|
Decision 123/2016: Ms Yvonne Christley and Dumfries and Galloway Health Board
Numbers and service details of staff resigning
Reference No: 201600008
Decision Date: 27 May 2016
Summary
On 14 October 2015, Ms Christley asked Dumfries and Galloway Health Board (NHS Dumfries and Galloway) for information regarding numbers and service details of staff in a particular Directorate, for six individual years.
NHS Dumfries and Galloway disclosed information on numbers of staff employed in each year, but refused to provide a precise number for those resigning in a particular year where the number was less than five. NHS Dumfries and Galloway withheld the actual figures, with grades and length of service for the staff concerned, on the basis that the information was personal data and its disclosure would breach the data protection principles. Following a review, Ms Christley remained dissatisfied and applied to the Commissioner for a decision.
The Commissioner investigated and found that NHS Dumfries and Galloway had partially failed to respond to Ms Christley's request for information in accordance with Part 1 of FOISA. She found that some of the information was not personal data and required NHS Dumfries and Galloway to disclose it to Ms Christley. The Commissioner was satisfied that NHS Dumfries and Galloway could withhold the personal data under the exemption in section 38(1)(b) of FOISA.
|
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. Appendix 1 forms part of this decision.
Background
1. On 14 October 2015, Ms Christley made a request for information to NHS Dumfries and Galloway. The information request stated:
1) The number of staff employed in the NMAHP Directorate for 2010, 2011, 2012, 2013, 2014 and 2015.
2) The number and grade of staff who resigned from their posts in the NMAP Directorate for 2010, 2011, 2012, 2013, 2014 and 2015. For staff members who resigned please include the length of service in the NMAP Directorate prior to departure.
Please note this request only refers to staff and teams who come under the direct managerial remit of the Executive Nurse Director.
2. NHS Dumfries and Galloway responded on 10 November 2015. For part 1 of the request, it disclosed the information in full. For part 2 of the request, it withheld the majority of the information under section 38(1)(b) of FOISA, on the basis that it comprised personal data and disclosure would be contrary to the data protection principles. It provided some information on staff numbers for this part of the request, but only where no staff had resigned in a given year: for the remaining years, it simply informed that Ms Christley that the number was less than five.
3. On 30 November 2015, Ms Christley wrote to NHS Dumfries and Galloway, requiring a review of its decision on the basis that she disagreed with the application of section 38(1)(b) of FOISA: she did not believe that any of the information comprised personal data.
4. NHS Dumfries and Galloway notified Ms Christley of the outcome of its review on 5 January 2016 and upheld its original response without modification.
5. On 4 February 2016, Ms Christley wrote to the Commissioner. She applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Ms Christley stated she was dissatisfied with the outcome of NHS Dumfries and Galloway's review because she did not accept that the information in question comprised personal data.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Ms Christley made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
7. On 4 February 2016, NHS Dumfries and Galloway was notified in writing that Ms Christley had made a valid application. It was asked to send the Commissioner the information withheld from her. The information was provided and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHS Dumfries and Galloway was invited to comment on this application, with specific reference to its reliance on section 38(1)(b) of FOISA.
9. Ms Christley was also invited to comment, being asked in particular to explain her legitimate interest in obtaining the information.
10. Both NHS Dumfries and Galloway and Ms Christley provided submissions to the investigating officer.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Ms Christley and NHS Dumfries and Galloway. She is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal Information
12. Where the information was held for any given year, NHS Dumfries and Galloway withheld the number of staff resigning, their grades and length of service. It withheld this information under section 38(1)(b) of FOISA.
13. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
14. NHS Dumfries and Galloway submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first, second and sixth data protection principles. It therefore argued that the information was exempt under section 38(1)(b) of FOISA.
15. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data, as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach any of the data protection principles cited by NHS Dumfries and Galloway.
16. This particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
17. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller?" (The full definition is set out in Appendix 1.) The DPA gives effect to Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (the Directive) and so should, where possible, be interpreted in a manner which is consistent with the Directive.
18. It was the view of NHS Dumfries and Galloway that due to the small number of staff that reported directly to the Executive Nurse Director (an average of 16 employed staff per year) and there only being nine leavers between 2010 and 2015, it was highly likely that an individual leaver could be identified from the information sought by Ms Christley.
