|
Decision 141/2015: Mr Andrew Hamilton and the Scottish Qualifications Authority
Qualifications of named individuals
Reference No: 201500860
Decision Date: 1 September 2015
Summary
On 9 April 2015, Mr Hamilton asked the Scottish Qualifications Agency (the SQA) for qualification and training information about two named individuals. The SQA stated that the requested information was exempt from disclosure as it consisted of personal data.
The Commissioner investigated and found that the SQA was entitled to refuse to confirm or deny whether it held relevant recorded information, or whether such information existed.
|
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for the purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 9 April 2015, Mr Hamilton made a request for information to the SQA. The request asked the SQA for specific training and qualification information relating to two individuals. Included in the request were the names of the individuals and two reference numbers, which did not relate to the SQA but to another organisation.
2. The SQA responded on 16 April 2015. The response informed Mr Hamilton that he had asked for personal data, disclosure of which would contravene at least one of the DPA principles. Section 38(1)(b) of FOISA would therefore apply to the information. It did not, however, confirm whether it held the requested information.
3. Within this response the SQA also informed Mr Hamilton, wrongly, that FOISA only gives individuals the right to access non-personal data held by the authority.
4. On 17 April 2015, Mr Hamilton wrote to the SQA, requesting a review of its decision. He provided additional information explaining why he had a personal interest in disclosure of the information requested.
5. The SQA notified Mr Hamilton of the outcome of its review on 30 April 2015. The SQA upheld its original response.
6. On 7 May 2015, Mr Hamilton wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Hamilton explained why he did not believe the exemption applied.
Investigation
7. The application was accepted as valid. The Commissioner confirmed that Mr Hamilton made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.
8. On 28 May 2015, the SQA was notified in writing that Mr Hamilton had made a valid application. The SQA was asked to send the Commissioner any information withheld from Mr Hamilton.
9. The SQA responded on 5 June 2015. In this response, the SQA identified the circumstances in which it would disclose personal data. Following this, the case was allocated to an investigating officer.
10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SQA was invited to comment on this application and answer specific questions in relation to how it had dealt with Mr Hamilton's request in terms of FOISA. It was explained to the SQA that FOISA applied to all information held by the authority, including personal data.
11. During the investigation, following further communications with the investigating officer, the SQA provided a further response to Mr Hamilton, explaining that it did not record or hold the course attendance information that he had requested. In relation to whether it held any qualifications for the named individuals (the remainder of his request), the SQA stated that it could neither confirm or deny whether it held the information, on the basis that, if held, it would be exempt from disclosure in terms of section 38(1)(b).
12. Mr Hamilton acknowledged receipt of the further response. He still believed the SQA was obliged to provide him with any relevant information it held.
Commissioner's analysis and findings
13. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr Hamilton and the SQA. She is satisfied that no matter of relevance has been overlooked.
Handling and validity of the request
14. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority. This obligation is subject to the application of any relevant exemptions in Part 2 of FOISA and any other relevant provision in Part 1.
15. In its communications with the Commissioner, the SQA stated that on receipt of Mr Hamilton's request it knew it was for personal data it would not disclose under FOISA. During the investigation, the SQA submitted to the Commissioner that that it should have dealt with Mr Hamilton's request by responding in terms of section 18(1) of FOISA. Its informed Mr Hamilton accordingly and it submissions in this regard are considered further below
16. The SQA appears to have approached this case, at least in its communications with Mr Hamilton, on the basis that personal data are always exempt from disclosure under FOISA. This is clearly not the case and reflects a lack of understanding which is of concern to the Commissioner. She would ask the SQA to familiarise itself again with the relevant provisions of FOISA, particularly the exemptions in section 38 and her related briefing[1].
Section 18(1) of FOISA - "neither confirm nor deny"
17. As mentioned above, the SQA refused to confirm or deny whether it held any information falling within the scope of Mr Hamilton's request, or whether that information existed.
18. Section 18(1) allows public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:
? a request has been made to the authority for information which may or may not be held by it;
? if the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA
? the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.
19. Where a public authority has chosen to rely on section 18(1) of FOISA, the Commissioner must establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest. She must also establish whether, if the information existed and was held by the public authority, the authority would be justified in refusing to disclose the information by virtue of any of the exemptions provided for by sections 28 to 35, 38, 39(1) or 41 of FOISA.
20. While doing this, the Commissioner must ensure that her decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that she is unable to comment in any depth on the reliance by the public authority on any of the exemptions listed in section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.
21. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information it held would be exempt information under one or more of the listed exemptions. Where the exemption is subject to the public interest test in section 2(1)(b) of FOISA, the authority must also be able to satisfy the Commissioner that the public interest in maintaining the exemption outweighs any public interest there would be in releasing any relevant information it held.
22. In this case, the SQA submitted that if it did hold any information falling within the scope of Mr Hamilton's request, it could be withheld under section 38(1)(b) of FOISA (as read with section 38(2)(a)(i)_or section 38(2)(b)). In these cases, the exemption in section 38(1)(b) is not subject to the public interest test.
23. The Commissioner must first consider whether the SQA could have given a refusal notice under section 16(1) of FOISA in relation to the information in question, if it existed and was held.
Section 38(1)(b)
24. The SQA stated that if it held the requested information, it would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
25. In order to rely on this exemption, the SQA must show, firstly, that any such information would be personal data for the purposes of the DPA, and secondly that disclosure of that information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1. In this case, the SQA submitted that if the information were held, disclosure would be in breach of the first data protection principle.
Is the information personal data?
26. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
27. The SQA stated that any information of the kind requested by Mr Hamilton would be the personal data of the individuals referred to in the request. If held, the information would relate to the record of attainment by external candidates, detailing the SQA qualifications held by individuals. Having considered these submissions and the terms of Mr Hamilton's request is seeking, the Commissioner accepts this.
Would disclosure contravene the first data protection principle?
28. The SQA argued that disclosure of the information, if it existed and was held, would contravene the first data protection principle. It submitted that it did not consider any of the conditions of Schedule 2 of the DPA could be satisfied in relation to disclosure of the information and disclosure would, therefore, be unlawful and in breach of the first principle.
29. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain in response to Mr Hamilton's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, as defined in section 2 of the DPA, at least one of the conditions in schedule 3 to the DPA must also be met: having considered the request, the Commissioner does not believe the information Mr Hamilton is seeking could fall into any of the categories of sensitive personal data in section 2 of the DPA.
30. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the requested information to be disclosed, if it existed and was held. If any of these conditions can be met, she must then consider whether such disclosure would be fair and lawful.
31. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits disclosure, it is likely that disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
32. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the information, if held. In any event, neither Mr Hamilton nor the SQA has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
33. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a. Is Mr Hamilton pursuing a legitimate interest or interests?
b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?
c. Even if the processing is necessary for Mr Hamilton's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
34. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Hamilton must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 would permit disclosure. If the two are evenly balanced, the Commissioner must find that the SQA would be able to refuse to disclose the requested information (if held) to Mr Hamilton.
Is Mr Hamilton pursuing a legitimate interest or interests?
35. Having considered all relevant submissions she has received on this point, the Commissioner does not accept that Mr Hamilton could be said to be pursuing a legitimate interest in this case. She accepts that he may have a personal concern as to whether the named individuals hold specific qualifications, but does not accept that it follows he would be pursuing a legitimate interest in seeking the information he has requested.
36. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the requested information, if it existed and was held by the SQA.
37. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of the information, if it existed and was held, would breach the first data protection principle. The information would therefore be exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.
38. Having accepted that the SQA could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if it existed and was held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to consider whether the SQA was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.
The public interest - section 18(1)
39. Mr Hamilton explained to the Commissioner why he believed the information requested, if it existed and was held, should be disclosed.
40. The SQA recognised that under FOISA, there is a clear, general public interest in providing public access to information held by a Scottish public authority.
41. Conversely, the SQA submitted that as the national examinations authority handling personal data of all candidates undertaking SQA qualifications, there was a strong public interest in ensuring that it handled any and all personal data it held in compliance with the DPA. In this case, it emphasised that the request related to candidates and not employees of the SQA.
42. The SQA submitted that it believed its application of section 18(1) in this case illustrated its compliance with the DPA, giving assurance that it took its obligations under the DPA seriously. It provided further comments, which cannot be repeated here without tending to confirm or deny whether relevant information exists and is held.
43. Having considered the submissions of both parties, the Commissioner is satisfied, in all the circumstances of this case, that on balance, it would have been contrary to the public interest for the SQA to reveal whether the information requested by Mr Hamilton existed or was held by it.
44. As a result, the Commissioner is satisfied that, in this case, the SQA was entitled to refuse to confirm or deny, in line with section 18(1) of FOISA, whether it held the information requested by Mr Hamilton, or whether such information existed.
|
Decision
The Commissioner finds that the Scottish Qualifications Agency complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Hamilton.
|
Appeal
Should either Mr Hamilton or the SQA wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
1 September 2015
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
18 Further provision as respects responses to request
(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.
?
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
[1]
