Decision 114/2010 Kenneth Roy, Editor of the Scottish Review and Shetland Health Board
Salary and pension information relating to Board members
Reference No: 201000151
Decision Date: 5 July 2010
Summary
Kenneth Roy of the Scottish Review (Mr Roy) requested from Shetland Health Board (NHS Shetland) information relating to the salary and pension costs of six named board members that had been withheld from NHS Shetland's 2007 ? 2008 annual accounts. NHS Shetland responded by withholding the information on the basis that it was personal information. Following a review, Mr Roy remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that NHS Shetland had partly failed to deal with Mr Roy's request for information in accordance with Part 1 of FOISA.He found that NHS Shetland was entitled to withhold the precise remuneration information on the grounds that this was exempt from disclosure under section 38(1)(b) of FOISA.However, the Commissioner concluded that thisinformation was not exempt from disclosure where it was presented in terms of bands which do not reveal precise remuneration.The Commissioner therefore found that NHS Shetland acted in breach of Part 1 of by refusing to supply the information in this form.
The Commissioner also found that NHS Shetland's response to Mr Roy failed to comply with the requirements to specify the exemption being applied and to explain the right to request a review and to apply to the Commissioner for a decision. As NHS Shetland provided Mr Roy with the withheld information during the course of the investigation, the Commissioner did not require NHS Shetland to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (general entitlement), 16(1) (refusal of request), 19 (content of notices), 38(1)(b) with 38(2)(a)(i) and 38(5) (personal information)
Data Protection Act 1998 (the DPA) section 1(1) (basic interpretive provisions) and schedules 1(1) (first data protection principle) and 2(1) & (6) (conditions relevant for purposes of first principle: processing of any personal data)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 21 December 2009, Mr Roy, the Editor of the Scottish Review, sent an email (timed 12:15) to NHS Shetland requesting the remuneration, including pension details where applicable, of six named board memberswhose consent to disclosure in the annual accounts of Shetland NHS Board for 2007-08 was withheld.
2.NHS Shetland responded by email timed 14:52 on the same day, indicating that the information requested was exempt from disclosure as it was personal information covered by the Data Protection Act 1998 (DPA). NHS Shetland further indicated that individuals had the right to exercise individual choice about whether to disclose their salary or not. This email did not refer to any exemption in FOISA or provide Mr Roy with information regarding his right to request a review of this decision or to subsequently apply to the Commissioner for a decision.
3.Mr Roy requested a review of this decision in an email timed 15:36 also on 21 December 2010, and highlighted the failure of NHS Shetland to inform him of his rights of review and application to the Commissioner under sections 20(1) and 47(1) of FOISA. At 18:37 that day NHS Shetland sent an email acknowledging Mr Roy's request for review in which it indicated that the information was considered exempt under section 38 of FOISA.
4.NHS Shetland notified Mr Roy of the outcome of its review on 6 January 2010. NHS Shetland upheld its original decision that the information was exempt under FOISA as it was personal information covered by the DPA.
5.On 21 January 2010, Mr Roy wrote to the Commissioner, stating that he was dissatisfied with the outcome of NHS Shetland's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Roy had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 15 February 2010, NHS Shetland was notified in writing that an application had been received from Mr Roy and was asked to provide the Commissioner with any information withheld from him. NHS Shetland responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted NHS Shetland, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, NHS Shetland was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
9.In its response NHS Shetland clarified that it was relying on the exemption in section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) to withhold the information as it believed that disclosure would breach the first data protection principle. NHS Shetland indicated that the salary details of staff members was confidential information that cannot be disclosed without the staff members' consent and that consent had not been given by the six named Board members.
10.NHS Shetland indicated that it had considered the conditions that might permit lawful processing of the information contained in Schedule 2 of the DPA but did not find any condition that applied on this occasion. In response to a specific question relating to the legitimate interest considerations contained in Condition 6 of Schedule 2, NHS Shetland indicated that while it had not sought any information from the applicant it seemed fairly clear that his key interest was being able to publish the information on a news website in the hope that by including this information the website would attract more interest. NHS Shetland indicated that it did not consider this to be a legitimate interest.
11.NHS Shetland further indicated that in withholding salary and pension information from its annual accounts where a staff member had not consented to its publication it was following advice contained in NHS Scotland Final Accounts Manual. NHS Shetland provided a copy of the 2007-2008 version of the manual[1] and referred in particular to a section entitled Data Protection Act:
In order to comply with the Data Protection Act 1998 employers are required to obtain the prior consent of the individuals concerned before personal data such as that on salaries and pensions can be disclosed.
