|
Decision 114/2016: Mr Edes and Highlands and Islands Airports Limited
Aircraft landing card charges
Reference No: 201602450
Decision Date: 19 May 2016
Summary
On 1 November 2015, Mr Edes asked Highlands and Islands Airports Ltd (HIAL) for details of every aircraft holding a landing card for one of its airports, with the annual charge paid in each case.
HIAL supplied some information on fees and on the number of cards issued. It withheld other information under sections 33(1)(b) (Commercial Interests and the economy) and 38(1)(b) of FOISA (Personal Information) of FOISA. Following a review, Mr Edes remained dissatisfied and applied to the Commissioner for a decision.
The Commissioner investigated and found that HIAL had partially failed to respond to Mr Edes's request for information in accordance with Part 1 of FOISA. Although she accepted that the information HIAL had withheld was exempt from disclosure, the Commissioner identified procedural failings in its responses to Mr Edes.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 16(1)(c) (Refusal of request); 25(1) (Information otherwise accessible); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 1 November 2015, Mr Edes made a request for information to HIAL. The information requested was:
"?details of every aircraft that holds a landing card (i.e. payment for unlimited landings) for any/all HIAL owned/operated airport/airfield and the amount they each pay per year for this privilege excluding VAT."
2. HIAL responded on 30 November 2015. It provided Mr Edes with a weblink to the standard fees charged for all airports, other than Inverness, which it published online. It also provided the total fees paid for landing cards at Inverness. For all its airports, it confirmed the total number of landing cards issued, and the total fees paid, in the current financial year.
3. In relation to cards issued to groups, HIAL also confirmed that there were currently four of these, issued to three groups. It explained that a discount could be negotiated with clubs, but withheld information on negotiated discounts under section 33(1)(b) of FOISA (Commercial interests and the economy). It withheld information it believed related to individuals under section 38(1)(b) (Personal information) of FOISA.
4. On 30 November 2015, Mr Edes wrote to HIAL requesting a review of its decision, suggesting its response was inadequate and disagreeing with its application of exemptions. He believed it would be possible to disclose individual fees without aircraft registrations.
5. HIAL notified Mr Edes of the outcome of its review on 22 December 2015. It upheld its original decision without modification
6. On 23 December 2015, Mr Edes wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Edes stated he was dissatisfied with the outcome of HIAL's review because he believed the removal of registrations would permit the information to be disclosed to him.
Investigation
7. The application was accepted as valid. The Commissioner confirmed that Mr Edes made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
8. On 22 January 2016, HIAL was notified in writing that Mr Edes had made a valid application. HIAL was asked to send the Commissioner the information withheld from Mr Edes. HIAL provided the information and the case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. HIAL was invited to comment on this application and answer specific questions, with reference to the exemptions claimed in its responses to Mr Edes.
10. HIAL provided submissions during the investigation.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Edes and HIAL. She is satisfied that no matter of relevance has been overlooked.
Information requested
12. In his request for review (30 November 2016), Mr Edes confirmed that he was willing to accept the information without aircraft registrations (i.e. substituting a non-specific label such as "Aircraft A" for each).
Section 25(1) of FOISA
13. In relation to fees charged, HIAL directed Mr Edes to its website for information on its standard fees for landing cards. It contended that this published information was otherwise accessible to Mr Edes.
14. In its submissions to the Commissioner, HIAL confirmed that it considered section 25(1) to apply to this information. Under section 25(1) of FOISA, information which an applicant can reasonably obtain, other than by requesting it under section 1(1) of FOISA, is exempt information.
15. HIAL was correct in stating that its standard fee rates were available for the public to access online. It is clear from HIAL's Conditions of Use and Airport Charges, published on HIAL's website at the time it provided Mr Edes with the relevant weblink, that these would be the charges applicable to all users except flying clubs, with which fees could be negotiated.
16. From his own submissions, Mr Edes is clearly aware of this. Clearly, also, Mr Edes is aware of the fees being paid by his own flying club and where the relevant aircraft are located. The Commissioner is satisfied that section 25(1) is engaged for these elements of Mr Edes's request.
