Decision 134/2010 Mr Hugh Henry MSP and Transport Scotland
Guy Houston's employment with Transport Scotland
Reference No: 200901767
Decision Date: 21 July 2010
Summary
Hugh Henry MSP requested from Transport Scotland any and all emails and documents relating to specific subjects and sent between named individuals in relation to Guy Houston's employment with Transport Scotland.Transport Scotland responded by providing some information withholding the remainder as personal data which was exempt in terms of section 38(1)(b) of FOISA.Following a review, Mr Henry remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that Transport Scotland had dealt with Mr Henry's request for information in accordance with Part 1 of FOISA, by correctly withholding the information as personal data, the disclosure of which would contravene the first data protection principle.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e) (Effect of exemptions);38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (DPA): section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 21 May 2009, Mr Henry, in his role as convenor of the Scottish Parliament's Public Audit Committee (the PAC) wrote to Transport Scotland requesting the following information:
Any and all emails and documents relating to Guy Houston's employment with Transport Scotland; the management of his declaration of interests; and any issues and advice around the termination of his employment with Transport Scotland sent between the following people:
? Guy Houston and Paul Gray;
? Paul Gray and yourself;
? Paul Gray or yourself and Scottish Ministers;
? Malcolm Reed and yourself, Paul Gray or Scottish Ministers.
In addition, the Committee would also be grateful for copies of any and all emails and documents sent between the above listed people with regards to any issues relating to the management of declaration of staff interests within the Scottish Government from the period of the commencement of Guy Houston's employment onwards.
2.Transport Scotland responded on 29 June 2009, providing Mr Henry with some information while informing him that certain information was being withheld as personal data under the exemption in section 38(1)(b) of FOISA.
3.On 20 August 2009, Mr Henry wrote to Transport Scotland requesting a review of its decision. In particular, Mr Henry questioned whether the employment of a senior public servant would fall within this exemption.He also confirmed that his legitimate interest in obtaining the information outweighed any legitimate interest the data subject might have.
4.Transport Scotland notified Mr Henry of the outcome of its review on 17 September 2009.Transport Scotland upheld the previous decision that the information was exempt in terms of 38(1)(b) of FOISA, claiming that the information was sensitive personal data and that its disclosure would breach the first data protection principle.
5.On 8 October 2009 Mr Henry wrote to the Commissioner, stating that he was dissatisfied with the outcome of Transport Scotland's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Henry had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.Transport Scotland is an agency of the Scottish Ministers (the Ministers) and, in line with agreed procedures, the Ministers were notified in writing on 28 October 2009 that an application had been received from Mr Henry and asked to provide the Commissioner with any information withheld from him.Subsequent references to contact with or submissions from Transport Scotland are therefore references to contact with or submissions made by the Ministers on behalf of Transport Scotland.
8.Transport Scotland responded on 15 December 2009 with the information requested and the case was then allocated to an investigating officer.
9.The investigating officer subsequently contacted Transport Scotland, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, Transport Scotland was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested, with particular reference to section 38(1)(b).
10.In relation to Mr Henry's request, Transport Scotland confirmed it was relying upon section 38(1)(b) of FOISA in withholding information contained in three documents, on the basis that disclosure would breach the first data protection principle.Transport Scotland further argued, however, that document 3 (which had been previously released subject to redaction) did not in fact fall within the scope of Mr Henry's request.
11.The investigating officer further corresponded with both Transport Scotland and Mr Henry and the submissions made be each, insofar as relevant, will be considered more fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Henry and Transport Scotland and is satisfied that no matter of relevance has been overlooked.
13.In relation to Mr Henry's request, Transport Scotland provided three documents, one of which had already been released subject to redaction.Transport Scotland contended that the whole contents of documents 1 and 2 and the redactions made to document 3 comprised personal data which they considered to be exempt in terms of section 38(1)(b) of FOISA in that disclosure would breach the first data protection principle.
14.Transport Scotland further argued during the investigation that document 3 fell outwith the scope of Mr Henry's request, in that it was not a document between any of the persons named in the request.Given that persons named in the request were only involved in the communication of the document as persons copied into the email in question, the Commissioner is prepared to accept the Ministers' argument on this point in this particular case.Therefore, he will not consider document 3 further in this decision.
Section 38(1)(b) ? Personal information
15.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts information from disclosure where that information is personal data and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles in Schedule 1 to the DPA.As noted above, Transport Scotland believes that disclosure of the information would breach the first data protection principle.
16.In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA and, if it is, whether any of it is sensitive personal data as defined in section 2 of the DPA.If he is satisfied that the information is personal data, he will go on to consider whether its disclosure would breach the first data protection principle, considering the implications of its status as sensitive personal data if and where appropriate.
17.It must be borne in mind that this particular exemption (i.e. section 38(1)(b) read in conjunction with section 38(2)(a)(i) or (b)) is an absolute exemption.This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
18."Personal data" is defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."
19.The Commissioner is satisfied that a living individual can be identified form the withheld information.The information is biographical of them in a significant sense and focuses on them.Consequently, the Commissioner is satisfied that the information relates to that individual and is their personal data.
Would disclosure of the information breach the first data protection principle?
20.The first data protection principle states that the processing of personal data (here, processing being the disclosure of the data in response to a request made under FOISA) must be fair and lawful and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
21.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that none of the data under consideration here are sensitive personal data.
22.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
23.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be otherwise fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
24.The Commissioner first considered the conditions listed in Schedule 2 of the DPA (none of which Transport Scotland considered applicable in this case) and concluded that only condition 6 might be considered to apply.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individual to whom the data relate).
