Decision 135/2015: Mr Andrew Hamilton and the Scottish Social Services Council Attendance at courses and qualifications obtained Reference No: 201500811 Decision Date: 25 August 2015 Summary On 11 March 2015, Mr Hamilton asked the Scottish Social Services Council (the SSSC) for information which would show whether two named individuals had attended certain courses and obtained certain qualifications. The SSSC withheld this information on the basis that it was personal data of the two named individuals and was exempt from disclosure under section 38(1)(b) of FOISA. Following an investigation, the Commissioner was satisfied that the SSSC did not hold some of the information Mr Hamilton had asked for, but that it had failed to notify Mr Hamilton that this was the case. The Commissioner accepted that the information held by the SSSC was exempt from disclosure under section 38(1)(b) of FOISA.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 11 March 2015, Mr Hamilton made a request for information to the SSSC. Mr Hamilton requested information about two named individuals (named in this decision as Person A and Person B). In relation to these individuals, he asked:

1. Have the above mentioned done the practice teaching course?

2. When did they complete the practice teaching course?

3. When did they receive the certificate for the practice teaching course?

4. What practice teaching training have they done and when?

5. Does it have relevance for assessing the social work honours degree course?

6. Have the above mentioned done the mental health award course?

7. When did they complete the mental health award course?

8. When did they receive the certificate for the mental health award course?

9. What mental health training have they done and when?

2. The SSSC responded on 23 March 2015. It explained that it did not require individuals to hold the qualifications specified in the request in order to register with the SSSC, and provided other information about the qualification required for Social Workers acting as Mental Health Officers. The SSSC stated that, in general, it was unable to release the information Mr Hamilton had asked for, as information about specific individuals is exempt from disclosure in terms of section 38(1)(b) of FOISA, where disclosure would breach any of the data protection principles set out in the DPA.

3. On 6 April 2015, Mr Hamilton emailed the SSSC requesting a review of its decision on the basis that he was not certain that the individuals were fully qualified. He stated that he had a personal interest in the disclosure of the information he had requested, and explained why.

4. The SSSC notified Mr Hamilton of the outcome of its review on 15 April 2015. It upheld its decision that information relating to specific individuals is exempt under section 38(1)(b) of FOISA.

5. On 1 May 2015, Mr Hamilton applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Hamilton stated he was dissatisfied with the outcome of the SSSC's review because it had failed to answer his questions and he did not believe that the individuals in question had obtained the relevant qualifications. He explained why he believed he had a legitimate interest in the release of the information.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Hamilton made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 19 June 2015, the SSSC was notified in writing that Mr Hamilton had made a valid application. The SSSC was asked to send the Commissioner the information withheld from him. The SSSC provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SSSC was invited to comment on this application and to answer specific questions. These questions focused on what information was held about the two named individuals and why it was deemed to be exempt from disclosure under section 38(1)(b) of FOISA. The SSSC responded on 20 July 2015.

9. The SSSC was asked for further information about the two named individuals. The SSSC provided this information.

10. Mr Hamilton was invited to provide his views as to why the withheld personal information should be disclosed, and did so.

11. Mr Hamilton agreed that the SSSC's response to part 5 of his request should be excluded from the Commissioner's investigation and decision.

Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Hamilton and the SSSC. She is satisfied that no matter of relevance has been overlooked.

Section 17 - Notice that information is not held

13. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received, subject to qualifications which are not applicable in this case. Under section 17(1) of FOISA, where an authority receives a request for information it does not hold, it must give an applicant notice in writing to that effect.

14. In its submissions, the SSSC explained that the qualifications which Mr Hamilton had asked about were not qualifications required for registration with the SSSC. While the SSSC gathered information from course providers on the numbers of entries, completions, withdrawals, deferrals, etc. (as part of its quality assurance/monitoring activity of SSSC - Approved courses), it did not require the names of individual candidates who had undertaken the programmes identified by Mr Hamilton.

15. The SSSC confirmed that it held some information relating to Person A. This information was covered by part 1 of Mr Hamilton's request, and was contained within a statement given by Person A.