Boards should consult the individuals whose data they would wish to disclose and seek to obtain their consent to do so (where consent has not already been given) before disclosing that data. The individual must be free to withhold consent, however where an individual relies on the Data Protection Act 1998 and withholds his/her consent then the words 'consent to disclosure withheld' should be disclosed against the name(s) of the appropriate individual(s) in the table.
Consent can be obtained once for all future accounting periods in which the employee is employed by the Board. In view of the importance attached to full disclosure, employers should ensure that it is made clear to individuals moving to posts for which disclosures are required, before they take up such posts, that the post has been designated as one where disclosure of salary and pension details is required."
12.NHS Shetland was subsequently asked to consider the guidance[2] issued by the Information Commissioner's Office (ICO) regarding the disclosure of public sector salaries and asked a further series of questions in relation to its decision to withhold the information in the context of that guidance. NHS Shetland indicated in response to that request that it had discussed the ICO guidance with the six named board members and there was agreement that no more time should be spent on this "non-productive" issue. Accordingly NHS Shetland has sought, and received, the consent of these board members to disclose the information requested to Mr Roy.
13.Mr Roy was contacted and asked to consider if he wished to withdraw his application in light of NHS Shetland now providing him with the withheld information. Mr Roy, who had previously identified to the Commissioner that his interest in obtaining the information was underpinned by a belief in greater transparency regarding the salary and pension costs of senior health service staff, indicated that he did not believe that NHS Shetland had yielded on the principle of the issue of disclosure. Mr Roy therefore did not feel it appropriate to withdraw his application and confirmed that he wished to receive a decision from the Commissioner.
Commissioner's analysis and findings
14.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Roy and NHS Shetland and is satisfied that no matter of relevance has been overlooked.
15.This decision is unusual, in that the information under consideration in what follows had been disclosed to Mr Roy by the time of its writing.Before continuing, the Commissioner would note that he has considered (as he is required to do in any decision) the application of the exemption in section 38(1)(b) to the information that was withheld in the circumstances that existed at the time when the NHS Shetland notified Mr Roy of the outcome of its review, and disregarding any developments since that time (including the disclosure of the withheld information to Mr Roy).
The Withheld information
16.The information requested by Mr Roy and withheld by NHS Shetland was remuneration, including pension details where applicable, of six named board members whose consent to disclosure in the annual accounts of Shetland NHS Board for 2007-08 was withheld.
17.The Commissioner notes that the disclosure of remuneration and pension details of board members within the annual accounts did not include precise figures, but instead revealed salary information within ?5,000 bands.Reading Mr Roy's request in that context, the Commissioner is not certain as to whether it was intended to seek precise information about the remuneration of the remaining Directors, or less detailed information in the same format set out in the annual accounts.
18.However, when responding to the Commissioner's request for the withheld information, NHS Shetland provided the precise figures relating to each relevant Director.This was also he information ultimately disclosed to Mr Roy after consent to that disclosure was granted during the investigation.The Commissioner therefore considers that NHS Shetland has interpreted his request to have been seeking the precise remuneration and pension details, and has considered this to be the withheld information in this case.
Application of the exemption in section 38(1)(b)
19.NHS Shetland confirmed during the investigation that it was relying on the exemption contained in section 38(1)(b) of FOISA, to withhold the information requested by Mr Roy on the basis that the information requested was personal data, disclosure of which would (in the absence of the data subjects' consent to disclosure that was granted during the investigation) breach the first data protection principle.
20.Section 38(1)(b), read in conjunction with section 38(2)(a)(i), exempts information from disclosure if it is personal data (as defined by section 1(1) of the DPA) and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles set out in Schedule 1 to the DPA. The exemption is absolute and therefore is not subject to the public interest test in section 2(1)(b) of FOISA.
Is the withheld information personal data?
21.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
22.Having considered the nature of the withheld information, the Commissioner accepts that it is personal data. The salary information clearly relates to living individuals who can be identified from the information, either by itself or read in conjunction with other information in the possession of (or likely to come into the possession of) the data controller.
Would disclosure of the information breach the first data protection principle?
23.In this case, NHS Shetland argued that disclosure of the information would have breached the first data protection principle. The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met, and, in the case of sensitive personal data at least one of the conditions in Schedule 3 (to the DPA) is also met. In this case, processing would be by disclosure in response to Mr Roy's information request.
24.Having considered the withheld information, the Commissioner is satisfied that it does not fall into any of the categories of sensitive personal data listed in section 2 of the DPA.
25.The Commissioner has first considered the application of the conditions in Schedule 2.
