Decision 117/2011 Ms I and the City of Edinburgh Council
Name and address of complainant
Reference No: 201002258
Decision Date: 13 June 2011
Summary
Ms I (Ms I) asked the City of Edinburgh Council (the Council) for the name and address of a person who had complained about her.The Council refused to disclose this information under the Environmental Information (Scotland) Regulations 2004 (the EIRs).
During the course of the investigation, the Council advised the Commissioner that it no longer considered that the EIRs applied, but, having considered Ms I's request in terms of the Freedom of Information (Scotland) Act 2002 (FOISA), it believed that the complainer's name and address were exempt from disclosure under sections 30(c) and 38(1)(b) of FOISA.
Following an investigation, the Commissioner found that the Council should initially have dealt with Ms I's request under FOISA rather than under the EIRs, but that the Council was entitled to withhold the name and address of the complainant under section 38(1)(b) of FOISA.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b) and (2)(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation) (definition of "environmental information")
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for the purposes of the first principle: processing of any personal data: conditions 1 and 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.The request for information under consideration in this case was made on 5 September 2010.However, since that request was made within a wider series of correspondence between Ms I and the Council, this section sets out the wider context of that request.
2.On 23 August 2010, Ms I wrote to the Council advising that she was aware that the Building Standards department had received a complaint about her, and requesting, under FOISA, the complainant's name and the reason for the complaint.
3.The Council responded on 31 August 2010.It provided some explanation of the matters that had been complained about.However, it indicated that, under regulation 10(5) of the EIRs, it was not obliged to disclose the name of the complainant.Regulation 10(5) of the EIRs contains a number of exceptions from disclosure.The Council's letter did not indicate which of these applied.
4.On 1 September 2010, Ms I made a subject access request to the Council under section 7 of the Data Protection Act 1998 (the DPA) for information regarding the alleged offence made in relation to building control and "third party information".
5.The Council responded the following day.It referred back to its letter of 31 August 2010, and refused to supply the requested information.The Council notified Ms I of her right to request a review and appeal to the Commissioner if she was dissatisfied with its response.
6.Ms I submitted a further information request to the Council on 5 September 2010, asking for personal data relating to her, and the third party information relating to the complainant's name and address.
7.No response was provided by the Council referring to this particular request for information.
8.On 6 September 2010, Ms I submitted another request to the Council, asking for (amongst other information) her own personal data and the third party information relating to the complainant's name.
9.The Council wrote to Ms I on 30 September 2010, making reference to her request of 6 September 2010.This letter explained again that the Council was relying on regulation 10(5) of the EIRs for withholding the name of the complainant.
10.On 5 November 2010, Ms I wrote to the Council.In this email, while making reference to certain of the information requests she had submitted to the Council, Ms I also requested a review of the Council's apparent failure to respond to her request of 5 September 2010.
11.The Council notified Ms I of the outcome of its review on 30 November 2010. In response, the Council advised that information as to the identity of the complainant was being withheld in terms of regulation 10(5) of the EIRs.The Council still made no reference to any of the specific exceptions contained in regulation 10(5) of the EIRs.However, it indicated that, as the information Ms I had requested comprises the personal data of a third party, and as it considered that disclosure of that information would breach at least one of the data protection principles in the DPA, the provisions in regulation 11(2) of the EIRs were applicable to that information.
12.On 20 December 2010, Ms I wrote to the Commissioner, stating that she was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to certain specified modifications.
13.The application was validated by establishing that Ms I had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
14.Although the sequence of information requests described above began with that made by Ms I on 23 August 2010, it is only the one made on 5 September 2010 that is under consideration in this decision.This is because Ms I's requirement for review of 5 November 2010 made reference only to this request.The other requests are summarised above solely for the purpose of explaining the wider context for the request of 5 September 2010.
Investigation
15.On 4 February 2011, the Council was notified in writing that an application had been received from Ms I.
16.In its response to this letter, the Council indicated that it now considered that Ms I's request was not a matter to be dealt with under the EIRs and, having considered it under FOISA, it considered the information requested to be exempt from disclosure under sections 30(c) and 38(1)(b) of FOISA.The Council provided submissions outlining why it considered that these exemptions were applicable to the requested information.
