Decision 113/2011 Ms P and the University of Edinburgh

Information relating to employees' salaries, the applicant's complaint and temporary employment at the University

Reference No: 201001747
Decision Date: 9 June 2011

Summary

In three separate communications, Ms P requested from the University of Edinburgh (the University) information concerning the salaries of certain employees of the University, information relating to a complaint that she had made to the University and information concerning individuals who had undertaken temporary employment with the University. The University responded by providing some information to Ms P, advising her that some information was considered exempt from disclosure in terms of section 38(1)(a) of FOISA (on the basis that it was her own personal data) and advising her that the cost of complying with one of her requests would exceed the sum of ?600 prescribed for the purposes of section 12(1) of FOISA. Following a review, Ms P remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the University had dealt with Ms P's requests for information in accordance with Part 1 of FOISA by correctly withholding the information sought in her first and second information requests under the exemptions in section 38(1)(a) and 38(1)(b) of FOISA.He also found that the cost of complying with Ms P's third information request would exceed the specified cost limit and that the University was therefore not obliged to comply with it.

However, the Commissioner also found that the University had breached the timescales for responding under section 10(1) of FOISA in relation to Ms P's first information request.In so doing, the University failed to comply fully with Part 1 of FOISA when dealing with Ms P's first request.The Commissioner did not require the University to take any action in respect of this breach.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 10(1) (Time for compliance); 12(1) (Excessive cost of compliance); 15 (Duty to provide advice and assistance) and 38(1)(a) and (b), (2)(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions ? definition of "personal data") and Schedules 1 (The data protection principles ? the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost ? prescribed amount)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.This decision considers the University's handling of three information requests from Ms P. These are described as Ms P's first, second and third information requests in what follows.

Ms P's first information request

2.On 1 July 2010, Ms P emailed the University in the following terms:

Please disclose those financial information during the same period of time (2002/2003 up to 2010/2011 by year) while indicating the basic salary and the individual bonuses/salary supplement each receives/has received:

1.The Principal

2.Vice-Principals (if it is variable, please indicate clearly)

3.Head of Court

4.Court members (again if variable, explain clearly)

5.Head of College (again if variable, explain clearly)

6.Head of School (again if variable, explain clearly)

3.The University emailed Ms P on 29 July 2010 in relation to a related matter. In its email, the University also explained that it would respond separately in relation to the request concerning staff remuneration, apologising for the fact that this part of its response would take longer than the 20 working days allowed under FOISA.

4.On 30 July 2010, Ms P emailed the University indicating that she expected a response to her request concerning staff remuneration within 20 working days.The Commissioner considers this communication to constitute a request for review of the University's failure to respond to Ms P's request for information within the timescale required by section 10(1) of FOISA.

5.The University then responded to Ms P's first request on 5 August 2010. In relation to the respective members of staff, the University responded as follows (since the University had not provided any substantive response prior to Ms P submitting her request for review, the Commissioner considers this response also to notify her of the outcome of its review):

The University advised Ms P that the Principal's salary from 2000 onwards was published in the University's annual financial statements. It provided Ms P with a weblink showing where the Principal's salary information could be found on the University's website.

In relation to Heads of College and Vice-Principals, the University provided Ms P with tables showing statistical information on the salaries of its senior management team (which included Heads of College and Vice-Principals).The information provided showed the numbers of staff receiving salaries within bandings of ?10,000. The University also provided similar statistical information in relation to lump sum payments made to senior management team members.

In relation to the Head of Court and Court members, the University advised Ms P that these were not remunerated positions and, therefore, no salary or bonus was paid to these individuals.

In relation to Heads of Schools, the University advised Ms P that Heads of School are paid an allowance on top of their normal salary. It advised her of the salary scale within which their salaries have fallen and that the allowance they received was the greater of ?8,000 or the difference between their basic salary and the 9^th point of their salary scale.

Ms P's second information request

6.On 14 July 2010, Ms P emailed the University requesting any correspondence it had in relation to her complaint since the date she initially referred the problem to a named employee (which was before the formal submission of the complaint) and/or subsequent decisions the University made which related to her whether within the University itself or with third parties. Ms P went on to clarify that this should include information related to her formal complaint, suspension from studies, exclusion from studies and further matters dealing with any of these issues.

7.The University responded to this request (and other requests for information that are not the subject of this decision) on 27 July 2010.It advised Ms P that, as the requested information was about her and her complaint, it would be handled as a subject access request under the DPA rather than as a request under FOISA. It noted that, because this route exists, information about a requestor is exempt from disclosure under section 38(1)(a) of FOISA.