26.As noted above, during the investigation, NHS Shetland sought and received consent from the data subjects to the disclosure of the information that was previously withheld, and this information was disclosed to Mr Roy only after this consent was granted.This consent ensured that Condition 1 within Schedule 2 was met at that stage.
27.However, the Commissioner understands that the data subjects had not provided consent to disclosure of the information under consideration prior to that point.Therefore, Condition 1 could not be met at the time when NHS Shetland conducted its review.
28.In the circumstances of this case, Condition 6 would appear to be the only condition which might have permitted disclosure at the relevant time.
29.Condition 6 permits personal data to be processed if the processingis necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights, freedoms or legitimate interests of the data subject.It is clear from the wording of this condition that each case will turn on its own facts and circumstances.
30.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a.Does Mr Roy have a legitimate interest in obtaining these personal data?
b.If yes, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?
c.Even if the processing is necessary for the legitimate purposes of Mr Roy, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s) in this case the named staff? This will involve a balancing exercise between the legitimate interests of Mr Roy and those of the data subjects. Only if (or to the extent that) the legitimate interests of the Mr Roy outweigh those of the data subject(s) can the personal data be disclosed.
31.NHS Shetland commented that it seemed that the key interest that the applicant had in this case was to be able to publish the salary details on a news website.It maintained that this was not a legitimate interest.
32.Mr Roy is Editor of the Scottish Review, a publication produced by the Institute of Contemporary Scotland (ICS)[3].He explained that ICS had initiated a research project on standards of transparency in Scottish public life, and had undertaken associated campaigns for increased transparency in relation to public bodies that it considered to fall short of reasonable standards of transparency. This project had also aimed to produce a league table of Scotland's highest earners.Mr Roy noted that difficulties had been encountered in this respect, and it had been established that a number of health boards (including NHS Shetland) did not publish in their annual accounts full details of the remuneration of executive and non-executive members of the board.
33.Mr Roy asserted that in a recession and a period where public sector jobs were threatened, remuneration of senior managers was a matter of significant public interest.He highlighted public comments by ministers and politicians who had highlighted concerns regarding what they considered to be "excessive remuneration" paid to some senior public sector employees, and calling for greater transparency in this area.He noted that there appeared to be political consensus in this area, but practical problems in enforcing a culture of transparency if individuals were entitled to refuse to consent to disclosure of information regarding their remuneration.
34.The Commissioner agrees with Mr Roy that remuneration of senior public sector employees is a matter of general public interest, and he accepts that he has a legitimate in accessing the information under consideration in this case.There is a legitimate interest in access to details of the remuneration of the particular individuals identified by Mr Roy, who are all board members in NHS Shetland, because this would allow a more fully informed debate about remuneration of senior staff both within NHS Shetland, and across the public sector.
Is disclosure of the information necessary to achieve those legitimate interests?
35.Having decided that the applicant has a legitimate interest, the Commissioner has to consider whether disclosure of the withheld information is necessary to achieve these legitimate aims.
36.The Commissioner notes that while the particular information requested by Mr Roy was not published in NHS Shetland's annual accounts, a section therein entitled "Higher paid employees remuneration" contains a chart indicating the number of employees whose remuneration falls within salary bands with ?10,000 increments.While this provides some information that would allow some insight into salaries paid to senior staff, it would not allow comparison of remuneration of specific posts within NHS Shetland or analysis across the public sector as a whole.
37.Given the limitations of the information that is publicly available, the Commissioner cannot envisage any alternative means of meeting the legitimate interests identified by Mr Roy while interfering less with the privacy of the relevant data subjects.The Commissioner concludes that disclosure of the specific information requested by Mr Roy is necessary to achieve these legitimate interests.
Would disclosure cause unwarranted prejudice to the rights and freedoms of the data subjects?
38.NHS Shetland maintained that disclosure of the withheld information would prejudice the rights of the data subjects to have their financial affairs kept confidential and also to their right to a private life.
39.As noted above, NHS Shetland indicated that it had followed the advice contained in the NHS Scotland Final Accounts Manual as outlined in paragraph 11 above.
40.The Commissioner has considered this guidance, and first of all noted that it appears to be somewhat misleading since it suggests that a lack of consent should be treated as the sole consideration when deciding whether details of an individuals' remuneration should be disclosed.
41.As noted above, determining whether the first data protection principle will or will not be breached involves consideration of fairness, lawfulness and conditions within schedule 2 (and where sensitive personal data is concerned, also schedule 3) of the DPA.
