Decision 119/2012 Mr Paul Hutcheon of the Sunday Herald and Aberdeenshire Council

Report to Council Committee

Reference No: 201200577
Decision Date: 12 July 2012

Summary

Mr Hutcheon requested from Aberdeenshire Council (the Council) a copy of a specified report prepared for a meeting of the Council's Policy and Resources Committee. The Council withheld the report in its entirety under the exemptions in sections 33(1)(b) and 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA). Following a review, Mr Hutcheon remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Council had dealt with Mr Hutcheon's request for information in accordance with Part 1 of FOISA by correctly applying the exemptions in sections 33(1)(b) and 38(1)(b) of FOISA to the withheld information. She did not require the Council to take any action.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 33(1)(b) (Commercial interests and the economy) and 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); 2(e) (Sensitive personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data: Recital 26

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 3 January 2012, Mr Hutcheon emailed the Council requesting the report mentioned at item 33 in the agenda for the Council's Policy and Resources Committee of 15 September 2011[1] (the report), regarding Cothrom Housing Ltd (Cothrom).

2.The Council responded on 6 January 2012, advising Mr Hutcheon that it considered the report to be exempt from disclosure in terms of sections 33(1)(b) and 38(1)(b) of FOISA.It provided some information drawn from minutes of Council committee meetings which set out in general terms the decisions taken with respect to Cothrom.It went on to indicate that the withheld report related to the commercial trading activity of Cothrom as an independent provider of long-term supported accommodation for people with complex needs.It also highlighted that the information would allow identification of particular tenants who are vulnerable, or have special needs, and the information could reveal sensitive personal information about their vulnerabilities.

3.On 24 January 2012, Mr Hutcheon emailed the Council requesting a review of its decision.Mr Hutcheon stated that the issue at hand relates to public money and a vital public service, and that he believed the public interest in transparency should override the exemptions cited by the Council.

4.The Council notified Mr Hutcheon of the outcome of its review on 17 February 2012, upholding its original decision without amendment.

5.On 26 March 2012, Mr Hutcheon wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr Hutcheon had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 11 April 2012, the Council was notified in writing that an application had been received from Mr Hutcheon and was asked to provide the Commissioner with any information withheld from him. The Council responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.

9.In response, the Council submitted that it considered the requested information to be exempt from disclosure in terms of sections 33(1)(b) and 38(1)(b) of FOISA and provided submissions supporting its application of these exemptions including its views on the public interest test (where appropriate).

10.The investigating officer also contacted Mr Hutcheon during the investigation seeking his submissions on the matters to be considered in this case.

11.The relevant submissions made by both the Council and Mr Hutcheon will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Hutcheon and the Council and is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) ? Personal data

13.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and if its disclosure to a member of the public otherwise than under FOISA would breach any of the data protection principles set out in Schedule 1 to the DPA.

14.The exemption in section 38(1)(b) is an absolute exemption, not subject to the public interest test laid down by section 2(1)(b) of FOISA.

15.In this case, the Council has argued that certain parts of the report comprise personal data in that they relate to individual tenants of Cothrom and would reveal their identities. It maintained that this may be considered sensitive personal data in terms of section 2(e) of the DPA, where it related to the physical and mental health of tenants.

16.The Council argued that the disclosure of the information would contravene the first data protection principle and that none of the conditions in either Schedule 2 or 3 of the DPA would permit disclosure.

Is the information (sensitive) personal data

17.The Commissioner will first consider whether the information withheld is personal data and, if so, whether it is sensitive personal data. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix). The DPA gives effect to Directive 95/46/EC on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data (the Directive) and so the DPA should, if possible, be interpreted in a manner which is consistent with the Directive.

18.Section 2 of the DPA provides that certain types of personal data are to be considered as sensitive personal data, which is afforded additional protection under the DPA. This includes, at section 2(e), information concerning an individual's physical or mental health or condition.

19.In considering the definition of "personal data", the Commissioner has also taken account of the opinions delivered by the House of Lords in Common Services Agency v Scottish Information Commissioner, by the High Court of England and Wales in Department of Health v Information Commissioner and by the Court of Session in Craigdale Housing Association and others v Scottish Information Commissioner.