8.Also on 27 July 2010, Ms P emailed the University requesting a review of its decision to deal with her request under the DPA. In particular, Ms P indicated that she wished the review to be handled in terms of FOISA on the basis that she was uncertain whether all of the requested information could be released under the DPA and that some of the information may not comprise her own personal data.

9.The University wrote again to Ms P on 30 July 2010. It reiterated its view that all of the requested information would be likely to come under the subject access provisions of the DPA. However, the University also stated that should any information be identified that was not about Ms P, it would process that information under FOISA.

10.The University subsequently responded to Ms P's information request in terms of the DPA, on 30 September 2010.It disclosed a range of personal data to her, but withheld some of the information on the grounds that it was exempt from disclosure to her under the DPA.

11.The University's letter of 30 September 2010 also reiterated that because the DPA provides a route for a person to access their own personal data, personal data about the requestor is exempt from disclosure under section 38(1)(a) of FOISA.The University confirmed that, in handling this request, it had found no information about Ms P that would not be covered by her subject access rights under DPA.It stated again that the information was entirely exempt from disclosure under section 38(1)(a) of FOISA.The Commissioner considers the letter of 30 September to give notice to Ms P of the outcome of its review of its handling of her request in terms of FOISA.

Ms P's third information request

12.On 3 September 2010, Ms P emailed the University requesting the names of all individuals who undertook short term, temporary or additional employment or contracts or any sort of service with the University since December 2008 where those jobs or services were not advertised through the University's website. Ms P indicated that this did not include anyone hired to undertake building maintenance, construction or engineering tasks. Within this communication, Ms P supplied a list of 58 individuals or groups of people about whom she had a particular interest.

13.The University responded on 27 September 2010, advising Ms P that it considered the cost of complying with the request would exceed the ?600 limit set out in the Fees Regulations and, therefore, that it was not obliged to comply with the request. The University did however advise Ms P that it had checked the list which she had supplied with her request and had identified that 14 of the individuals on the list were University employees. The University stated that it had checked its records for these individuals and had established that none had ever held a post that was not advertised on the University website.

14.On 4 October 2010, Ms P emailed the University requesting a review of its decision. In subsequent correspondence with the University, Ms P stated that she believed the University should hold organised accounting records which would mean her request could be easily processed.

15.The University notified Ms P of the outcome of its review on 10 November 2011 upholding its decision that it was not obliged to comply with the request on the basis that the cost of compliance would exceed the ?600 cost threshold.

16.On 6 September 2010 and 8 November 2011 and, in a supplemental application dated 14 November 2011, Ms P wrote to the Commissioner, stating that she was dissatisfied with the outcome of the University's reviews and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

17.The application was validated in relation to the three requests described above by establishing that Ms P had made requests for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its responses to those requests. The case was then allocated to an investigating officer.

Investigation

18.On 9 December 2010, the University was notified in writing that an application had been received from Ms P. Given the complexity and volume of correspondence from Ms P, the investigating officer subsequently discussed the matters under consideration with the University with a view to clarifying and establishing which aspects of the application were valid for the purposes of FOISA.

19.The investigating officer subsequently contacted the University, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the University was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.

20.In its response, the University confirmed with respect to Ms P's three requests that it considered the following provisions in FOISA to be applicable:

section 38(1)(b), in relation to the personal data of University staff sought by Ms P's first request;

section 38(1)(a) in relation to the information (concerning Ms P's own complaint and related matters) sought by in her second request, and

section 12(1) in relation to the third information request.It also explained the advice and assistance it had provided to Ms P in pursuit of the University's obligations under section 15(1) of FOISA in relation to this request.

21.During the investigation, it became apparent that the volume of information held by the University made it difficult for the University to supply the Commissioner with all of the withheld information. However, at the University's invitation, two members of the Commissioner's staff viewed a sample of the withheld information within the University's premises.

22.The investigating officer also contacted Ms P during the investigation seeking submissions on the matters to be considered in the case. Her submissions, along with those of the University are summarised and considered (where relevant) in the Commissioner's analysis and findings section below.

Commissioner's analysis and findings

23.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Ms P and the University and is satisfied that no matter of relevance has been overlooked.

The scope of the investigation

24.The Commissioner is aware that there has been a lengthy history of complex and often overlapping correspondence between Ms P and the University which has included a number of information requests under both FOISA and the DPA. It should be noted that the requests reproduced at paragraphs 2, 6 and 12 above do not comprise all of the requests submitted by Ms P to the University, nor do they comprise all of the matters which she asked the Commissioner to consider in her application.