42.The granting of consent to processing by a data subject ensures that condition 1 in schedule 2 applies and also makes it likely that the processing will be fair.The Commissioner does not consider there to be anything within the DPA to suggest that a data subject's decision not to give consent to processing should automatically lead to processing being judged to be unfair, or infer that no schedule 2 condition (other than condition 1) could be met.
43.Notwithstanding his concerns about the legal accuracy of the paragraphs cited by NHS Shetland, the Commissioner accepts that their content would be likely to create an expectation on the part of the data subjects that details of their remuneration will not be disclosed (within the relevant annual accounts, but presumably also in response to a request under FOISA) if they withheld their consent.This expectation must be given some weight when considering the balance between the legitimate interests of Mr Roy and the data subjects.
44.When considering the balance of legitimate interests in this case, the Commissioner has had regard to theguidance note produced by the Information Commissioner (who is responsible for the enforcement of the DPA) entitled "Public Sector Salaries ? how and when to disclose", previously mentioned in paragraph 12 above.This document is referred to in what follows as "the guidance".
45.The guidance makes it clear that those who are paid from the public purse should expect some information about their salaries to be made public.However, it also notes that salary information relates to individuals' personal financial circumstances and so deserves some protection.
46.In particular, the guidance notes that only in exceptional circumstances is disclosure of exact pay likely to be justified.The Commissioner suggests instead that, where disclosure of salary bands alone is insufficient to satisfy a legitimate interest in knowing remuneration levels, it may be appropriate to consider disclosing an approximate amount paid to an individual, for example to the nearest ?5,000.
47.This approach to banding of salary information also accords with HM Treasury guidance on the disclosure of public sector salaries and pension benefits.[4] This guidance indicates that salary and total accrued pension values should be disclosed in bandings of ?5000 and the real increase in pension value should be disclosed in bandings of ?2500. The Commissioner also notes that these bandings are included in the title row of the template contained within the NHS Shetland annual accounts albeit with the relevant information relating to the six named board members excluded.
48.When addressing the expectations of the individual concerned, the guidance highlights a number of factors for consideration:
a.how senior their role is, including their level of accountability and personal responsibility;
b.whether they have a public profile or public facing role;
c.whether they are responsible for major policy decisions or expenditure of public funds
49.Other points made in this guidance include
a.more senior staff who are responsible for major policy and financial initiatives can expect greater scrutiny of their pay than more junior employees.
b.the fact that an individual has not been warned that their salary would be disclosed under FOI will not necessarily be a bar to disclosure;
c.you should take into account whether salaries for this type of post are generally made public.
50.Having had regard to all of the above, the Commissioner notes that the information withheld relates to staff employees at the most senior level as board members in NHS Shetland.As Board members, they are responsible for decision making about policy and expenditure by the Board.He notes also that it is increasingly common practice across the public sector to disclose details of remuneration of directors or board members.The Commissioner considers that all of these factors contribute to an expectation (notwithstanding the NHS guidance referred to by NHS Shetland) that details of remuneration for employees at board level would be disclosed in response to a request under FOISA.
51.The Commissioner has balanced the legitimate interests identified by Mr Roy against those of the data subjects.In so doing, he has given weight to the interests of the data subjects in maintaining the privacy of their financial affairs, and their express refusal (at the relevant time) to consent to the inclusion of details of their remuneration in the annual accounts of NHS Shetland.He accepts that disclosure in this case would have caused some intrusion into the private lives of the data subjects, and he accepts that disclosure of the exact remuneration of the individuals concerned, without their consent to disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.
52.For the precise remuneration information requested by Mr Roy, therefore, the Commissioner accepts that condition 6 of Schedule 2 of the DPA could not be met, and since consent had not been granted at the time of the review, no condition within Schedule 2 could be met at the time of NHS Shetland's review of Mr Roy's information request.As a result, it would have breached the first data protection principle to provide in full the information requested by Mr Roy.
53.However, the Commissioner considers that the level of intrusion into the private lives of the individuals concerned would be limited if the remuneration information was disclosed in a form which showed remuneration in terms of ?5000 bands, and increases in pension value in terms of ?2,500 bands.The Commissioner notes that this would be in line with the approach suggested by the guidance issued by the Information Commissioner and HM Treasury, and also the disclosure for other members of staff within NHS Shetland's Annual Accounts.
54.When considering the balance of the legitimate interests identified by Mr Roy against those of the data subjects, the Commissioner considers that the legitimate interests of Mr Roy outweigh those of the data subjects.In this form, he does not accept that the disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.He therefore accepts that Condition 6 could (at the time of the review) be met with respect to the information requested by Mr Roy, where it is presented in the form of the bands described above.