20.In its initial response to Mr Hutcheon, the Council stated that certain elements of the information constituted personal data relating to individual tenants of Cothrom and the identities of individual tenants would be revealed by disclosure of the information. In its submissions to the Commissioner, the Council argued that the withheld information contains sensitive personal data about the tenants and that the limited number of homes operated by Cothrom increased the risk of identifying individuals.

21.The Commissioner has noted the approach taken by the Court of Session in the Craigdale Housing Association case. The Court of Session referred to Recital 26 of the Directive, which states that, when determining whether a person is identifiable, account should be taken of all the means likely reasonably to be used to identify the data subject. As noted by the Court of Session, the test is therefore whether disclosure of the information would lead to the identification of an individual or whether there is other information in the public domain which, when taken with the information, would reasonably allow for such identification.

22.Guidance entitled "Determining what is personal data[2]" which has been issued by the (UK) Information Commissioner (who is responsible for enforcing the DPA throughout the UK) states that, in considering whether a person can be identified, it should be assumed that it is not just the means reasonably likely to be used by the ordinary man in the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual.

23.The Commissioner has therefore considered whether the information sought by Mr Hutcheon, together with other information already in the public domain (or as a result of action likely to be taken by a determined person to identify the individuals if the information were to be disclosed) would reasonably allow individual tenants to be identified. If disclosure of the information would reasonably allow for identification, then the information would comprise personal data and cannot be disclosed unless certain conditions can be fulfilled. If disclosure of the information would not reasonably allow for identification, then the information would not comprise personal data and the exemption in section 38(1)(b) would not apply.

24.If this information is viewed in isolation, it appears to be anonymous, in that it does not permit the identification of any individual tenant referred to within the report. However, the Commissioner must examine whether there are other factors or information which, considered alongside the report, would "unlock" the information and permit identification of any of the individuals represented within the report.

25.The Commissioner has considered the means by which the public could obtain information that would allow the properties referred to within the report, and thereafter, the individual occupants, to be identified.

26.The Commissioner accepts that, given the relatively small communities in which Cothrom operate, it would not be difficult for the public to identify a property which is let by Cothrom. Having done so, it would be relatively easy to identify the occupants, for example, by reference to the Council Tax or electoral registers.

27.In the circumstances, the Commissioner is satisfied that the report contains certain information that relates to living individuals who could be identified from that information along with other information available to local residents or another reasonably determined person.As such, considered in the light of the court Opinions mentioned in paragraph 19, the Commissioner finds that this information is personal data.

28.As the personal data within the report contains information that relates to individuals' physical or mental health or condition, the Commissioner is satisfied that it is sensitive personal data as defined in section 2(e) of the DPA.

29.Having concluded that the information is sensitive personal data, the Commissioner has gone on to consider whether disclosure of the information would breach the first data protection principle and whether any of the conditions in both Schedule 2 and Schedule 3 to the DPA can be met which would permit disclosure.

Would disclosure breach the first data protection principle?

30.Personal data is not exempt from disclosure under FOISA simply because it is personal data.It will, however, be exempt from disclosure, in line with section 38(1)(b) of FOISA (as read with section 38(2)(a)(i) or (b)) if disclosure to a member of the public, otherwise than under FOISA, would contravene one or more of the data protection principles.

31.The Council has argued that disclosure of the personal data would breach the first data protection principle. This principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (also to the DPA) is met. Given that the conditions in Schedule 3 are, intentionally, much more stringent than those in Schedule 2, the Commissioner considers it appropriate to look at these first.

32.The Council submitted that none of the conditions in Schedule 3 to the DPA would permit disclosure.

33.The conditions listed in Schedule 3 to the DPA have been considered by the Commissioner, as have the additional conditions for processing sensitive personal data as contained in legislation such as the Data Protection (Processing of Sensitive Personal Data) Order 2000[3].

34.In guidance issued by the Commissioner regarding the exemption in section 38(1)(b)[4], it is noted that the conditions in Schedule 3 are very restrictive in nature and, as a result, generally only the first and fifth conditions are likely to be relevant when considering a request for sensitive personal data under FOISA.

35.Condition 1 allows processing where the data subject has given explicit (and fully informed) consent to the release of the information.Condition 5 allows processing where information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

36.Having considered these conditions, the Commissioner has concluded that it would not be reasonable to seek consent from the data subjects for the release of the information. The Commissioner has therefore concluded that condition 1 is not met in this case. She is also satisfied that none of the information under consideration has been made public as a result of steps deliberately taken by the data subjects, and so condition 5 is not met.

37.Having reached these conclusions, and also finding that no other condition in Schedule 3 is applicable in the circumstances of this case, the Commissioner finds that there are no conditions in Schedule 3 which would permit the sensitive personal data to be disclosed.

38.As the Commissioner is satisfied that there are no conditions in Schedule 3 to the DPA which would permit disclosure, she is not required to consider whether any of the conditions in Schedule 2 to the DPA would permit disclosure.

39.As such, and in the absence of a condition permitting it, the Commissioner finds that disclosure of the sensitive personal data contained in the report would be unfair.In the absence of such a condition, disclosure would also be unlawful. Disclosure of the information would therefore contravene the first data protection principle and the sensitive personal data is accordingly exempt from disclosure under section 38(1)(b) of FOISA.

40.The Commissioner therefore finds that the Council was entitled to withhold the sensitive personal data contained within the report under section 38(1)(b) of FOISA.

Section 33(1)(b) ? commercial interests and the economy

41.The Council submitted that the information sought by Mr Hutcheon was exempt from disclosure in terms of section 33(1)(b) of FOISA, which provides that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). This is a qualified exemption and is therefore subject to the public interest test in section 2(1)(b) of FOISA.

42.There are certain elements which an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to indicate whose commercial interests would (or would be likely to) be harmed by disclosure, the nature of those commercial interests and how those interests would (or would be likely to) be prejudiced substantially by disclosure. The prejudice must be substantial, in other words of real and demonstrable significance. Where the authority considers that the commercial interests of a third party would (or would be likely to be) harmed, it must make this clear: generally, while the final decision on disclosure will always be one for the authority, it will assist matters if the third party has been consulted on the elements referred to above.

43.It is the Commissioner's view that commercial interests in their clearest sense will relate to any commercial trading activity an organisation undertakes, such as the sale of products or services, commonly for the purpose of revenue generation. Such activity will commonly take place within a competitive environment. There is no requirement that these activities are profit-making before this exemption can be engaged, although it would be normal.

44.Having considered the Council's submissions, the Commissioner is satisfied that Cothrom does have commercial interests in the leasing of residential property.

45.Having reached this conclusion, the Commissioner must now go on to consider whether the commercial interests he has identified would, or would likely to, be prejudiced substantially by the disclosure of the information withheld. Substantial prejudice is described in paragraph 42 above: such prejudice must be at least likely before the exemption can apply.

46.In its submissions, the Council argued that the disclosure of the information sought by Mr Hutcheon would harm the commercial interests of Cothrom. It argued that disclosure of the information would create uncertainty about the future of the company and increase pressure on it. The Council considered there would be an adverse effect on Cothrom's reputation which would cause real and significant harm to its ability to continue to trade. The Council submitted that this harm would occur as soon as details of the report were published in the press.

47.The Commissioner has considered the arguments put forward by the Council and she accepts that, if this information were to be disclosed, then it is likely that substantial prejudice would be caused to Cothrom's commercial interests. Given the nature of, and detail within, the withheld information, the Commissioner agrees that its disclosure would give a significant insight into Cothrom's current financial position and strategy. The Commissioner considers its disclosure would be likely to have a significant detrimental effect on Cothrom's continuing trading activities by creating speculation about Cothrom's true financial security, thereby inhibiting its ongoing commercial activities.

48.For these reasons, the Commissioner accepts that disclosure of the withheld information would be likely to prejudice the commercial interests of Cothrom and she accepts that the exemption in section 33(1)(b) was correctly applied on that basis.

Public interest test

49.As the Commissioner has found that the exemption in section 33(1)(b) applies, she has gone on to consider the public interest test in section 2(1)(b) of FOISA. This requires consideration of whether, in all the circumstances of the case, the public interest in disclosing the withheld information is outweighed by the public interest in maintaining the exemption in section 33(1)(b).

50.In his submissions, Mr Hutcheon argued that, as Cothrom provides accommodation for vulnerable individuals, changes that could affect those people, as well as issues relating to the quality or future of service provision should be released. Additionally, he considered the Council's role in the matter involved issues relating to the public purse.

51.In its submissions, the Council referred to the minutes of its Policy and Resources Committee meeting of 15 September 2011[5] and its Social Work and Housing Committee meeting of 2 June 2011[6]. These included the information provided to Mr Hutcheon within the Council's initial response regarding the issues surrounding Cothrom and the Council's decision making.The Council considered the general public interest in the scrutiny of the public decision making process and the effective scrutiny of value for money was served by the information provided in these minutes.

52.Additionally, the Council considered the disclosure of the information would adversely impact on residential accommodation and thus the wellbeing of vulnerable individuals and that disclosure would prejudice those individuals' right to privacy.

53.The Commissioner has noted all of the comments made by Mr Hutcheon and the Council regarding the public interest test.

54.In considering the public interest in favour of disclosure, theCommissioner has recognised the general public interest in disclosing information held by Scottish public authorities. She recognises that disclosure in this case would contribute to the public's understanding of the Council's actions, its use of public funds and the rationale for the decisions it had taken.

55.The Commissioner also recognises that there are relevant and valid arguments in this case which suggest that the public interest in disclosing the information is outweighed by that in maintaining the exemption. These include the likelihood of commercial damage being caused to Cothrom through the disclosure of sensitive information and the potential damage to Cothrom's reputation. Having already concluded that disclosure in this case would harm Cothrom's commercial interests, she also recognises that it would be contrary to the public interest to place Cothrom in a disadvantageous position with respect to its competitors, to the detriment of its ability to continue to contribute to the provision of rented accommodation.

56.In this case, the Commissioner finds, on balance, that the public interest in disclosure of the report is outweighed by that in avoiding the undermining of Cothrom's ongoing ability to continue to trade and carry on its operations.She agrees that, to a certain extent, the public interest in the disclosure of the information has already been satisfied by the Council's disclosure of information, as referred to in paragraph 51.

57.Therefore, having balanced the public interest for and against disclosure in this case, the Commissioner has concluded that, in all the circumstances of the case, the public interest in maintaining the exemption in section 33(1)(b) outweighs that in disclosure of the information under consideration.

58.The Commissioner therefore finds that the Council was entitled to withhold all of the information under consideration in this decision.

DECISION

The Commissioner finds that Aberdeenshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Hutcheon.

Appeal

Should either Mr Hutcheon or Aberdeenshire Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
12 July 2012

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

33 Commercial interests and the economy

(1) Information is exempt information if-

?

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

?

(e)his physical or mental health or condition.

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 3 ? Conditions relevant for purposes of the first principle: processing of sensitive personal data

1.The data subject has given his explicit consent to the processing of the personal data.

?

5.The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

?

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

Recital 26

Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable?.

[1] http://www.aberdeenshirecouncil.org.uk/committees/detail.asp?ref_no=802572870061668E80257757005502FE

[2] http://www.ico.gov.uk/~/media/documents/library/Data_Protection/Detailed_specialist_guides/PERSONAL_DATA_FLOWCHART_V1_WITH_PREFACE001.ashx

[3] http://www.legislation.gov.uk/uksi/2000/417/pdfs/uksi_20000417_en.pdf

[4] Http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38.aspx

[5] http://www.aberdeenshire.gov.uk/committees/files_meta/802572870061668E802579420035F475/15.09.11%20p&r.pdf

[6] http://www.aberdeenshire.gov.uk/committees/files_meta/802572870061668E802578B1005E7DB8/02.06.11%20swh.pdf