25.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a.Does Mr Henry have a legitimate interest in obtaining this personal data?
b.If yes, is the disclosure necessary to achieve these legitimate interests?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?
c.Even if the processing is necessary for the legitimate purposes of Mr Henry, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?This will involve a balancing exercise between the legitimate interests of Mr Henry and those of the data subjects.Only if (or to the extent that) the legitimate interests of Mr Henry outweigh those of the data subject can the personal data be disclosed.
Does the applicant have a legitimate interest?
26.Mr Henry was asked by the Commissioner to specify why he considered he had a legitimate interest in obtaining the withheld information.He commented that as the Convenor of the PAC his legitimate interest arose from the report prepared by the Auditor General for Scotland (AGS), which was laid before the Scottish Parliament and considered by the PAC under rule 6.7 of the Parliament's Standing Orders.This had raised certain issues falling within the PAC's remit and ultimately leading to the information request of 21 May 2009.
27.Mr Henry also suggested that more weight might be given to the legitimate interests of the requester where the following public interest factors were present?
current controversies or credible allegations
a lack of safeguards against corruption
normal procedures not being followed
and concluded that he considered the first of these factors to be particularly pertinent to his legitimate interest.
28.Having considered the submissions of both Transport Scotland (which accepted that Mr Henry had a legitimate interest) and Mr Henry, the Commissioner accepts that as Convenor of the PAC Mr Henry has a legitimate interest in obtaining the information withheld.
Is disclosure of the information necessary to achieve those legitimate interests?
29.Transport Scotland submitted that Parliament had certain rights, in terms of section 23 of the Scotland Act 1998, to obtain information and pointed out that the Parliament (i.e. Mr Henry in his role as Convenor of the PAC) had not sought to obtain the information requested by means of a section 23 Notice.Mr Henry, on the other hand, advised that the use of section 23 to secure the information had been considered but discounted.He pointed out that the powers it conferred were qualified and confirmed that in his view it did not provide a reasonable alternative route for securing disclosure of the information.
30.In considering whether the legitimate interests of Mr Henry might reasonably be met by any alternative means, the relevant question is whether those legitimate interests can be met by any means which interfere less with the privacy of the data subject than disclosure of the withheld personal data.While a notice under section 23 might provide the data controller (Transport Scotland) with an alternative Schedule 2 condition to permit the processing (condition 5), the Commissioner is not of the view that the effect of disclosure under such a notice would be any more or less intrusive for the data subject.In the absence of any notice under section 23 (or, apparently, any intention to serve one), therefore, there would appear to be no point in this context of considering its relevance any further.
31.In this case, the Commissioner has concluded, taking into account of all the submissions by Mr Henry and Transport Scotland (and noting in particular Mr Henry's stated inability to secure satisfactory answers to the PAC's questions by any other means) that disclosure of the withheld information is necessary to meet Mr Henry's legitimate interests.
Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
32.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject.As noted above, this involves a balancing exercise between the legitimate interests of Mr Henry and the individual in question. Only if the legitimate interests of Mr Henry outweigh those of the individual in question can the information be disclosed without breaching the first data protection principle.There is no presumption in favour of disclosure.
33.In this case Mr Henry submitted (with reference to the Information Commissioner's guidance on disclosure of salary information) that due weight should be given to the senior nature of the data subject's position with Transport Scotland, the public profile of his departure from that organisation and the attendant public interest in the circumstances of that departure.
34.Mr Henry also explained the context behind his request for information as set out in paragraph 26 above and made references to the expectations in respect of public scrutiny contained in the Scottish Public Finance Manual.
35.Transport Scotland, on the other hand, contended that disclosure would be unwarranted due to prejudice to the rights and freedoms of the data subject.It noted in particular that the matter to which the information related was covered by a Compromise Agreement which contained a confidentiality clause.The data subject would therefore have an expectation that the information would not be disclosed. In this connection, Transport Scotland drew the Commissioner's attention to advice received from the Information Commissioner's Office, as the authority responsible for Data Protection across the UK, as to the strength of the expectation of privacy created by a compromise agreement, taking account of the important and legally recognised role of such agreements in an employment context.
36.Having considered the withheld information, the Commissioner is satisfied that it falls within the scope of a legally binding Compromise Agreement, which contains a confidentiality clause applicable to that information.Consequently, the Commissioner is of the view that, having entered into a legally recognised formal agreement which places obligations of confidentiality on both parties, Mr Houston would reasonably expect that the information would not be disclosed and therefore accepts Transport Scotland's argument that there would be a strong (and legitimate) expectation on the part of the data subject that this information would not be disclosed.
37.The Commissioner has balanced the legitimate interests of the data subject against the legitimate interests identified by Mr Henry.Having done so, and, having taken account of the data subject's legitimate expectations of privacy, the Commissioner finds that the legitimate interests served by disclosure to Mr Henry would not outweigh the unwarranted prejudice that would be caused to the rights and freedoms or legitimate interests of the data subject.The Commissioner is therefore satisfied that condition 6 in Schedule 2 to the DPA is not met in this case.
38.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interest of the data subject as described above, the Commissioner must also conclude that disclosure would be unfair.As condition 6 is not met, he would also regard disclosure as unlawful.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information and that the withheld personal data was properly withheld under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that Transport Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Henry.
Appeal
Should either Mr Henry or Transport Scotland wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
21 July 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part 1 ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
?
6 (1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
