet the definition of personal data in section 1(1) of the DPA. Given this conclusion, the Commissioner finds that RCS was not entitled to apply section 38(1)(b) to withhold the names of the organisations.

22. RCS confirmed that it was a condition of the remaining donations that the identity of the donor(s) remained anonymous. However, it also confirmed that it held the name(s) of the individual(s) concerned. It provided the Commissioner with this information, confirming that it was continuing to withhold it under section 38(1)(b) of FOISA.

23. The Commissioner has considered the submissions received from RCS on this point, along with the withheld information. In line with these submissions, she is satisfied that the information comprises the personal data of the donor(s). The information records the name(s) of the individual(s) who made six-figure donations. Clearly, it is possible to identify living individual(s) from it. It is about those individual(s) and so can be said to relate to them. It is therefore those individual(s)' personal data, as defined by section 1(1) of the DPA.

24. As indicated above, the Commissioner considers all of the withheld information to be the personal data of the individual(s) to whom it relates. In the circumstances, including the terms of the request and the actual information held, she does not consider it would be possible to disclose any of the withheld information without a real risk remaining that the individual(s) could be identified: consequently it would remain their personal data.

Would disclosure contravene the first data protection principle?

25. In its submissions, RCS argued that disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully. The processing in this case would be the disclosure of the information into the public domain, in response to Ms K's request.

26. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for her to consider the conditions in Schedule 3.

27. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the information would be fair and lawful.

28. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

29. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the information to Ms K. In any event, neither Ms K nor RCS has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

30. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does Ms K have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for Ms K's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

31. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Ms K must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that RCS was correct to refuse to disclose the personal data to Ms K.

Does Ms K have a legitimate interest in obtaining the personal data?

32. In her submissions to the Commissioner, Ms K stated that significant donations to organisations which are, in part, public institutions have public implications. They cannot be considered only a private issue, particularly where the donation is so large in comparison to the organisation's average budget.

33. She further argued that the use of the DPA was not a guarantee of absolute privacy and, while the wishes of the donor(s) regarding anonymity should be taken into account, these did not provide grounds for total exemption from disclosure of the information under FOISA.

34. RCS did not accept that Ms K had a legitimate interest in the information. It noted that she believed disclosure was in the public interest, but did not consider this relevant.

35. The Commissioner has considered all the relevant submissions she has received on this point, along with the withheld personal data.

36. The Commissioner considers that Ms K has a legitimate interest in the withheld information, as disclosure would provide transparency about individual(s) who donated significant sums of money to this organisation. This is, at least potentially, a matter of wider public interest and the Commissioner is satisfied that it is relevant in this case for the purposes of determining whether Ms K herself has a legitimate interest. In all the circumstances, she accepts that Ms K has a legitimate interest in obtaining the withheld personal data.

Is disclosure necessary to achieve those legitimate interests?

37. The Commissioner must now go on to consider whether disclosure of the withheld personal data would be necessary to meet the legitimate interest she has identified above. As indicated above, this will include consideration of whether the legitimate interest might be met by alternative means which interfere less with the privacy of the data subject.

38. In this case, the Commissioner has carefully considered all relevant submissions she has received, along with the withheld information. She accepts that the legitimate interest in transparency she has identified above cannot be met in full without disclosure of the withheld personal data. To that extent, disclosure is necessary, so she must go on to consider whether it would nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Would disclosure nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

39. The Commissioner has also taken account the submissions by both parties, and of her own briefing on the exemptions relating to personal data, published on her website[1].

40. RCS submitted that it was a condition of the donations that the identity of the donor(s) remained anonymous. It provided evidence of this, and also of the circumstances of the donations being considered fully by its auditors. She considers it is reasonable, in the circumstances, to regard the information as relating to the private life of the individual(s) concerned, which means that disclosure will generally be more likely to be unwarranted.

41. In relation to the individual(s) concerned, it is appropriate to consider what reasonable expectations they would have in relation to disclosure of the information concerned. In all the circumstances, having considered the information in question and all relevant submissions, the Commissioner does not believe the individual(s) concerned would have a reasonable expectation of disclosure. The evidenced condition of anonymity expressed by the donor(s) gives a clear indication of this.

42. Having considered these competing interests, the Commissioner must balance them. Having done so, in this particular case, the Commissioner finds that the legitimate interest in transparency is outweighed by the prejudice to the rights and freedoms of the data subject that would result from disclosure. Different considerations might apply if it were reasonable to conclude that any of the donations were from the proceeds of crime, were other than simply gratuitous, or were otherwise from a source it would be inappropriate for RCS to be associated with: the Commissioner can identify nothing to suggest that any of these considerations (or anything similar) are relevant in this case.

43. On balance, therefore, the Commissioner must find that the requirements of condition 6 cannot be met here.

44. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the remaining withheld information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.

Decision The Commissioner finds that the Royal Conservatoire of Scotland (RCS) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Ms K. The Commissioner finds that RCS was entitled to withhold the identity of the individual(s) who had donated sums exceeding ?100,000 under section 38(1)(b) of FOISA, and so complied with Part 1. However, by wrongly applying the exemption in section 38(1)(b) to the names of organisations that donated sums exceeding ?100,000, RCS failed to comply with Part 1. Given that RCS disclosed the names of these organisations to Ms K during the investigation, the Commissioner does not require RCS to take any action in respect of this failure.

 

Appeal

Should either Ms K or the Royal Conservatoire of Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

10 May 2016

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---