17. Unfortunately, however, HIAL did not state to Mr Edes that it was applying section 25(1) to this information, although its reasons for withholding the information clearly apply to that exemption. In failing to do this, the Commissioner finds that HIAL failed to respond to Mr Edes's request in accordance with section 16(1)(c) of FOISA (the text of which is reproduced in Appendix 1).
18. In its submissions, HIAL also confirmed that information on charges for Inverness Airport was available on request and that it had never (subject to the exemptions considered below) intended to deny this information to Mr Edes. In fact, it is apparent from the information disclosed to Mr Edes (or to which he was directed), read with HIAL's submissions, that there is no additional information on fees to be disclosed to Mr Edes in relation to Inverness (or any of the other HIAL airports), with the exception of the fees negotiated with flying clubs (which the Commissioner will consider below). This should have been explained to Mr Edes, however, in HIAL's review outcome: in failing to do this, HIAL failed to respond to the request in accordance with section 1(1) of FOISA.
Section 38(1)(b) of FOISA
19. Having reached the above conclusions, the Commissioner does not find it necessary to consider the withholding of the fees paid by individual or commercial card holders, or information in respect of Mr Edes's own flying club. Mr Edes knows all of this, from the information already in the public domain or from personal knowledge. The Commissioner still has to consider the information withheld on the locations of the various aircraft, and on the fee negotiated with the remaining flying club, all withheld under section 38(1)(b) of FOISA.
Is the remaining withheld information personal data?
20. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).
21. Mr Edes did not consider that he had requested personal data, submitting that the information could be provided without identifiers. The Commissioner will consider the locations first.
22. HIAL took the view that the information could not be disclosed without identifying individuals who held landing cards. It believed the individual holders of landing cards would remain identifiable, even if aircraft identifiers were removed as Mr Edes proposed. It highlighted the risk of identification, in an area where population numbers were small, people were known to each other and the numbers with access to a plane were considerably smaller (and thus likely to be more obvious). Mr Edes, as someone interested and active in flying locally, would be all the more likely to be able to deduce who the individuals concerned were from the locations.
23. The Commissioner shares HIAL's concerns that the individual card holders would be identifiable from the locations of the aircraft, at what are evidently all small airports. She acknowledges that Mr Edes is particularly qualified to identify those individuals: with other information which is likely to be available to him, the Commissioner is satisfied that the individual card holders would be identifiable from the withheld locations. In addition, she accepts that the information would say enough about those individuals and their leisure interests for it to relate to them. It would be their personal data.
24. HIAL also put forward arguments in relation to the remaining flying club and whether disclosure of further information on it and the charges it paid could be considered personal data. It concluded that the information could be linked to particular identifiable individual(s), in such a way that it could be considered their personal data. The Commissioner has considered these arguments carefully: she does not consider it possible to comment on them in greater detail without giving at least an indication of the nature of the information. She is, however, satisfied that (for similar reasons to those set out above in relation to the locations) further information covered by Mr Edes's request and relating to the remaining flying club cannot be disclosed without a substantial risk of disclosing personal data.
25. Having considered all relevant submissions, the Commissioner is satisfied that it would not be possible to render the withheld personal data sufficiently anonymous for them to cease to be personal data.
Would disclosure contravene the first data protection principle?
26. HIAL submitted that disclosure of the withheld personal data would breach the first data protection principle: therefore, the data were exempt under section 38(1)(b) of FOISA. Section 38(1)(b), applied on this basis, is absolute exemption and so is not subject to the public interest test.
27. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that the withheld information does not fall into any of the categories of sensitive personal data in section 2 of the DPA.
28. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject. The processing under consideration in this case would be the disclosure of the personal data into the public domain, in response to Mr Edes's information request.
29. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits disclosure, it is likely that disclosure will also be fair and lawful.
30. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the requested information to be disclosed. If any of these conditions can be met, she must then consider whether such disclosure would be fair and lawful.
Can any of the conditions in Schedule 2 be met?