19. NHS Dumfries and Galloway submitted that current and former staff members within the NMAHP Directorate had knowledge of the staffing structures and who was employed and left their posts within at least the last 2-3 year period. This would allow individual leavers to be identified readily. Specifically, it highlighted the risk of identification through the length of service (which, it submitted, was specific to the individual and not the post).
20. Taking the whole of the withheld information together, the Commissioner accepts that this information can be classed as personal data. From this combination of information, it would be possible to identify living individuals with a reasonable degree of certainty. The length of service, in particular, would be specific to each of the individuals concerned and the Commissioner accepts that this dataset, taken as a whole, would have some biographical significance in relation to those individuals. It would relate to them.
21. The Commissioner does not consider that to be an end to the matter, though. She accepts that personal data would be processed in disclosing the whole data set and, for that matter, in disclosing the grades and lengths of service (which would have the same effect), but she is not satisfied that the numbers for each year, on their own, would comprise personal data.
22. In the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1], which involved a request for statistics relating to childhood leukaemia in Dumfries and Galloway, the House of Lords concluded that the definition of "personal data" in the DPA must, in terms of recital 26 of the Directive, be taken to permit the disclosure of information which has been rendered fully anonymous in such a way that individuals are no longer identifiable from it, without having to apply the data protection principles.
23. In that case, Lord Hope considers the second part of the definition of "personal data" in the context of anonymisation. That part of the definition is what appears to be relevant here, given that NHS Dumfries and Galloway has submitted that the withheld information could be used by current and former members of staff to identify the individuals concerned, along with personal knowledge (in other words, "other information"). Lord Hope's point is that both the withheld information and the "other information" must be capable of making a contribution towards identification before the withheld information can be personal data.
24. Following Lord Hope's reasoning, if identification can be achieved from the "other information" in isolation, then the withheld information can be considered anonymous and not personal data. In this case, therefore, the Commissioner is satisfied that the numbers of those resigning in each year, alone, would not add anything to what former colleagues would know already. Indeed, NHS Dumfries and Galloway's argument appears to be that the remaining information, particularly that on length of service, would be the key to identification.
25. To ordinary members of the public, it has not been suggested that the withheld information would mean anything. Recital 26 of the Directive states that in determining whether a person is identifiable, "account should be taken of all the means likely reasonably to be used either by the [data] controller or by any other person to identify the said person". Beyond the personal knowledge of current and former employees, no such means has been suggested to the Commissioner: considering the matter objectively, no other means appears likely to her.
26. In all the circumstances, therefore, the Commissioner must conclude that the number of individuals resigning in each of the given years, taken in isolation, cannot be considered personal data, as defined by section 1(1) of the DPA. The Commissioner therefore finds that the exemption in section 38(1)(b) of FOISA cannot apply to this element of the withheld information. No other exemption has been applied to the information, so she requires NHS Dumfries and Galloway to disclose this information to Ms Christley.
27. Having accepted that the staff grades and lengths of service are personal data, the Commissioner now go on to consider whether they are exempt from disclosure under section 38(1)(b).
28. NHS Dumfries and Galloway submitted that disclosure would breach the first, second and sixth data protection principles. The Commissioner will begin by considering the first data protection principle.
Would disclosure breach the first data protection principle?
29. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.
30. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 (and, where relevant, one in Schedule 3) which permits disclosure, it is likely that disclosure will also be fair and lawful.
31. NHS Dumfries and Galloway was of the view that the data fell within the bounds of "sensitive personal data" because the information related to personal information held by the Workforce Directorate, within the remit of the Employment Practice Code. This does not take the data within the bounds of any of the categories of personal data listed in section 2 of the DPA. The Commissioner would urge NHS Dumfries and Galloway to consider that definition more carefully in future.
32. In any event, there is no need to consider the requirements of Schedule 3 to the DPA. The Commissioner need only consider whether any of the conditions in Schedule 2 to the DPA would permit disclosure of the withheld personal data.
33. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the Common Services Agency case, discussed above, that the conditions require careful treatment in the context of a request for information under FOISA: they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject. The processing under consideration in this case would be the disclosure of the personal data into the public domain, in response to Ms Christley's information request.
Can any of the conditions in Schedule 2 to the DPA be met?
34. Condition 6 of Schedule 2 to the DPA would appear to be the only condition which might permit disclosure of the personal data requested by Ms Christley. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
35. There are a number of different tests which must therefore be satisfied before condition 6 can be met. These are:
? Does Ms Christley have a legitimate interest in obtaining the personal data?
? If she does, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject (the individual(s) to whom the data relate)?
? Even if the processing is necessary for Ms Christley's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?
36. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by FOISA. Accordingly, the legitimate interests of Ms Christley must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that NHS Dumfries and Galloway was correct to refuse to disclose the personal data to Ms Christley.
Does Ms Christley have a legitimate interest?
37. Ms Christley submitted that disclosure of the information would permit an objective assessment of the rates of staff turnover and retention within the Directorate. This, she asserted, would allow the leadership and management of the Directorate to be scrutinised and held accountable.
38. The Commissioner accepts that Ms Christley has demonstrated a legitimate interest in the withheld length of service information. Disclosure could assist in providing transparency in relation to the issues identified by Ms Christley, which are matters of some public concern.
39. The Commissioner is not satisfied, however, that the grading information withheld NHS Dumfries and Galloway is relevant to the legitimate interest identified by Ms Christley. Therefore, she must conclude that condition 6 cannot be met in relation to this information.
Is disclosure of the information necessary for Ms Christley's legitimate interests?
40. Having established that Ms Christley does have a legitimate interest (in relation to the length of service information), the Commissioner must now go on to consider whether disclosure is necessary for the purposes of that legitimate interest. She must consider whether disclosure is proportionate as a means and fairly balanced as to ends, or whether these legitimate aims could be achieved by alternative means which would interfere less with the privacy of the individual(s) in question.
41. After considering all relevant submissions, the Commissioner cannot identify any other viable means of meeting Ms Christley's interests which would interfere less with the privacy of the data subject(s) than providing the withheld personal data. For this reason, the Commissioner is satisfied that disclosure is necessary for the purposes of Ms Christley's legitimate interests.
Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
42. As the Commissioner is satisfied that disclosure of the withheld personal data (in relation to length of service) is necessary to fulfil Ms Christley's legitimate interests, she must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s). As noted above, this involves a balancing exercise between the legitimate interests of Ms Christley and those of the individual(s) concerned. Only if the legitimate interests of Ms Christley outweigh those of the data subject(s) can the information be disclosed without breaching the first data protection principle.
43. In the Commissioner's briefing on personal information[2], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
? the potential harm or distress that may be caused by disclosure
? whether the individual objected to the disclosure
? the reasonable expectations of the individual as to whether the information should be disclosed.
44. NHS Dumfries and Galloway submitted that the information about length of service related to the individual(s)' private lives rather than specifically to the roles that they performed. Disclosing this information, NHS Dumfries and Galloway stated, could result in claims from the individual(s) concerned.
45. The Commissioner has considered the submissions from both NHS Dumfries and Galloway and Ms Christley. As stated above, she accepts the importance of transparency in relation to matters of public concern.
46. Nonetheless, she must also take into consideration that it would be unlikely that the individual(s) concerned would consent to, or reasonably expect, disclosure of the length of service information withheld by NHS Dumfries and Galloway. As NHS Dumfries and Galloway has submitted, this is information which has as much to do with their private lives as with their working lives. Indeed, it says nothing directly about the performance of their duties.
47. Having considered the competing interests in this particular case, the Commissioner finds that Ms Christley's legitimate interests are outweighed by the prejudice to the rights, freedoms and legitimate interests of the individual(s) concerned that would result from disclosure of the information on length of service. On balance, therefore, she must find that the requirements of condition 6 cannot be met in relation to this information.
48. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of this information would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA. In the circumstances, she is not required to consider the application of the other data protection principles referred to in NHS Dumfries and Galloway's submissions.
|
Decision
The Commissioner finds that Dumfries and Galloway Health Board (NHS Dumfries and Galloway) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Ms Christley.
The Commissioner finds that by withholding information that did not comprise personal data under the exemption in section 38(1)(b) of FOISA, NHS Dumfries and Galloway failed to comply with section 1(1) of FOISA.
However, the Commissioner accepts that NHS Dumfries and Galloway was entitled to withhold that information which did comprise personal data under the exemption in section 38(1)(b).
The Commissioner therefore requires NHS Dumfries and Galloway to disclose to Ms Christley the number of employees who resigned in each of the years specified in Ms Christley's information request, by 11 July 2016.
|
Appeal
Should either Ms Christley or Dumfries and Galloway Health Board wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If Dumfries and Galloway Health Board fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that it has failed to comply. The Court has the right to inquire into the matter and may deal with it as if it had committed a contempt of court.
Margaret Keyse
Head of Enforcement
27 May 2016
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6 (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