25.In reviewing the correspondence submitted by Ms P, the Commissioner concluded that he was not legally entitled to consider some of the matters that she wished the Commissioner to consider, and so he was unable to validate her application insofar as it related to these matters.

26.This decision will therefore only consider the requests noted at paragraphs 2, 6 and 12 above.

Ms P's first information request

27.As noted above, the University provided Ms P with a weblink showing the Principal's salary for the periods under consideration and provided statistical data concerning the salaries of the other employees.

28.In her application to the Commissioner, Ms P indicated that she expected that payments made to senior management should be disclosed in ?5000 bands and that all payments made to the Principal should also be disclosed.

29.Ms P also expressed dissatisfaction with the University's failure to respond to this request within 20 working days.

Section 38(1)(b) of FOISA ? personal information

30.The University applied the exemption in section 38(1)(b) to the information sought in the first information request which related to the salaries and payments made to senior staff.

31.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)), exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA. This exemption is absolute in that it is not subject to the public interest test laid down by section 2(1)(b) of FOISA.

32.The University has withheld the information sought in relation to staff salaries under section 38(1)(b) of FOISA, arguing that it is personal data, the disclosure of which would contravene the first data protection principle.

Is the information personal data?

33.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

34.In this case, the Commissioner is satisfied that the withheld information clearly relates to living individuals, who can be identified from that information (disclosing the information will confirm that a named University employee is paid a salary within a certain band). He is therefore satisfied that this information is the employees' personal data.

Would disclosure breach the first data protection principle?

35.The University has argued that the release of the information would breach the first data protection principle.

36.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure in response to Ms P's information request.

37.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the personal data in this case does not fall into any of the relevant categories.It is therefore not necessary to consider the conditions in Schedule 3 in this case.

38.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

39.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.

Can any of the conditions in Schedule 2 to the DPA be met?

40.When considering the conditions in Schedule 2 of the DPA, the Commissioner has noted Lord Hope's comment in the case of the Common Services Agency v Scottish Information Commissioner[1] (the Collie judgement) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.

41.The Commissioner considers condition 6 to be the only condition in Schedule 2 which might permit disclosure in this case. Condition 6 permits personal data to be processed if the processing (which in this case would be by disclosure in response Ms P's information request) is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights, freedoms or legitimate interests of the data subject (the individual(s) to whom the withheld information relates). It is clear from the wording of this condition that each case will turn on its own facts and circumstances.

42.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met.These are:

Does Ms P have a legitimate interest in obtaining the personal data?

If yes, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?

Even if the processing is necessary for Ms P's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Ms P must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the personal data to Ms P.

Does the applicant have a legitimate interest?

43.When asked why she considered that she had a legitimate interest in the disclosure of the information she had asked for, Ms P stated that there was a high public interest in knowing if the individuals whose salaries she had requested had a conflict of interest whilst making statements about her to the University.Additionally, she argued that there was a high public interest in knowing why anyone was paid an amount above their regular salary, in order to prevent the misuse of public funds.

44.The Commissioner has considered the submissions made by Ms P and accepts that members of the public are entitled to have some insight into the salaries of, and additional payments made to, staff employed by public authorities.

45.The Commissioner notes that, in this case, the University has provided Ms P with details of the Principal's salary and statistical information about senior staff salaries in ?10,000 bandings.

46.Whilst the Commissioner would not wish to diminish the importance to Ms P of the matters with which she has raised concerns, he does not consider that there is any evidence of the conflict of interest she expressed concern about or, indeed, of the misuse of public funds in this case.

47.The Commissioner considers that, to the extent there is a wider legitimate public interest in knowing the salaries of the employees identified by Ms P, this could be satisfied in this instance from the information already supplied to her by the University.

48.In conclusion, therefore, the Commissioner is not persuaded that Ms P has a legitimate interest in obtaining the personal data withheld by the University in the detail she has requested.

49.As the Commissioner considers that Ms P does not have a legitimate interest in obtaining the information withheld by the University, he is satisfied that condition 6 of Schedule 2 is not met in this case.

50.Since no condition within Schedule 2 of the DPA can be met in this case, the Commissioner has concluded that disclosure would breach the first data protection principle. Accordingly, the information is exempt from disclosure and was properly withheld by the University in terms of section 38(1)(b) of FOISA.

Section 10 of FOISA (Time for compliance)

51.In her application to the Commissioner, Ms P expressed dissatisfaction at the University's failure to respond to this request for information within the timescale prescribed in FOISA.

52.Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days from receipt of the request, or subsequent clarification of that request, to comply with a request for information, subject to certain exceptions which are not relevant in this case.