31. The Commissioner's view is that condition 6 in Schedule 2 is the only one which might permit disclosure in this case.
32. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
33. There are a number of different tests which must be satisfied before condition 6 can be met. These are:
(i) Does Mr Edes have a legitimate interest or interests?
(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?
(iii) Even if the processing is necessary for Mr Edes's legitimate interests, is the processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
34. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Edes must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit disclosure. If the two are evenly balanced, the Commissioner must find that HIAL would be able to refuse to disclose the information to Mr Edes.
Is Mr Edes pursuing a legitimate interest or interests?
35. Mr Edes submitted that disclosure of the information was in the public interest for reasons of transparency and accountability, and in particular to ensure that fees were being managed properly. HIAL acknowledged that he might have such an interest.
36. The Commissioner finds that Mr Edes (and the wider public) do have a legitimate interest in understanding the fees paid for landing cards at each airport, to the extent that it is not (or was not, at the time HIAL responded to Mr Edes's request and requirement for review) in the public domain already. There is a legitimate interest in knowing how these fees (and any related discount) are calculated, as part of the legitimate process of "following the public pound".
Is the processing necessary for the purposes of these interests?
37. In reaching a decision on this, the Commissioner must consider whether these interests might reasonably be met by any alternative means.
38. HIAL suggested that the information Mr Edes sought was not necessary to pursue his legitimate interests here. It contended it had already supplied sufficient, relevant information to Mr Edes to allow him to understand the fees paid. It did not believe disclosure of the withheld personal data would contribute significantly to understanding how the relevant fee (or any discount negotiated) had been calculated. Mr Edes cited perceived differences in rates negotiated with flying clubs, highlighting that these negotiated sums were not published.
39. Having considered these arguments carefully, the Commissioner is inclined to accept that the withheld personal data would have little of value to say on the key question of how the fees and discounts are calculated. In the circumstances, taking account of all the information available to Mr Edes already, she is not satisfied that disclosure of the withheld personal data was necessary to meet Mr Edes's legitimate interest in this case
40. Having found that disclosure was not necessary, the Commissioner must conclude that condition 6 in Schedule 2 (to the DPA) could not be met in this case in relation to the withheld personal data. In the absence of a condition permitting disclosure, she must also conclude that disclosure would be unlawful.
41. The Commissioner therefore concludes that disclosure of the withheld personal data would breach the first data protection principle, and so this information was properly withheld under the exception in section 38(1)(b) of FOISA.
42. Having reached this conclusion, it is not necessary for the Commissioner to go on to consider the application of section 33(1)(b) of FOISA.
| Decision
The Commissioner finds that Highlands and Islands Airports Ltd (HIAL) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Edes.
The Commissioner finds that HIAL complied with Part 1 to the extent that it disclosed information to Mr Edes. However, in failing to state that section 25(1) of FOISA applied to information it considered otherwise accessible to Mr Edes, HIAL failed to comply with section 16(1)(c) of FOISA. It also failed to comply with section 1(1) of FOISA, in failing to explain that it had provided him with (or directed him to) all the information it held on fees charged at Inverness Airport, with the exception of specific fees negotiated with flying clubs.
The Commissioner also finds HIAL was entitled to withhold information under the exemption in section 38(1)(b) of FOISA.
In the circumstances, the Commissioner does not require HIAL to take any action in respect of the breaches she has identified.
|
Appeal
Should either Mr Edes or Highlands and Islands Airports Ltd wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If Highlands and Islands Airports Ltd (HIAL) fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that HIAL has failed to comply. The Court has the right to inquire into the matter and may deal with HIAL as if it had committed a contempt of court.
Margaret Keyse
Head of Enforcement
19 May 2016
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority..
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
16 Refusal of request
(1) Subject to section 18, a Scottish public authority which, in relation to a request for information which it holds, to any extent claims that, by virtue of any provision of Part 2, the information is exempt information must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant a notice in writing (in this Act referred to as a "refusal notice") which-
?
(c) specifies the exemption in question; and
?
25 Information otherwise accessible
(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.
?
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6 (1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