17.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was asked whether it wished to provide any additional submissions to justify its reliance on the exemptions in sections 30(c) and 38(1)(b) of FOISA.The Council was also asked specific questions about its application of these exemptions, and to clarify whether it had, in fact, provided a response to Ms I's information request of 5 September 2010.
18.A response was received from the Council on 30 March 2011, providing further submissions on sections 30(c) and 38(1)(b) of FOISA.
19.The Council also advised that it had recorded Ms I's request as being dated 6 September 2010 and had responded to this on 30 September 2010. In further correspondence, the Council acknowledged that it did receive Ms I's letter of 5 September 2010 and advised that its response of 30 September 2010 was intended to be a response to this request.
20.Having read the Council's response of 30 September 2010, the Commissioner accepts that, although it does not refer to Ms I's request of 5 September 2010, it does provide a response to all of the points raised in Ms I's request, and indicates that the Council considered this information to be excepted from disclosure under the EIRS.
21.During the course of the investigation, the investigating officer also invited and obtained Ms I's comments on her own legitimate interests in disclosure to assist the Commissioner's consideration of the exemption in section 38(1)(b) of FOISA.
22.The submissions received from both the Council and Ms I are summarised, where relevant, in the analysis and findings section below.
Commissioner's analysis and findings
23.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by both Ms I and the Council and is satisfied that no matter of relevance has been overlooked.
24.As mentioned above, the Commissioner accepts that the Council's response of 30 September 2010 was a response to the requests made by Ms I on both the 5 and 6 September 2010, indicating that the Council was withholding the identity of the complainant in terms of regulation 10(5) of the EIRs .
25.While this has not been explicitly clarified by the Council, the Commissioner considers it apparent from comments in the Council's various communications with Ms I that it was actually referring to regulation 10(3) of the EIRs.The Commissioner notes that regulation 10(5) of the EIRs contains a number of exceptions from disclosure, none of which appear to have been applied by the Council in this case.Regulation 10(3), however, states that where the environmental information requested includes personal data, the authority shall not make those personal data available unless in accordance with section 11.
26.Following its review, the Council indicated that it considered both regulation 10(5) and the provisions of regulation 11(2) of the EIRs to be applicable to the complainant's name and address.Regulation 11(2) provides that personal data can be withheld in a number of circumstances, one of which is where its disclosure would breach any of the data protection principles set out in the DPA.
27.During the course of the investigation, the Council advised that it considered that Ms I's request should have been dealt with in line with the provisions of FOISA, and so relied on the exemptions in sections 30(c) and 38(1)(b) (read in conjunction with 38(2)(a)(i)) of FOISA for withholding the information.Section 38(1)(b) of FOISA contains an exemption from disclosure which is essentially the same as the provision contained in regulation 11(2) of the EIRs.
FOISA v EIRs?
28.The first matter for the Commissioner to consider is whether the Council should have responded to Ms I's information request in terms of FOISA or the EIRs.
29.Environmental information is defined in regulation 2(1) of the EIRs (the definition is reproduced in full in the Appendix to this decision).Where information falls within the scope of this definition, a person has a right to access it under the EIRs, subject to various restrictions and exceptions contained in the EIRs.
30.Having considered the subject matter of Ms I's request, the Commissioner agrees that the requested information is not environmental information as defined in regulation 2(1) of the EIRs.
31.The information sought by Ms I is the name and address of a complainant.While the complaint concerned related to building control matters (and so the substance of that complaint might include information falling within the definition in regulation 2(1) of the EIRs), the name and contact details of the complainant does not fall within any part of the definition.As a consequence, the Commissioner concludes that Ms I's request is not one to which the EIRs apply.
32.This decision will therefore focus solely on the Council's handling of the request in line with the requirements of FOISA.The Commissioner notes that when responding to Ms I's various requests, no reference was made to her rights under FOISA, or any exemption in Part 2 of FOISA.
33.Since the Council responded to Ms I's request solely in terms of the EIRs, the Commissioner must find that the Council breached Part 1 of FOISA (and in particular section 1(1) and 1(6)) by failing to acknowledge that the request made by Ms I was a valid one made in terms of FOISA, and by failing to provide any response to it in terms of FOISA.
34.Having reached this conclusion, the Commissioner went on to consider whether the Council was entitled to withhold the information in terms of the exemptions that were cited during the investigation.He first considered the exemption in section 38(1)(b) of FOISA.
Personal data ? section 38(1)(b) of FOISA
35.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)) exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
36.The Council has withheld the name and address of the complainant under section 38(1)(b) of FOISA, arguing that it is personal data, disclosure of which would contravene the first data protection principle.
Is the information personal data?
37.Personal data is defined in section 1(1) of the DPA as data which relates to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
38.The Commissioner accepts that the name and address of the complainant is information which identifies a living individual, and relates to that individual by confirming their involvement in the complaint.He is therefore satisfied that this information is the complainant's personal data, and falls within the definition of personal data in section 1(1) of the DPA.
39.The Commissioner must now consider whether disclosure of this personal data would contravene the first data protection principle, as argued by the Council.
Would disclosure breach the first data protection principle?
40.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
41.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and is satisfied that the personal data in this case does not fall into this category.It is, therefore, not necessary to consider the conditions in Schedule 3 to the DPA in this case.
42.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
43.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of the complainant's name and address would be fair and lawful.
Can any of the conditions in Schedule 2 of the DPA be met?
44.Condition 1 of Schedule 2 permits data to be processed (in this case, disclosed into the public domain in response to Ms I's information request) if consent to such processing is given by the data subject.The Council advised that the data subject has not given consent to the processing of their personal data.The Commissioner is therefore satisfied that condition 1 cannot be fulfilled in this case.
45.In the circumstances, the Commissioner considers that the only other condition in Schedule 2 to the DPA which might be considered to apply is condition 6(1).This allows personal data to be processed (as noted above, in this case, this means put into the public domain in response to Ms I's information request) if disclosure of the data is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
46.There are a number of tests which must be met before condition 6(1) in Schedule 2 of the DPA can apply:
Does Ms I have a legitimate interest in being given this personal data?
If yes, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject (in this case, the complainant)?
Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?This will involve a balancing exercise between the legitimate interests of Ms I and those of the complainant.Only if the legitimate interests of Ms I outweigh those of the complainant can the personal data be disclosed.
Does Ms I have a legitimate interest?
47.There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.In his published guidance on section 38 of FOISA[1], the Commissioner states:
In some cases, the legitimate interest might be personal to the applicant ? e.g. he or she might want the information in order to bring legal proceedings.With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
48.Ms I was invited to provide her reasons for requiring the information, to inform the Commissioner's consideration of condition 6(1).
49.Ms I advised that since moving to her current address she feels that she has been harassed by certain neighbours, particularly when she is having work carried out to her property.Ms I states that she believes that certain neighbours have made allegations to the Council about her which have been found not to be true.
50.She believes that, in a case of harassment, it is important to do justice between the parties and disclose information which is appropriate to the case being considered.
51.Ms I also considers that her right to respect for her private and family life under Article 8 of the Human Rights Act 1998 is one of the reasons why she has a legitimate interest in obtaining the name and address of the complainant.
52.Within her submission, Ms I made it clear that provision of the name and address of the complainant would allow her to consider whether to take appropriate legal action.
53.The Council advised that, while Ms I undoubtedly has an interest in understanding who complained about her to the Council Building Standards section, she has no legitimate interest in this information.
54.The Council submit that, as a matter of principle, it is never a legitimate interest on the part of someone who is the subject of a complaint to know who has complained about them.Where complaints are made in bad faith, the Council advised that it is for it to address the issue of the complainer wasting public time; to release the identity of such complainers would resolvenothing and would potentially cause great harm.
55.The Commissioner has noted the Council's comments.However, having considered the submission from Ms I, the Commissioner accepts that Ms I as an individual has a legitimate interest in understanding who has made a complaint about her to the Council, to enable her to decide whether or not to take appropriate legal action if she considers she is being harassed.
Is disclosure of the personal data necessary for Ms I's legitimate interests?
56.The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so he must consider whether these interests might reasonably be met by any alternative means, or which would interfere less with the privacy of the complainant.
57.The Commissioner accepts that, without disclosure of the name and address, Ms I will be unable to identify who the complainant was.The Commissioner considers that there is no other practical means open to Ms I to obtain this information other than by obtaining it directly from the Council, which she has been unable to do either by means of an information request or subject access request.
58.The Commissioner concludes that Ms I's interest could not be met through any means other than by access to the name and address of the complainant.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
59.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject (the complainant).As noted above, this involves a balancing exercise between the legitimate interests of Ms I and the individual in question.Only if the legitimate interests of Ms I outweigh those of the individual in question can the information be disclosed without breaching the first data protection principle.
60.In the Commissioner's briefing on section 38 of FOISA[2], the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise.These include:
whether the information relates the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);
the potential harm or distress that may be caused to by the disclosure;
whether the individual has objected to the disclosure; and
the reasonable expectations of the individuals as to whether the information would be disclosed.
61.The Council concluded that the disclosure of the information would be unfair and therefore unwarranted; it considers that someone who reports a suspected offence is entitled to expect protection from the authority to which he or she has reported the matter.
62.The Council advised that it cannot guarantee the complainant's safety and freedom from harassment or reprisals should the information be disclosed.
63.The Commissioner has noted that the complainant made a complaint directly to the Council rather than to Ms I, about a specified matter.
64.The Commissioner considers, as he has in previous decisions, that a person submitting a complaint of this nature to the Council would do so with the expectation that it would be treated confidentially.
65.The Commissioner also accepts that disclosure of the name and address of the complainant into the public domain (which would be the effect of disclosure under FOISA, as opposed to, for example, a disclosure under the DPA) would constitute an intrusion into the private life of that person.
66.Having read the submission from Ms I, the Commissioner considers that it is likely that if the name and address of the complainant were disclosed to her then this is likely to lead to Ms I making contact with the complainant, whether personally or via a legal representative.
67.Having considered all of the submissions made by Ms I and the Council, the Commissioner considers that, in this case, the rights, freedoms and legitimate interests of the data subject (the complainant), in relation to their reasonable expectation that their identity would not be made public should they make a complaint to the Council, outweigh the legitimate interest Ms I has in the obtaining the information.The Commissioner therefore concludes that disclosure in this case would be unwarranted intrusion into the private life of the complainant.
68.Given this conclusion, the Commissioner finds that condition 6 of Schedule 2 to the DPA could not be met in relation to disclosure of the withheld information.For the same reasons, the Commissioner has concluded that disclosure would be unfair and, in breaching the first data protection principle would be unlawful.The Commissioner therefore accepts that the information was properly withheld under section 38(1)(b) of FOISA.
69.As the Commissioner has found that the Council was correct to rely on the exemption in section 38(1)(b) (read in conjunction with section 38(2)(a)(i)) of FOISA for withholding the information from Ms I, he is not required to go on to consider the application of the exemption in section 30(c) of FOISA.
DECISION
The Commissioner finds that the City of Edinburgh Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Ms I.
The Commissioner finds that the Council breached Part 1 of FOISA, in particular sections 1(1) and (6), in not responding to Ms I's request under FOISA.
However, the Commissioner finds that the Council was entitled to withhold the name and address of the complainant under the terms of section 38(1)(b) of FOISA.
The Commissioner does not require the City of Edinburgh Council to take any action in response to this decision.
Appeal
Should either Ms I or the City of Edinburgh Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
13 June 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?.
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
(e) in subsection (1) of section 38 ?
?.
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?.
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations ?
?
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
(b) factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in paragraph (a);
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
(d) reports on the implementation of environmental legislation;
(e) costs benefit and other economic analyses and assumptions used within the framework of the measures and activities referred to in paragraph (c); and
(f) the state of human health and safety, including the contamination of the food chain, where relevant, conditions of human life, cultural sites and built structures inasmuch as they are or may be affected by the state of the elements of the environment referred to in paragraph (a) or, through those elements, by any of the matters referred to in paragraphs (b) and (c);
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
1.The data subject has given his consent to the processing.
?
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=3085&sID=133
[2] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=3085&sID=133