16. The SSSC submitted that any other information falling within the scope of Mr Hamilton's request would be held in the Registrant's records within its registration/case management system. This department confirmed that the information Mr Hamilton asked for is not required for the purposes of registration with the SSSC, and that the SSSC does not hold the information.

17. The SSSC provided the Commissioner with a copy of the email correspondence from the Registrant department. It also provided a copy of the forms submitted by Person A and Person B when applying to register with the SSSC, and the record of their qualifications held in its Registration/case management system.

18. The Commissioner notes that information about the type of courses or qualifications to which Mr Hamilton's request refers is not required by the SSSC's online registration form.

19. Having considered the SSSC's submissions in relation to the information it requires for registration, together with evidence from the application forms submitted to the SSSC by Person A and Person B, the Commissioner is satisfied that the only information which the SSSC holds and which is covered by Mr Hamilton's request is information about Person A's attendance on a Practice Teaching course (part 1 of the request). The Commissioner accepts that the SSSC does not hold any other information covered by Mr Hamilton's request.

20. The SSSC stated in its review response to Mr Hamilton that the information he had asked for was exempt under section 38(1)(b) of FOISA. It failed to give him notice (as required by section 17(1) of FOISA) that it did not hold most of the information covered by his request.

21. The Commissioner recommends that the SSSC reviews the way it responds to requests, to ensure that, in future, it takes steps to identify the information that it holds before applying exemptions to information. .

Section 38(1)(b) - personal data

22. The SSSC submitted that the information it held about Person A and which is covered by part 1 of Mr Hamilton's request is personal data for the purposes of the DPA. The SSSC considered that disclosure would contravene the first data protection principle in the DPA, and the information was therefore exempt from disclosure under section 38(1)(b) of FOISA.

23. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data from release if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

24. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle.

25. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

26. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in Appendix 1).

27. In its submissions, the SSSC stated that the withheld data relates to Person A, who is identifiable from the data.

28. The Commissioner accepts this, noting that the withheld data has Person A as its main focus and is information with biographical significance for Person A.

29. Having concluded that the withheld information is personal data as defined in section 1(1) of the DPA, the Commissioner must now go on to consider whether disclosure of this information would contravene any of the data protection principles in the DPA.

Would disclosure of the information breach the first data protection principle?

30. The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed (in this case, disclosed into the public domain in response to Mr Hamilton's request) unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data (as defined by section 2 of the DPA), at least one of the conditions in Schedule 3 to the DPA is also met. (The Commissioner is satisfied that the personal data in question is not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for the Commissioner to consider the conditions in Schedule 3.)

31. When considering the conditions, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] (the CSA case) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the named individual to which the data relates).

32. Condition 1 of Schedule 2 permits personal data to be processed if the data subject consents to the data being processed. In its submissions, the SSSC explained that Person A provided the information voluntarily and their expectation is that the information will be kept confidential. The Commissioner has concluded that condition 1 in Schedule 2 cannot be met in this case.

33. The Commissioner considers that the only other condition in Schedule 2 which might apply in this case is condition 6. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

34. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

? Does Mr Hamilton have a legitimate interest in obtaining the personal data?

? If so, is the disclosure necessary to achieve those legitimate interests? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of Person A?

? Even if disclosure is necessary for those purposes, would it nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of Person A? As noted by Lord Hope in the above judgment, there is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Mr Hamilton must outweigh the rights and freedoms or legitimate interests of Person A before condition 6 will permit the personal data to be disclosed.

Does Mr Hamilton have a legitimate interest in obtaining the personal data?

35. Mr Hamilton argued that any practice teacher who does not have the award (the practice teaching certificate) is committing fraud. Mr Hamilton stated that, if they did not have the award, it means that they do not have the qualification to pass a student on the social work degree course, which means that all students without a qualified practice teacher are potentially being awarded with fraudulent degree courses by the universities which run the social work degree courses. He raised doubts about whether all social work students were being taught by properly qualified teachers.

36. Mr Hamilton submitted that social workers were important in providing legal reports for the criminal justice system, professional evidence under oath in court and in numerous other legal situations. Mr Hamilton considered that they are providing expert/professional opinion for which they are potentially not qualified.

37. The SSSC considered that it did not have enough information to reach a conclusion as to whether Mr Hamilton had a legitimate interest in the requested information.

38. In this instance, the Commissioner accepts that disclosure of the withheld information would assist Mr Hamilton in understanding whether Person A had the specified qualification, and in understanding whether there was any basis for his concerns. She has therefore concluded that he has a legitimate interest in its disclosure.

Is disclosure of the information necessary to achieve those legitimate interests?

39. Having concluded that Mr Hamilton has a legitimate interest in obtaining the personal data under consideration, the Commissioner must now consider whether disclosure of the personal data is necessary in order to satisfy the legitimate interests identified above. In doing so, she must consider whether this legitimate interest might be reasonably met by any alternative means.

40. The Commissioner considers that it would be necessary for the withheld personal data to be disclosed to Mr Hamilton in order to achieve his legitimate interest. The Commissioner is not aware of any other viable means of meeting Mr Hamilton's interests which would interfere less with the privacy of the data subject than providing the withheld personal data. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mr Hamilton's legitimate interests.

Would disclosure cause unwarranted prejudice to the legitimate interests of Person A?

41. The Commissioner must now consider whether disclosure of the personal data requested by Mr Hamilton would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Mr Hamilton and those of Person A. Only if the legitimate interests of Mr Hamilton outweigh those of Person A can the information be disclosed without breaching the first data protection principle.

42. In the Commissioner's briefing on the personal information exemption[2], she notes that a number of factors should be taken into account in carrying out the balancing exercise. These include:

? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

? the potential harm or distress that may be caused by disclosure

? whether the individual objected to the disclosure

? the reasonable expectations of the individual as to whether the information should be disclosed.

43. The SSSC explained that Person A provided the information voluntarily. The SSSC considered it would be both an unfair and unlawful to use the personal information for a purpose other than that for which it was collected.

44. The SSSC considered it would be unfair to Person A to reveal the existence and content of the information because Person A had an expectation that it would remain confidential, and disclosure could expose Person A to adverse actions by the Mr Hamilton.

45. The SSSC noted that the information provided by Person A is unverified and considered that, as such, it would be unlawful for this information to be placed in the public domain as there is no guarantee of its accuracy.

46. Having considered the nature of the requested information and the circumstances in which it was obtained by the SSSC, the Commissioner is satisfied that Person A would not have had any expectation that their personal information would be made public in the context of Mr Hamilton's information request. The Commissioner notes that Person A provided the information voluntarily, to assist the SSSC with its regulatory functions.

47. In the circumstances, the Commissioner has concluded that disclosure of this information would be prejudicial to the legitimate interests of Person A. Having balanced the legitimate interests of Person A against the legitimate interests identified by Mr Hamilton, she has concluded that disclosure would be unwarranted in this case.

48. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of Person A, the Commissioner must conclude that no condition in Schedule 2 can be met and that disclosure would breach the first data protection principle.

49. The Commissioner therefore concludes that the information about Person A was properly withheld under the exemption in section 38(1)(b) of FOISA.

50. During the investigation, the SSSC advised the Commissioner that it also considered the information to be exempt from disclosure under a number of other exemptions. Having found that the information is exempt from disclosure under section 38(1)(b) of FOISA, the Commissioner is not required (and will not go on) to consider whether these additional exemptions were correctly applied by the SSSC.

Decision The Commissioner finds that, in respect of the matters specified in the application, the Scottish Social Services Council (the SSSC) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Hamilton. The Commissioner found that the SSSC failed to provide Mr Hamilton with notice that it did not hold some of the information he had asked for, as required by section 17(1) of FOISA, and that the SSSC had wrongly applied an exemption to this information. However, the Commissioner also found that the SSSC was entitled to withhold the information it did hold under section 38(1)(b) of FOISA. She did not require the SSSC to take any action.

Appeal

Should either Mr Hamilton or the SSSC wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

25 August 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met

?

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---

[1]

[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx