Decision 120/2011 James Johnston and City Parking (Glasgow) LLP Witness statements Reference No: 201100410 Decision Date: 16 June 2011

Summary

Mr James Johnston requested from City Parking (Glasgow) LLP (City Parking) information relating to a complaint he had made about two parking attendants, and witness statements that the attendants had made in relation to the incident.City Parking provided some information to Mr Johnston, but it withheld the two witness statements on the grounds that they were exempt from disclosure under section 38(1)(b) of FOISA.Following a review, in which City Parking upheld its decision to withhold the witness statements, Mr Johnston remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that City Parking had dealt with Mr Johnston's information request in accordance with Part 1 of FOISA.He found that the information withheld was personal data of the witnesses, and its disclosure under FOISA would breach the first data protection principle.As such, the Commissioner found that the information was correctly withheld under section 38(1)(b).

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e) (Effect of exemptions); 38(1)(a) and (b), 2(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal Information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data") and Schedules 1 (The data protection principles ? the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 13 December 2010, Mr Johnston wrote to City Parking requesting:

All correspondence held electronically or in hard copy in relation to a complaint he had made about two parking attendants, and

Copies of statements from both parking attendants that were submitted in relation to the incident.

2.City Parking responded on 13 January 2011, indicating that copies of correspondence previously issued to Mr Johnston would be forwarded to him.It refused to supply the witness statements on the grounds that these were exempt from disclosure under section 38(1)(b) of FOISA.It explained that it considered this information to be personal data, disclosure of which would breach the data protection principles set out in the DPA.

3.On 8 February 2011, Mr Johnston wrote to City Parking requesting a review of its decision. He explained that he was dissatisfied with its decision to withhold the witness statements, and explained that he wanted these because they contain information relating to himself.

4.City Parking notified Mr Johnston of the outcome of its review on 7 March 2011. It upheld the initial decision to withhold the witness statements on the grounds that they were exempt under section 38(1)(b) of FOISA.

5.On 15 March 2011, Mr Johnston wrote to the Commissioner, stating that he was dissatisfied with the outcome of City Parking's review and applying for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr Johnston had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 25 March 2011, City Parking was notified in writing that an application had been received from Mr Johnston and was asked to provide the Commissioner with the withheld witness statements. City Parking responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted City Parking, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.City Parking was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested (with particular reference to section 38(1)(b)).

9.City Parking responded with its comments and responses to the investigating officer's questions on 21 April 2011.

10.The submissions and comments received from both Mr Johnston and City Parking are considered, where relevant, in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

11.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Johnston and City Parking and is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) ? personal data

12.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, where appropriate, section 38(2)(b)), exempts information from disclosure if it is "personal data", as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA. This particular exemption is an absolute exemption (see section 2(2)(e)(ii) of FOISA), and so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.

13.In order for a public authority to rely on this exemption, it must show firstly that the information which has been requested is personal data for the purposes of the DPA and secondly that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.

14.City Parking withheld the witness statements requested by Mr Johnston on the grounds that they are the personal data of the witnesses, and their disclosure would breach the first data protection principle.

Is the information personal data?

15.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

16.The witness statements under consideration set out the recollections of and comments of the witnesses concerned about the incident which was the subject of Mr Johnston's complaint.The information clearly relates to them, and they are identifiable from the information contained in the statements alone, and from that read in conjunction with other information in the possession of City Parking.The withheld information is therefore the personal data of the two witnesses.

17.The Commissioner has also noted that, to the extent that the witness statements contain information relating to Mr Johnston and his involvement in the relevant incident, the information is also his personal data.

18.Information that is the personal data of the applicant is absolutely exempt from disclosure under section 38(1)(a) of FOISA.This exemption exists under FOISA because individuals have a separate right to make a request for their own personal data (commonly known as a "subject access request") under section 7 of the DPA.This ensures that such information is disclosed to the data subject (rather than to the world at large, which is the effect of disclosure under FOISA) under a regime designed for such purposes.

19.Although it was clearly an option for City Parking to apply the exemption in section 38(1)(a) to much of the withheld information, it has not done so.The Commissioner has therefore focussed in this decision on the consideration of the witness statements as the personal data of the witnesses.He next considered whether their disclosure would breach the first data protection principle.

Would disclosure contravene the first data protection principle?

20.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure of the personal data into the public domain in response to Mr Johnston's information request.

21.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked.For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

22.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If he considers that there is a condition in Schedule 2 which would permit the data to be disclosed, he will then go on to consider whether that information comprises sensitive personal data for the purposes of section 2 of the DPA and, if so, whether there are any conditions in Schedule 3 to the DPA which would allow the data to be processed.

23.Where a schedule 2 condition (and if necessary a schedule 3 condition) can be met he will then go on to consider whether the disclosure of this personal data would otherwise be fair and lawful.

Can any of the conditions in Schedule 2 of the DPA be met?

24.City Parking has argued that none of the conditions set out in Schedule 2 to the DPA, could be met in this case.

25.It has confirmed that the witnesses both refused to consent to the disclosure of their statements.Therefore, condition 1 of Schedule 2 (which applies where the data subject consents to the processing of their personal data) cannot be met in this case.

26.Having considered all other Conditions in Schedule 2, the Commissioner considers that only condition 6 might be applicable in the circumstances of this case.

27.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individual to whom the data relates).

28.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

1. Does Mr Johnston have a legitimate interest in obtaining the personal data?

1. If yes, is the disclosure necessary to achieve these legitimate interests? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?

1. Even if the processing is necessary for Mr Johnston's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the individual in question? There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA. Accordingly, the legitimate interests of Mr Johnston must outweigh the rights and freedoms or legitimate interests of the individual concerned before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that City Parking was correct to refuse to disclose the personal data to Mr Johnston.

Does Mr Johnston have a legitimate interest in obtaining the personal data?

29.Mr Johnston has highlighted that the witness statements contain personal data relating to him as well as the witnesses.

30.The Commissioner recognises that the witness statements contain information relevant to the complaint made by Mr Johnston, and the events leading to this. It offers some insight into the steps taken by City Parking to consider his complaint and the account of the relevant events provided by the two witnesses.

31.The Commissioner accepts that Mr Johnston has a legitimate interest in understanding the steps taken by City Parking to address his complaint and in seeing the evidence gathered.As such, he has a legitimate interest in obtaining the information contained in the witness statements.

Is disclosure necessary for the purposes of those legitimate interests?

32.The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so he must consider whether these interests might reasonably be met by any alternative means.

33.The Commissioner accepts that Mr Johnston could only fully understand the handling of his complaint if he had access to the information contained within the witness statements.He therefore accepts that disclosure is necessary for the purposes of Mr Johnston's legitimate interests.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

34.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects.As noted above, this involves a balancing exercise between the legitimate interests of Mr Johnston and those of the data subjects.Only if the legitimate interests of Mr Johnston outweigh those of the witnesses can the information be disclosed without breaching the first data protection principle.

35.City Parking has submitted that the data subjects would not expect this information to be disclosed in response to a request under FOISA, and that their legitimate interests outweigh those of Mr Johnston.

36.Having considered the content of the witness statements and the context in which they were provided, the Commissioner recognises that the individuals providing the statements would have held a clear expectation that the information they provided would not be made publicly available.

37.The Commissioner also recognises that where a complaint is made about an employee's conduct, the internal disciplinary process that follows is generally considered to be a private matter between the employer and the employee.The Commissioner considers that public disclosure of the witness statements in response to Mr Johnston's information request under FOISA would cause significant intrusion into the privacy of both individuals.

38.Having balanced Mr Johnston's legitimate interests against the rights, freedoms or legitimate interests of the data subjects, the Commissioner has found that the legitimate interests served by release of the witness statements would not outweigh the prejudice that would be caused to the rights, freedoms or legitimate interests of the data subjects, and so the disclosure would be unwarranted.

39.The Commissioner finds that condition 6 cannot be met in this case.Having accepted that disclosure of the majority of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interest of the data subjects as described above, the Commissioner also concludes, for the same reasons, that disclosure of witness statements would be unfair.

40.As disclosure of the majority of the witness statements would be unfair and no Schedule 2 condition can be met, they cannot be disclosed without contravening the first data protection principle.Consequently, disclosure would also be unlawful.

41.The Commissioner has therefore concluded that disclosure of the witness statements would breach the first data protection principle.

42.The Commissioner therefore finds that City Parking correctly applied the exemption in section 38(1)(b) to the witness statements, and so complied with Part 1 of FOISA when refusing to supply these in response to Mr Johnston's information request.

DECISION

The Commissioner finds that City Parking (Glasgow) LLP complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr James Johnston.

Appeal

Should either Mr Johnston or City Parking wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
16 June 2011

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

(i) paragraphs (a), (c) and (d); and

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?