Decision 139/2015: Mr Paul Hutcheon and the Chief Constable of the Police Service of Scotland Housing allowances for police officers Reference No: 201500988  Decision Date: 1 September 2015 Summary On 19 January 2015, Paul Hutcheon asked the Chief Constable of the Police Service of Scotland (Police Scotland) for information on the amount of housing allowance claimed by officers in 2013-14. Police Scotland provided Mr Hutcheon with information fulfilling part of his request, but they refused to provide a breakdown of the amount of housing allowance claimed by individual senior officers. Following a review, Mr Hutcheon remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that Police Scotland were entitled to withhold the information on the basis that it was personal data, disclosure of which would breach the first data protection principle, and therefore it was exempt from disclosure under FOISA.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 19 January 2015, Mr Hutcheon made a request for information to Police Scotland. The information requested was:

a) The number of police officers broken down by rank, from PC to Chief Constable;

b) The number of police officers broken down by rank, from PC to Chief Constable, who received a rent/housing allowance;

c) The total amount spent on rent/housing allowance in 2013/14;

d) The total amount each named assistant/deputy/chief constable (including acting and temporary) received in rent/housing allowance.

2. Police Scotland did not respond to this request.

3. On 23 February 2015, Mr Hutcheon wrote to Police Scotland requesting a review of their decision on the basis that they had failed to respond to his information request.

4. Police Scotland responded on 6 March 2015. In their response, Police Scotland provided Mr Hutcheon with information fulfilling requests a), b) and c) but they refused to provide information that met the terms of part d) of Mr Hutcheon's request, on the basis that the requested information was personal data and was exempt from disclosure in terms of section 38(1)(b) of FOISA.

5. On 6 March 2015, Mr Hutcheon wrote to Police Scotland requesting a review of their decision to withhold information from him. Mr Hutcheon argued that similar information had been disclosed by Strathclyde Police in 2010, and he did not accept that disclosure of the requested information would breach data protection legislation.

6. Police Scotland notified Mr Hutcheon of the outcome of their review on 28 April 2015. Police Scotland upheld their previous position that the requested information was personal data and was therefore exempt from disclosure in terms of section 38(1)(b) of FOISA.

7. On 25 May 2015, Mr Hutcheon wrote to the Commissioner. Mr Hutcheon applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Hutcheon stated he was dissatisfied with the outcome of Police Scotland's review because they failed to provide him with the information he had requested and he wanted the Commissioner to take into account the fact that Strathclyde Police had released similar information in the past.

Investigation

8. The application was accepted as valid. The Commissioner confirmed that Mr Hutcheon made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

9. On 8 June 2015, Police Scotland were notified in writing that Mr Hutcheon had made a valid application and the case was allocated to an investigating officer.

10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. Police Scotland were invited to comment on this application and answer specific questions including justifying their reliance on any provisions of FOISA they considered applicable to the information requested.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Hutcheon and Police Scotland. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal Information

12. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

13. Police Scotland submitted that the withheld information was personal data for the purposes of the Data Protection Act 1998 (the DPA) and that its disclosure would contravene the first data protection principle. Therefore, they argued that the information was exempt under section 38(1)(b) of FOISA.

14. In considering the application of this exemption, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle as claimed.

15. This is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

16. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

17. The Commissioner has considered the submissions received from Police Scotland on this point, along with the withheld information. She is satisfied that the information withheld is personal data: it is possible to identify living individuals from the information itself, in line with the definition of personal data. The information is significantly biographical in relation to those individuals, and therefore can be said to relate to them.

Would disclosure of the information breach the first data protection principle?

18. Police Scotland argued that disclosure of the information would breach the first data protection principle. The first data protection principle requires that personal data be processed fairly and lawfully and, in particular, shall not be processed (in this case, disclosed into the public domain in response to Mr Hutcheon's request) unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data (as defined by section 2 of the DPA), at least one of the conditions in Schedule 3 to the DPA is also met.

19. The Commissioner is of the view that the requested information is not sensitive personal data as defined by section 2 of the DPA, and it is therefore not necessary to consider whether any of the conditions in Schedule 3 could be met.

20. When considering the conditions in Schedule 2 to the DPA, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] (the CSA case) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject(s) (e.g. the named individuals to which the data relates).

21. The Commissioner considers that the only condition in Schedule 2 to the DPA which might apply in this case is condition 6. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

22. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

? Does Mr Hutcheon have a legitimate interest in obtaining the personal data?

? If so, is the disclosure necessary to achieve those legitimate interests? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects (i.e. the individuals to whom the data relate)?

? Even if making the information available is necessary for the legitimate purposes of Mr Hutcheon, would it nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects? This will involve a balancing exercise between the legitimate interests of Mr Hutcheon and those of the data subjects. Only if (or to the extent that) the legitimate interests of Mr Hutcheon outweigh those of the data subjects can the personal data be made available.

Does Mr Hutcheon have a legitimate interest?

23. There is no definition in the DPA of what constitutes a "legitimate interest." The Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance on section 38 of FOISA[2] states:

"In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

24. Mr Hutcheon did not provide any specific arguments on his legitimate interests in obtaining the withheld information, but he did suggest that as similar information had previously been disclosed by Strathclyde Police in 2010 there was no legal reason why it could not be provided in this case. Mr Hutcheon was asked to provide the Commissioner with a copy of the information he obtained from Strathclyde Police in 2010, but he failed to do so.

25. The Commissioner accepts that Mr Hutcheon, as a journalist and taxpayer, has a legitimate interest in understanding how Police Scotland allocates their financial resources and, in particular, the use of taxpayers' money to supplement the salaries of senior officers in the form of an allowance for rent or housing. The Commissioner is satisfied that Mr Hutcheon (and the general public) has a legitimate interest in knowing how much rent/housing allowance has been claimed by individual senior officers.

Is disclosure of the information necessary to achieve those legitimate interests?

26. Having concluded that Mr Hutcheon has a legitimate interest in obtaining the personal data under consideration, the Commissioner must now consider whether disclosure of the personal data is necessary in order to satisfy the legitimate interests identified above. In doing so, she must consider whether these legitimate interests might be reasonably met by any alternative means.

27. Police Scotland have argued that they have sought to meet the legitimate interest in public expenditure on these allowances for senior officers by providing aggregated figures for each rank. Police Scotland maintained that the further breakdown to identify individual officers would be unwarranted, and that Condition 6 of Schedule 2 to the DPA cannot be satisfied as a legitimising condition for the first data protection principle.

28. The Commissioner notes that Mr Hutcheon has been provided with the total amount of rent/housing allowance claimed by senior officers of each rank. However, the Commissioner does not consider that the information available to Mr Hutcheon would satisfy his legitimate interest in knowing how much rent/housing allowance was claimed by each individual senior officer.

29. The Commissioner considers that it would be necessary for the withheld personal data to be disclosed to Mr Hutcheon in order to achieve his legitimate interests. The Commissioner is not aware of any other viable means of meeting Mr Hutcheon's interests which would interfere less with the privacy of the data subjects (i.e. the senior police officers) than providing the withheld personal data. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mr Hutcheon's legitimate interests.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

30. The Commissioner must now consider whether disclosure of the personal data requested by Mr Hutcheon would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the senior police officers. As noted above, this involves a balancing exercise between the legitimate interests of Mr Hutcheon and those of the data subjects. Only if the legitimate interests of Mr Hutcheon outweigh those of the senior police officers can the information be disclosed without breaching the first data protection principle.

31. In the Commissioner's briefing on the personal information exemption, she notes that a number of factors should be taken into account in carrying out the balancing exercise. These include:

? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

? the potential harm or distress that may be caused by disclosure

? whether the individual objected to the disclosure

? the reasonable expectations of the individuals as to whether the information should be disclosed.

32. Police Scotland have submitted that the senior police officers were not approached for their consent to the disclosure of their personal information, either on receipt of the original request or the request for review. Police Scotland argued that they do not consider that consent is a sound legitimising condition for the disclosure of personal information, as it is not possible for the data subject(s) to be informed about the likely use or disclosure of their data once disclosed under FOI, or to maintain a level of control over it. Police Scotland also argued that seeking consent from senior officers was not warranted in this case, given the outcome of a previous decision by the Commissioner, Decision 180/2014 Mr Michael Roulston and the Chief Constable of the Police Service of Scotland[3] which upheld that disclosure of the rent/housing allowance claimed by individual senior officers would breach the first data protection principle.

33. Police Scotland explained that the housing/rent allowances paid to senior officers forms part of their terms and conditions which they accepted at the time of gaining employment with the police and, as such, these individuals would have an expectation that the specific details would remain confidential between themselves and their employer.

34. Police Scotland further explained that the rent/housing allowances are influenced by matters concerning the private lives of the officers: for example, their marital status; whether their property is shared with another officer; and what rank the officer holds. As a result, Police Scotland argued that the allowances are not purely related to the individual's public role and are dependent on factors which are personal to them. Disclosure of such information would therefore be unfair to these individuals and would impinge on their right to a private life.

35. Mr Hutcheon argued that similar information about senior officers was disclosed by Strathclyde Police in 2010 and he indicated that there was no reason why it could not be disclosed in this case. The Commissioner notes that, despite asking Mr Hutcheon to provide her with the information he obtained from Strathclyde Police in 2010, he did not do so. In light of this, the Commissioner has not been able to take into account the information that Strathclyde Police disclosed in 2010 as she has not seen it.

36. The Commissioner has considered all of the submissions made by Mr Hutcheon and Police Scotland when balancing the legitimate interests in this case.

37. The Commissioner accepts that most employees have a general expectation that information which, at least in part, relates to their private lives will not be disclosed into the public domain. In this case, the Commissioner accepts that the amount of rent/housing allowance received by a senior officer partly depends on matters concerning their private lives (such as marital status and/or house-sharing arrangements). The Commissioner accepts that the disclosure of such information would be a significant intrusion into matters which the senior officers would reasonably expect to be kept private, even accepting the seniority of the positions occupied.

38. The Commissioner has weighed Mr Hutcheon's legitimate interests in the withheld information against the rights, freedoms and legitimate interests of the senior police officers. As noted previously, there can be no presumption that the disclosure of personal data is in the public interest. The Commissioner must be satisfied that Mr Hutcheon's legitimate interests outweigh those of the senior officers before requiring disclosure.

39. Having considered the nature and content of the withheld information, the Commissioner has concluded that, on balance, disclosure would be disproportionately intrusive. She finds that disclosure would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the senior police officers. As such, she finds that condition 6 in Schedule 2 to the DPA is not met.

40. For the reasons given above, the Commissioner also finds that disclosure would be unfair. In addition, since the Commissioner has found that no condition in Schedule 2 can be met, she would consider disclosure to be unlawful. It therefore follows that disclosure of the personal data under consideration would breach the first data protection principle. Accordingly, the Commissioner accepts that this information is exempt from disclosure and Police Scotland were entitled to withhold it under section 38(1)(b) of FOISA.

Decision The Commissioner finds that, in relation to the matters raised by Mr Hutcheon in his application for a decision, Police Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to his information request.

Appeal

Should either Mr Hutcheon or the Chief Constable of the Police Service of Scotland wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

1 September 2015

Appendix 1: Relevant statutory provision

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met
 

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---

[1]

[2]

[3]