53.In this case, the University did not provide a substantive response to Ms P's request of 1 July 2010 concerning staff salaries within the 20 working days allowed by section 10(1) of FOISA.

54.The Commissioner therefore finds that the University failed to respond to Ms P's first information request within the 20 working days allowed by section 10(1) of FOISA, and in so doing, it breached Part 1 of FOISA in its handling of this request.

55.The Commissioner notes that this failure took place in the context of an extremely large volume of correspondence and information requests from Ms P which were complex and often overlapping. In the circumstances, he does not require the University to take any action in relation to this breach in response to this decision.

Ms P's second information request

56.Ms P's second request is summarised at paragraph 6 above.The University applied the exemption in section 38(1)(a) of FOISA to the information requested by Ms P on the basis that it comprised her own personal data.

57.It went on to disclose much information falling within the scope of this request to Ms P in pursuit of her subject access rights under the DPA.However, when doing so, it withheld some information on the grounds that it was entitled to do so under the DPA.

58.The University submitted that all of the information that it had identified as falling within the scope of this request had been found to be Ms P's own personal data.

59.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.The fact that it is absolute means that it is not subject to the public interest test set out in section 2(1) of FOISA.

60.This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a "subject access request") under section 7 of the DPA.This ensures that such information is disclosed to the data subject (rather than to the world at large, which is the effect of disclosure under FOISA) under a regime designed for such purposes.It is not one of the purposes of FOISA to give the data subject a more extensive right of access to their own personal data than they would enjoy under the regime primarily governing the processing of that data, even if the applicant might wish that to be the case.

61.The question of whether or not a person is entitled to receive the personal data under consideration in response to a subject access request under the DPA is not relevant to the Commissioner's consideration of section 38(1)(a) of FOISA.If the Commissioner is satisfied that the information is the applicant's personal data, then the exemption in section 38(1)(a) will apply, and the Commissioner cannot consider the matter further.

62.The definition of personal data is set out in paragraph 33 above.

63.Having reviewed the precise terms of Ms P's second information request, the Commissioner considers it highly unlikely, if not impossible, that any information could fall within its terms and yet not be Ms P's personal data.

64.As noted above, two members of the Commissioner's staff viewed the majority of the information that was identified as falling within the scope of Ms P's second request within the University premises.This included both the information that was disclosed to and withheld from Ms P when this request was considered in terms of the DPA.

65.Having done so, they were satisfied that all information falling within the scope of Ms P's request (and which was either disclosed to her or withheld when the University responded to her request in terms of the DPA) related to her as an individual.They were also satisfied that Ms P could be identified from that data either directly or with reference to other information in the possession of the University.

66.The Commissioner has therefore concluded, given the specific terms of this request and the views of the members of his staff who viewed the information as mentioned above, that the information withheld by the University does comprise Ms P's personal data. He therefore finds that the University was correct in its application of section 38(1)(a) of FOISA to this information.

67.As noted above, the exemption in section 38(1)(a) of FOISA is an absolute one and the Commissioner is therefore not required to go on to consider whether the public interest lies in the information being released or withheld.

68.The Commissioner therefore finds that the University complied with Part 1 of FOISA by refusing to supply the requested information to Ms P in response to her request made in terms of FOISA.

Ms P's third information request

69.This request sought the names of all individuals who undertook short term, temporary or additional employment or contracts or any sort of service with the University since December 2008 where those jobs or services were not advertised through the University's website.In its response to this request, the University advised Ms P that it considered the cost of complying with the request would exceed ?600.

70.Section 12(1) provides that a Scottish public authority is not obliged to comply with a request for information where the cost of doing so (on a reasonable estimate) would exceed the relevant amount prescribed in the Fees Regulations. This amount is currently set at ?600 in terms of regulation 5 of the Fees Regulations.

71.Consequently, the Commissioner has no power to require the release of information should he find that the cost of responding to a request for information exceeds this amount.

72.The projected costs the public authority can take into account in relation to a request for information are, according to regulation 3 of the Fees Regulations, the total costs, whether direct or indirect, which the authority reasonably estimates it is likely to incur in locating, retrieving and providing the information requested in accordance with Part 1 of FOISA. The public authority may not charge for the cost of determining (i) whether it actually holds the information requested or (ii) whether or not it should provide the information. The maximum rate a Scottish public authority can charge for staff time is set at ?15 per hour.

73.The University explained that, within her request, Ms P had included a list of individuals, or groups of individuals, about whom she was particularly interested. It had identified that 14 of those individuals were University employees.However, on checking its records, it established that none had ever held a post that was not advertised on the University's website.

74.The University also explained that it did not hold a single database with information on the method of recruitment for all posts and it would therefore have to search the individual files relating to all members of staff who had started working at the University during the relevant time period. The University indicated that this would include almost 3,000 staff files.

75.The University explained that it had estimated that it would take approximately 10 minutes to check each file, which gave a total of 473.5 hours. The University stated that this would be conducted by a member of staff charged at ?15 per hour. The University also submitted that it had estimated that additional administrative and photocopying tasks would bring the total cost to ?8357.54.

76.In her submissions, Ms P stated that she believed the University should have an excellent financial database and that this should not be a time consuming task for any trained professional.

77.The Commissioner has given consideration to the submissions made by both parties in this case and overall is satisfied with the University's arguments as to the tasks that would require to be undertaken and the likely time involved in locating, retrieving and providing any relevant information requested by Ms P.

78.The Commissioner has considered whether it would be necessary that the work required to check each employee's file should be carried out by a member of staff charged at a rate of ?15 per hour. However, even if the work could be carried out by a member of staff on a lower salary scale, the cost of providing the information would still considerably exceed the prescribed amount of ?600.

79.Having taken due account of the submissions made by Ms P and the University, together with the terms of section 12(1) of FOISA and the Fees Regulations, the Commissioner is satisfied that the costs of complying with Ms P's information request would exceed the ?600 prescribedlimit set out in the Fees Regulations. Therefore, the Commissioner concludes that the University was correct in its application of section 12(1) of FOISA and was under no obligation to comply with the information request made by Ms P.

Section 15 of FOISA ? Duty to provide advice and assistance

80.Section 15 of FOISA requires a Scottish public authority, so far as it is reasonable to expect it do so, to provide advice and assistance to a person who has made, or proposes to make, a request for information to it. Examples of such advice and assistance given in the Scottish Ministers' Code of Practice on the discharge of functions by public authorities under FOISA include, in cases where section 12(1) applies, "an indication of what information could be provided within the cost ceiling".

81.In response to the investigating officer's questions, the University explained that, as Ms P's request was so wide-ranging, it did not consider it possible to make any suggestions that would provide her with any approximation to the information that she was seeking within the ?600 cost threshold. The University also pointed out that, in her correspondence, Ms P had identified 58 individuals or groups of individuals about whom she had a particular interest. The University considered that it had responded to this aspect of her request in full and considered that, in doing so, it had met its obligation to assist Ms P in making a request below the cost threshold.

82.In the circumstances of this case and, having regard to the nature of the information request, the response provided by the University to Ms P and the explanation provided by the University, the Commissioner is satisfied that that the Universitymet the requirements of section 15 of FOISA in this particular case.

DECISION

The Commissioner finds that the University of Edinburgh (the University) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) when responding to Ms P's first information request.In relation to this request, the Commissioner finds that the University complied with Part 1 of FOISA by correctly withholding the information requested on the grounds that it was exempt from disclosure under section 38(1)(b) of FOISA.

However, the Commissioner finds that the University failed to respond to Ms P's first information request in line with the timescale required by section 10(1) of FOISA and, in doing so, failed to comply with Part 1 of FOISA. The Commissioner does not require the University to take any action in relation to this breach in response to this decision.

The Commissioner finds that the University complied fully with Part 1 of FOISA when responding to Ms P's second and third information requests.

He finds that the University complied with Part 1 of FOISA by correctly withholding the information requested in Ms P's second information request on the grounds that it was exempt from disclosure under section 38(1)(a) of FOISA.

The Commissioner finds that by applying section 12(1) of FOISA in response to Ms P's third information request, the University complied with Part 1. The Commissioner is also satisfied that the University provided reasonable advice and assistance to Ms P in terms of section 15(1) of FOISA.

Appeal

Should either Ms P or the University wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
9 June 2011

Appendix

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

(i)paragraphs (a), (c) and (d); and

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

10 Time for compliance

(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-

(a) in a case other than that mentioned in paragraph (b), the receipt by the authority of the request; or

(b) in a case where section 1(3) applies, the receipt by it of the further information.

?

12Excessive cost of compliance

(1)Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.

15 Duty to provide advice and assistance

(1) A Scottish public authority must, so far as it is reasonable to expect it to do so, provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

(2) A Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 is, as respects that case, to be taken to comply with the duty imposed by subsection (1).

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004

3 Projected costs

(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.

(2) In estimating projected costs-

(a) no account shall be taken of costs incurred in determining-

(i) whether the authority holds the information specified in the request; or

(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and

(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed ?15 per hour per member of staff.

5 Excessive cost - prescribed amount

The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is ?600.

[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm