Decision 118/2019: Proposed Rangers Fanzone at Ibrox Football Centre
Public authority: Glasgow City Council
Reference No: 201801863
Summary
The Council was asked for correspondence and meeting records regarding a proposed Rangers Fanzone at Ibrox.
Following an investigation, the Commissioner was satisfied that the Council identified all the relevant information it held and notified the requester correctly. He was satisfied that the Council complied with FOISA in withholding information, as either personal data or as information whose disclosure would substantially prejudice the effective conduct of public affairs.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and 2(e)(ii) (Effect of exemptions); 21(4) and (5) (Review by Scottish public authority); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "the GDPR", "personal data" and "processing") and (5A) (Personal information)
General Data Protection Regulation (the GDPR) Articles 4(11) (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(a) and (f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 22 August 2018, Ms M made a request for information to Glasgow City Council (the Council), asking for all correspondence regarding the proposed Rangers Fanzone, from March 2018, between the Council and the following parties:
a) Glasgow Life
b) A named Councillor
c) Ibrox and Cessnock Community Council
For the same period, she also requested all internal Council documents regarding the Fanzone, and minutes, agendas and papers for all meetings involving the Council where the Fanzone was discussed.
2. The Council responded on 3 September 2018 in terms of section 17 of FOISA, stating that it did not hold the requested information. The Council advised that Glasgow Life (a separate organisation, formerly Culture and Sport Glasgow, operational since 1 April 2007) might hold the information.
3. Later that day, Ms M wrote to the Council requesting a review of its decision: she did not accept that the Council did not hold the information she sought.
4. The Council notified Ms M of the outcome of its review on 1 October 2018, substituting a different decision on the basis it held information capable of addressing the request. The Council applied section 27(1) of FOISA, claiming that it intended to publish the information on its website the following week. It explained that some information would be redacted, including personal data, but confirmed that Ms M would be informed when the information was available online.
5. In a subsequent letter (12 October 2018), confirming that the information had been published on the Council's website and providing a link, the Council applied the exemptions in sections 38(1)(b) (Personal information) and 30(b)(ii) (Prejudice to effective conduct of public affairs) of FOISA to information redacted from what had been published.
6. On 31 October 2018, Ms M wrote to the Commissioner. Ms M applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Ms M stated she was dissatisfied with the outcome of the Council's review (the letter of 12 October 2018) because she did not accept that the application of exemptions was correct, or the online publication represented full disclosure of what had been requested (noting subsequent additions to what was published online).
Investigation
7. The application was accepted as valid. The Commissioner confirmed that Ms M made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
8. On 7 December 2018, the Council was notified in writing that Ms M had made a valid application. The Council was asked to send the Commissioner the information withheld from Ms M, and did so. At this point, it applied section 30(c) of FOISA where it had previously applied section 30(b)(ii). The case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. These related to the scope of the request, the searches undertaken, and the exemptions the Council considered applicable to the withheld information.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Ms M and the Council. He is satisfied that no matter of relevance has been overlooked.
11. In her application, Ms M expressed dissatisfaction with the Council's initial response stating that the information was not held and directing her to another organisation. She was also unhappy with the way the Council published the information subsequently. In her view, the published material remained incomplete as information was still being uploaded and changed after the date of the Council's review decision. She contended that the Council not only failed to give proper notification, but it had not published all the information it held.
12. Ms M does not express dissatisfaction with the application of section 27(1) as such, but she is clearly unhappy with the disclosures, whether they represented all the relevant information held by the Council and whether she should have been notified of further information posted on the website after the review outcome.
13. The Commissioner's remit is to investigate and reach a determination on recorded information, if held by a Scottish public authority. He cannot comment on what a public authority ought to hold or record, but he can consider whether the Council took adequate, proportionate steps to identify any information held and which falls within the scope of Ms M's request. For clarity, the Commissioner cannot comment on the accuracy of the information which is held.
Information held
14. The standard of proof in considering whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining this, the Commissioner will consider the scope, quality, thoroughness and results of the searches carried out by the public authority. He will also consider, where appropriate, any reason offered by the public authority to explain why the information is not held.
Ms M's submissions
15. Ms M submitted that the original response to the effect that no information was held was clearly false and untrue. If it had not been for media attention, she believed the disclosed information would not have come to light.
16. Also, Ms M was dissatisfied that, following the notification of 12 October 2018, the Council seemed to have added "multiple documents" to its website, without any further direct notification to her. She regarded the disclosure at review stage as only partial, in light of these modifications to the published material. (Her dissatisfaction with the information withheld under exemptions will be considered later in this decision notice.)
The Council's submissions
17. During the investigation, the Council was asked to set out in detail the approach and methodology used in searching for information with which to address Ms M's request, and did so.
18. The Council confirmed that, initially, it refused her request on the grounds it did not consider it held information. It explained that its Licensing Department was aware of a Temporary Public Entertainment Licence application being withdrawn prior to a meeting on Monday 6 August 2018. The Council stated that the Licensing Team understood the only information held which was capable of addressing this request was held by Glasgow Life. After limited searches for information about elected members, this was the conclusion the Council reached.
19. It may be helpful at this juncture to confirm that, under FOISA, requests cannot be transferred from one authority to another so there was not an option under FOISA for the Council to pass Ms M's request to Glasgow Life, had it wished to do so. Authorities can give advice on which organisations they believe may hold the information. The original response contains such advice.
20. The Council submitted that it was only when Ms M sought a review of the initial response that it decided to undertake searches across the organisation. The Council then recognised it held information capable of addressing the request and took steps to identify all information held. As part of this investigation, the Council provided the list of officers/sections and departments contacted, with supporting documents to evidence its searches at the time of its review.
Conclusions on information held
21. In the circumstances, the Commissioner is satisfied with the approach taken by the Council on review. He notes the parameters and extent of the searches. It is clear that this approach relied to a high degree on staff expertise, but provided a sufficiently broad "sweep" of a number of departments to establish which, if any, held information capable of addressing Ms M's request. The Commissioner is satisfied that this approach to searches was both proportionate and adequate.
22. In regard to the amended material, the Council submitted that all relevant Council documents published were uploaded to the website by 12 October 2018, when Ms M was notified of publication. The Council explained that a number of additional documents were uploaded on 16 and 17 October, but these all originated from Glasgow Life (and were clearly identified as such by the prefix "GL" at the start of the document name).
23. On balance, the Commissioner accepts that, by the time of the review, the Council had taken adequate and proportionate steps to establish what information it held and which was capable of addressing Ms M's request. He is satisfied with the searches conducted by the time the Council issued its review decision.
24. For clarity, the Commissioner is satisfied that the information originating from Glasgow Life was not held by the Council at the time of Ms M's request, some time before it was uploaded to the Council's website. The Commissioner can only consider what was held at the time of the request, as section 1(4) of FOISA provides.
25. Consequently, the Commissioner is satisfied that, by the time of the review decision, the Council had conducted all the searches needed to identify and locate the information it held for the purposes of FOISA. In the circumstances, the Council was not required to notify Ms M of further information published after 12 October 2018, which was not information held by the Council for the purposes of FOISA.
26. The Commissioner will now go on to consider the withheld information.
Section 38(1)(b) - Personal information
27. The Council withheld names, contact details and some identifying data of individuals within the published material on its website. The Council did not consider it would be lawful to disclose this data.
28. In her requirement for review and her application, Ms M remained dissatisfied with the extent to which the personal data was redacted. She accepted that the names of junior staff were correctly withheld, but was dissatisfied with the redaction of more senior staff details and the names of Councillors (who she believed should expect to be identified in this context, given their professional roles).
Is the information personal data?
29. Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" and its disclosure would contravene any of the data protection principles in the GDPR or (where relevant) in the DPA 2018.
30. "Personal data" is defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular by reference to -
(i) an identifier such as a name, an identification number, location data or an online identifier, or
(ii) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."
31. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
32. The information withheld under section 38(1)(b) relates to Councillors, employees of the Council, employees of Glasgow Life and employees of Rangers. In her application, Ms M is clear her focus lies solely with senior employees of the Council and Councillors, as they should, she believes, be accountable for their actions and for the decisions they took. There is no suggestion from either party here that these details are not personal data.
33. The Commissioner is satisfied that the withheld information is personal data: it relates to identifiable living individuals and it is clear that the name of a person in connection with their employment or role as a Councillor clearly relates to each individual a living person. The Commissioner therefore accepts that the information is personal data as defined in section 3(2) of the DPA 2018. In any case, neither Ms M nor the Council appear to dispute this point.
Would disclosure contravene one of the data protection principles?
34. Article 5(1)(a) of the GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject." The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". In the case of FOISA, personal data are processed when disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the GDPR) and fair.
35. As mentioned above, Ms M's focus centres on those in decision-making or senior positions.
36. The Council recognised that the redacted information here belongs to living individuals who are relatively senior staff or Councillors, who routinely engage with the public and who, ordinarily, might expect their details to be disclosed. The Council did not accept that disclosure was safe or appropriate in this particular context, for reasons considered further below.
Lawful processing: Articles 6(1)(a) and (f) of the GDPR
37. The Commissioner considers conditions (a) and (f) of Article 6(1) of the GDPR are the only ones which could potentially apply in the circumstances of this case.
Condition (a): consent
38. Condition (a) states that processing will be lawful if the data subject has given consent to the processing of the data for one or more specific purposes. "Consent" is defined in Article 4 of the GDPR as:
"… any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".
39. The Council confirmed during the investigation the circumstances and level of risk believed to be involved here: it did not think it appropriate to ask data subjects for their consent in such circumstances.
40. The Commissioner is satisfied that there was no requirement on the Council to seek consent to disclosure. In the absence of consent, condition (a) could not be met.
Condition (f): legitimate interest
41. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child."
42. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
43. The tests which must be met before Article 6(1)(f) can be met are as follows:
a) Does Ms M have a legitimate interest in obtaining the personal data?
b) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
c) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the person making this request have a legitimate interest in obtaining the personal data?
44. Clearly Ms M and the public have a legitimate interest in seeing how decisions are taken by public authorities and this includes knowing at what level decisions are taken. Some of the accompanying redacted data would facilitate this, to some extent, even if names would not.
Is disclosure necessary?
45. There is no obvious way of meeting the legitimate interest without disclosing the data in question. To that extent, disclosure can be considered necessary.
Interests or fundamental rights and freedoms of the data subjects
46. The Council submitted that it would be unfair on all four groups of individuals (Councillors, employees of the Council, employees of Glasgow Life and employees of Rangers) to disclose the withheld personal data. They would have no expectation that it would be disclosed in a way which could potentially endanger them. It explained that any Council involvement with either half of the Old Firm tended to be contentious, and that in relation to previous matters in this area members of staff had received death threats considered credible by the Police (in at least one case resulting in safety briefing and other protective measures). At least one death threat had been received in relation to the present matter, resulting in criminal charges and Police protection. Given the risk of threats in the circumstances, for anyone connected with the matter, the Council submitted that personal details of all concerned should be withheld.
47. The safety of all concerned is clearly a key concern when forming conclusions here. The Commissioner accepts the apprehension of risk put forward by the Council as genuine in the circumstances, and clearly a factor that must carry considerable weight in considering the interests of the data subjects. In such circumstances, the Commissioner is satisfied that they would have no reasonable expectation that their personal details would be disclosed to the public.
48. On balance, the Commissioner is satisfied that disclosing the personal data sought by Ms M would be unwarranted here, in the interests of the data subjects, given the levels of risk to their safety at the time of the review decision.
49. In the circumstances of this particular case, therefore, the Commissioner concludes that condition (f) in Article 6(1) of the GDPR cannot be met in relation to the withheld personal data. Disclosure would therefore be unlawful.
Fairness and transparency
50. Given the Commissioner's finding that processing would be unlawful, he is not required to go on to consider separately whether disclosure of the personal data would otherwise be fair or transparent in relation to the data subjects.
51. The Commissioner therefore finds no condition in Article 5(1) of the GDPR can be met and that the withheld personal data were properly withheld under section 38(1)(b) of FOISA.
Section 30(c) - Prejudice to effective conduct of public affairs
52. In its review, the Council originally stated disclosure would have a significantly disruptive effect on future discussions. It also commented to the effect that, while there is significant public interest in the openness and transparency of the information requested, there was a significant public interest in authorities being able to discuss all the factors involved: discussion of this kind, the Council contended, would cease to take place once the withheld information in this case is disclosed.
53. On review, the Council applied section 30(b)(ii) to the remainder of the withheld information. During the investigation it changed its position, applying section 30(c) instead. This exemption applies where disclosure of the information in question would "… otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs." The word "otherwise" is used to distinguish the required harm from that required for the other exemptions in section 30.
54. The Council noted that the withheld information pertains to internal discussions on specific topics. Disclosure would have a substantial negative impact on the work of the Council's media staff, with a potential adverse reputational effect on the organisation a whole. A particular concern of the Council was its ability, in any future discussions, to record views in matters of so much media interest.
55. The Council submitted that the withheld information did not form part of a decision-making process: the information in question was not capable, in the Council's view, of adding to the public's understanding of what happened and how/why.
56. Having considered the nature and content of the withheld information, together with the Council's submissions and the comments made by Ms M, the Commissioner accepts that its disclosure would be likely to cause substantial prejudice to the effective conduct of public affairs, by inhibiting staff (particularly those dealing with media relations) from participating fully and frankly in future discussions concerning the Old Firm.
57. As is apparent above (see consideration of section 38(1)(b)), this particular debate was highly contentious at the time of this request and requirement for review, as evidenced by the media coverage (and threats reported to, and acted upon by, the Police). The Commissioner is satisfied, given the subject matter, that the Council could become involved in similar debates in future, which could become similarly contentious. In the circumstances, the risk of future inhibition would appear to be a real one.
58. Consequently, the Commissioner is satisfied that the exemption under section 30(c) is engaged here.
Public interest arguments for section 30(c)
59. The Council recognised Rangers was a large organisation with a large fan base. Any major decision impacting on the club was of significant interest and the proposed Fanzone at Ibrox attracted significant media attention.
60. In favour of maintaining the exemption, the Council noted its early decision to publish information proactively, acknowledging the public interest points above. For example, early publication would allay various conspiracy theories circulating. The Council explained that public interest and safety concerns were at the forefront of thinking when deciding what to publish and what to withhold: it remained of the view that the published material met the public interest in this case.
61. On balance, the Council submitted that the public interest favoured maintaining the exemption for this withheld information.
62. Although there is a public interest in disclosure of the material in question, this must be balanced against the public interest in maintaining the exemption. As noted earlier, much of the material is in draft form and so, in the Commissioner's view, it is limited in what it can add to the public record of the decision taken. The Commissioner must also take into account the extent to which the public interest has been met by what has been published already, and the contentious nature of the ongoing debate must weigh against publication of what remains.
63. On balance, therefore, the Commissioner is of the view that the public interest in withholding the information (and maintaining the exemption) outweighs the public interest in disclosing it.
64. The Commissioner therefore finds that the Council correctly withheld the information under section 30(c) of FOISA.
Decision
The Commissioner finds that Glasgow City Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Ms M.
Appeal
Should either Ms M or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
13 August 2019
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
…
21 Review by Scottish public authority
…
(4) The authority may, as respects the request for information to which the requirement relates-
(a) confirm a decision complained of, with or without such modifications as it considers appropriate;
(b) substitute for any such decision a different decision; or
(c) reach a decision, where the complaint is that no decision had been reached.
(5) Within the time allowed by subsection (1) for complying with the requirement for review, the authority must give the applicant notice in writing of what it has done under subsection (4) and a statement of its reasons for so doing.
…
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
…
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
….
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);
…
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
General Data Protection Regulation
Article 4 Definitions
For the purposes of this Regulation:
…
11. 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
…
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available.
…
(subject to subsection (14)(c) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
…
(10) "The GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