55.Having reached this conclusion, the Commissioner has gone on to consider whether (as required by the first data protection principle) disclosure of the information requested by Mr Roy in the form described in paragraph 53 would also have been fair and lawful at the time of NHS Shetland's review of Mr Roy's request.
56.The Commissioner considers that disclosure would be fair, for the reasons already outlined in relation to condition 6.NHS Shetland has not put forward any arguments as to why the disclosure of the information would be unlawful (other than in terms of a breach of the data protection principles) and, in any event, the Commissioner can identify no reason why disclosure should be considered unlawful.
57.The Commissioner therefore finds that NHS Shetland acted appropriately by withholding the precise remuneration requested by Mr Roy in terms of section 38(1)(b) because (prior to the granting of consent to such disclosure by the data subjects during the investigation), disclosure of this information would have breached the first data protection principle.
58.However, the Commissioner considers that the information showing the approximate remuneration (expressed in terms of bands as discussed above) could have been disclosed without any breach of the first data protection principle.For this information, the Commissioner concludes that the Council wrongly applied the exemption in section 38(1)(b) of FOISA.
59.Since NHS Shetland has released the requested information in full to Mr Roy during the course of the investigation, the Commissioner does not require any action to be taken in response to this decision.
60.The Commissioner is also pleased to note that NHS Shetland has informed him that it has now introduced a local policy requiring the inclusion of salary and pension information of all board and senior management team members in its annual accounts.
Content of Refusal Notice
61.Section 16(1) of FOISA indicates that, subject to the provisions contained in Section 18 of FOISA, when claiming that information is exempt a Scottish public authority must issue a notice, in writing, to the applicant which:
a.discloses that it holds the information;
b.states that it so claims;
c.specifies the exemption in question; and
d.states (if not otherwise apparent) why the exemption applies.
62.Section 19 of FOISA requires that a refusal notice issued under Section 16(1) must contain particulars ?
a.of the procedure provided by the authority for dealing with complaints about the handling by it of requests for information; and
b.about the rights of application to the authority and the Commissioner conferred by sections 20(1) and 47(1).
63.The email response from NHS Shetland to Mr Roy sent on 21 December 2009 at 14:52 was in effect a refusal notice that simply stated that the information was exempt because it was personal information covered by the DPA. This refusal notice did not conform to the requirements of section 16(1) as it did not state that NHS Shetland held the information or identify which exemption NHS Shetland considered to be engaged. Additionally, the refusal notice did not contain any of the information required to be provided in accordance with section 19 of FOISA.
64.The Commissioner is disappointed to note that despite being reminded of its responsibilities in relation to making an applicant aware of their right to review in an email from Mr Roy sent at 15:08 that day it still failed to comply with the requirements of both sections 16(1) and 19 of FOISA in its response sent at 15:37 that day.
65.Accordingly the Commissioner finds that NHS Shetland failed to comply with the requirements of section 16(1) and section 19 of FOISA in failing to include the required information in its refusal notice to Mr Roy.
DECISION
The Commissioner finds that Shetland Health Board (NHS Shetland) partially failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Roy of the Scottish Review.He finds that NHS Shetland acted in accordance with Part 1 of FOISA by withholding the precise remuneration details requested by Mr Roy, because these were (at the relevant time) exempt from disclosure in terms of section 38(1)(b) of FOISA.
However, the Commissioner found that NHS Shetland failed to comply with Part 1 of FOISA by:
a)failing to issue a refusal notice in accordance with section 16(1) and section 19 of FOISA; and
b)incorrectly applying the exemption in section 38(1)(b), read in conjunction with section 38(2)(a)(i), to the withheld information, where it was expressed in terms of the bands described in paragraph 53 above..
Given that all of the withheld information was released to Mr Roy during the course of the investigation, the Commissioner does not require NHS Shetland to take any action in response to these failures.
Appeal
Should either Mr Roy or NHS Shetland wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
5 July 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
16 Refusal of request
(1) Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-
(a) discloses that it holds the information;
(b) states that it so claims;
(c) specifies the exemption in question; and
(d) states (if not otherwise apparent) why the exemption applies.
?
(6) Subsections (1), (4) and (5) are subject to section 19.
19 Content of certain notices
A notice under section 9(1) or 16(1), (4) or (5) (including a refusal notice given by virtue of section 18(1)) or 17(1) must contain particulars-
(a) of the procedure provided by the authority for dealing with complaints about the handling by it of requests for information; and
(b) about the rights of application to the authority and the Commissioner conferred by sections 20(1) and 47(1).
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
1.The data subject has given his consent to the processing.
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
