|
Decision 132/2015: Mr N and New College Lanarkshire
Investigation information
Reference No: 201500755
Decision Date: 18 August 2015
Summary
On 16 February 2015, Mr N asked New College Lanarkshire (the College) for a copy of an investigation into concerns he had raised with the College in 2012 regarding a named member of staff.
The College responded by informing Mr N that the information was personal data and exempt from disclosure. Following investigation, the Commissioner found that the College was entitled to withhold the information on the basis that it was personal data, disclosure of which would breach the data protection principles.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 16 February 2015, Mr N made an information request to the College. He asked for a copy of an investigation conducted following concerns he had raised in 2012 regarding the conduct of a staff member.
2. The College responded on 2 March 2015. The College stated that, as the requested information was personal data, the disclosure of which would breach several of the data protection principles, it was exempt from disclosure under section 38(1)(b) of FOISA. It also applied exemptions in section 36 (Confidentiality) of FOISA.
3. On 16 March 2015, Mr N wrote to the College requesting a review of its decision. He believed personal data could be redacted, which would then allow disclosure.
4. The College notified Mr N of the outcome of its review on 20 April 2015. It explained that the information could not be redacted in any way that would anonymise the information sufficiently to allow disclosure, upholding its application of section 38(1)(b).
5. On 23 April 2015, Mr N wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr N believed the information could be disclosed.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that Mr N made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
7. On 5 May 2015, the College was notified in writing that Mr N had made a valid application. The College was asked to send the Commissioner the information withheld from him. The College provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The College was invited to comment on this application and answer specific questions, with specific reference to the exemptions it had relied upon previously.
9. During the investigation, the College disclosed to Mr N some of the policy and procedural information it held within the investigation file, as it accepted this was not exempt from disclosure. Mr N acknowledged receipt of this information, but explained that the information he sought was information created as a result of the allegations and investigation. He had no interest in policy documents not so created.
10. The College provided full supporting submissions as to why it considered the remaining information to be properly withheld under exemptions including section 38(1)(b) of FOISA.
11. During the investigation, the College also provided Mr N, as an individual involved, and outwith the terms of FOISA, with a summary explanation of the circumstances. Mr N acknowledged receipt of this letter of explanation, but continued to seek a decision on the personal data that was still withheld.
Commissioner's analysis and findings
12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr N and the College. She is satisfied that no matter of relevance has been overlooked.
13. The Commissioner will first of all consider whether the College was entitled to withhold the information under section 38(1)(b) of FOISA.
Section 38(1)(b) - Personal Information
14. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
15. The College submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first and second data protection principles. It therefore argued that the information was exempt under section 38(1)(b) of FOISA.
16. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first and (if necessary) the second data protection principle, as claimed.
17. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
18. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."
19. The College told the Commissioner that Mr N had requested information about an investigation concerning a named member of staff, who was based at the College's Learning Centre within HMP Shotts. The College submitted that all of the information it had withheld related to living individuals and that living individuals could be identified from it, either directly or as a result of information that could be linked to specific individuals. It explained that, as Mr N attended the Learning Centre at HMP Shotts, where many of the participants in the investigation were based, he was better placed than a member of the general public to be able to identify individuals from the information held, even if identifiers such as names were redacted.
20. The College referred to the UK Information Commissioner's Guidance, "Determining what is personal data[1]", stating that, in addition to containing information from which living individuals could be identified, the purpose of the information was to inform or influence decisions about an individual, in this case the staff member under investigation. (The UK Information Commissioner is responsible for enforcing the DPA throughout the UK.) The College considered the information to be of "biographical significance" in relation to the staff member, who was the main focus of the majority of the documents. The College stated that the information gathered and the processing of the data, in terms of its applicability in reaching a decision on potential disciplinary action, had a clear impact on the staff member at a personal and professional level.
21. The Commissioner has considered the submissions received from the College, along with the withheld information. In the circumstances, bearing in mind that Mr N's request relates to information concerning a specific issue raised against a named individual, and the subsequent disciplinary investigation, she is satisfied that the information relates to that named living individual, who can be identified from the information. The information is biographical in relation to, and focuses on, the individual staff member. She is also satisfied that some of the information relates, in addition, to other identifiable living individuals who participated in and contributed to that investigation. The Commissioner accepts that all of the information relates to these individuals, who can be identified from it. It is therefore those individuals' personal data, as defined by section 1(1) of the DPA.
22. As indicated above, the Commissioner considers all of the withheld information to be the personal data of the individual under investigation. She does not consider it would be possible to redact the information so that the individual concerned would no longer be identifiable to Mr N and others who would be aware of the circumstances of the investigation. Consequently, it would continue to be that individual's personal data whatever redactions were made.
The first data protection principle
23. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain, in response to Mr N's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (the full text of the principle is set out in the Appendix). If the personal data are also sensitive personal data, at least one of the conditions in Schedule 3 must be met in addition: the Commissioner has considered the definition of sensitive personal data in section of the DPA and is satisfied that this does not apply to the withheld information.
24. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.
25. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
26. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Mr N. In any event, neither Mr N nor the College has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
27. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a. Is Mr N pursuing a legitimate interest or interests?
b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject(s)?
c. Even if the processing is necessary for Mr N's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
28. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr N must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the College was correct to refuse to disclose the personal data to Mr N.
Is the applicant pursuing a legitimate interest or interests?
29. The College submitted that it did not consider Mr N to have a legitimate interest for the purposes of condition 6, beyond the general public interest in confirming that allegations against College staff were appropriately addressed.
30. Mr N submitted that, as a participant in the disciplinary process, he was certain his name would have been circulated as part of the investigation. He also made further comments regarding the allegations and the outcome of the investigation, linking these to his subsequent treatment by the Scottish Prison Service within the prison system. He further submitted that, in his opinion, as a major part of the investigation, he should be made aware of the content.
31. Having considered all relevant submissions she has received on this point, along with the withheld personal data, the Commissioner accepts that Mr N, as an individual connected to the allegations and subsequent investigation, may have an interest in the disciplinary process of the College and whether, in any given case, that process has been conducted fairly. In this regard, the Commissioner notes that, during the investigation, the College provided Mr N, as an individual who was involved in the investigation, with a brief summary of the investigation and its outcome. She considers that this explanation goes some way to satisfying any legitimate interest Mr N might have.
32. However, the Commissioner does not accept that any legitimate interest Mr N might have in the allegations and their investigation would extend to the personal data under consideration in this case. While she cannot comment on the specific content of the information, she does not consider information at that level of detail to be relevant to fulfilling the legitimate interest she has identified.
33. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the personal data under consideration. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA. In reaching this conclusion, she has not found it necessary to consider the second data protection principle, also referred to in the College's submission.
34. Having found that the information under consideration was properly withheld by the College under section 38(1)(b) of FOISA, the Commissioner is not required to (and will not) go on to consider the other exemptions claimed by the College.
|
Decision
The Commissioner finds that New College Lanarkshire complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr N.
|
Appeal
Should either Mr N or the College wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
18 August 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
[1]
