Decision 143/2012 Ms N and North Lanarkshire Council
Allegations and evidence relating to complaint
Reference No: 201102394
Decision Date: 28 August 2012
Summary
Ms N asked North Lanarkshire Council (the Council) for information about a complaint which had been made about her.Following a review, the Council withheld certain information, which it said the complainer had refused consent to release.
Following an investigation, while identifying certain technical failings in the Council's response to the request, the Commissioner found that the Council was entitled to withhold the requested information as either the applicant's personal data or the personal data of others where disclosure would breach the data protection principles.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e) (Effect of exemptions); 38(1)(a), (1)(b), (2)(a)(i) and b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.Following other correspondence with the Council about a complaint made in respect of alleged anti-social behaviour, on 14 January 2011 solicitors acting on behalf of Ms N wrote to the Council requesting details of the "allegations" and "evidence gained" (this wording was quoted from the Council's correspondence).Subsequent references to correspondence with Ms N should be read as including correspondence with solicitors acting on her behalf.
2.On 25 March 2011, having received no response to her request, Ms N wrote to the Council enclosing a copy of her request of 14 January 2011 and requesting a review in respect of its failure to respond.
3.The Council responded to Ms N on 29 March 2011.It explained that, while members of the public had the right to request access to information held in their file, there were clear exemptions applicable to protect the privacy of an affected third party.Given that Ms N was requesting details of complaints that would, by their nature and content, identify a third party who had not given their express permission for the release of the information, the Council considered itself unable to comply with this request.
4.Ms N wrote to the Council on 7 April 2011, arguing that its position was untenable.She understood the Council to be saying that it could issue written warnings to its tenants, based on complaints the details of which would not be revealed to the parties who were adversely affected.Ms N suggested that this was a clear breach of her human rights.
5.Further correspondence followed, in accordance with the Council's complaints procedure.Throughout this correspondence, Ms N reiterated that she was unhappy that she was unable to obtain the identity of the complainer or details of the allegations made.
6.In dealing with the complaint raised by Ms N, the Council advised (on 28 April 2011) that the "additional details" she had requested could not be provided without disclosing information about a third party who could be identified from that information.The Council explained that the individual in question had not consented to the information being disclosed, and it did not consider it reasonable in the circumstances to comply with the request without that individual's consent.This was reiterated in correspondence at subsequent stages of the complaints process (1 June and 1 July 2011).
7.On 1 December 2011, Ms N wrote to the Commissioner, stating that she was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. Ms N confirmed this in a letter of 16 December 2011, expanding on the reasons why she was dissatisfied with the Council's decision.
8.The application was validated by establishing that Ms N had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
9.On 24 January 2012, the Council was notified in writing that an application had been received from Ms N and was asked to provide the Commissioner with any information withheld from her.The Council responded with the information requested and the case was then allocated to an investigating officer.
10.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions.In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
11.The relevant submissions received from both the Council and Ms N will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to her by both Ms N and the Council and is satisfied that no matter of relevance has been overlooked.
13.Ms N took the view that her request (and her application to the Commissioner) related to the nature of the allegations made, rather than simply the identity of the complainer. The Council took the view that it related to the latter only, noting that her application (that is, her letter of 16 December 2011) specified the basis for her dissatisfaction as "They [the Council] will not tell us who made the allegations."
14.As Ms N's letter of 16 December 2011 also stated that, in her view, the Council had "unreasonably failed to provide the information requested concerning allegations made that ? were involved in ? disorder", the Commissioner asked Ms N to clarify what she considered to be the matter(s) which gave rise to her dissatisfaction.She confirmed that she was seeking information regarding the nature of the allegations, as well as the identity of the person who was supposed to have made them.Having considered all of the relevant correspondence between Ms N and the Council, together with her application for a decision, the Commissioner accepts this as a reasonable interpretation of both the request and the application.
15.The Council explained that it had withheld information under section 38(1)(a) and 38(1)(b) of FOISA.It also explained that it considered section 35(1)(g) of FOISA to be applicable.
Consideration of section 38(1)(a)
16.Section 38(1)(a) of FOISA contains an absolute exemption in relation to personal data of which the applicant is the data subject.The fact that it is absolute means that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.
17.This exemption exists under FOISA because individuals have a separate right to request their own personal data (commonly known as a "subject access request") under section 7 of the DPA.This ensures that such information is disclosed to the data subject (rather than to the world at large, which is the effect of disclosure under FOISA) under a regime designed for such purposes.
18."Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).Having considered the withheld information the Commissioner is satisfied that elements of the information fall within this definition, the individual to whom they relate being Ms N (i.e. the applicant in this case). The remaining personal data will be addressed by the Commissioner below (see consideration of section 38(1)(b)).
19.The Commissioner therefore finds that, in responding to Ms N's information request, the Council failed to comply with Part I of FOISA by not relying on section 38(1)(a) of FOISA in respect to information that comprised Ms N's own personal data.
20.In the circumstances, the Commissioner is satisfied that the Council is correct to withhold those elements of the requested information comprising Ms N's personal data under section 38(1)(a) of FOISA.As noted above, the exemption in section 38(1)(a) is an absolute one and the Commissioner is therefore not required (or entitled) to go on to consider whether the public interest lies in the information being disclosed or withheld.
21.It is not part of this Commissioner's functions to determine whether Ms N would be entitled to these elements of personal data under the right of subject access in section 7 of the DPA.
Consideration of section 38(1)(b)
22.The Council confirmed that it wished to withhold the remaining information in terms of section 38(1)(b) of FOISA, on the basis that it was the personal data of individuals other than Ms N and its disclosure would breach the first data protection principle.
23.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.In considering the application of this exemption, therefore, the Commissioner will first consider whether the information in question is personal data as defined in section 1(1) of the DPA and, if it is, whether disclosure of the information would breach the first data protection principle.
Is the information under consideration personal data?
24.The definition of "personal data" is set out in full in the Appendix and considered in paragraph 18 above.The Commissioner has considered the information withheld under this exemption, all of which is contained within the complainer's witness statement.
25.The Commissioner is satisfied that the information falls within the definition of personal data: living individuals can be identified from the information, which is biographical in relation to those individuals and focuses on them.The Commissioner is satisfied that the information relates to those individuals.
26.In some cases it may be possible to redact certain information with the result that individuals are no longer identifiable and consequently the information disclosed is no longer personal data.In this case, however, the Commissioner does not believe it would be possible to redact information from the complaint in such a way as to provide information from which the individuals concerned would no longer be identifiable.
27.The Commissioner will now go on to consider whether disclosure of the information would breach the first data protection principle.
The first data protection principle
28.The first data protection principle states that personal data shall be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.In this case, the processing would take the form of disclosing the information in response to Ms N's request.
29.The Council did not submit that the information included sensitive personal data as defined by section 2 of the DPA. In the circumstances, the Commissioner has not found it necessary to consider whether any of the conditions in Schedule 3 could be met.
30.When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
31.Condition 1 is applicable when the data subject (i.e. the person to whom the data relate) has given consent to the release of the information. In relation to the withheld information, the Commissioner accepts that the complainer has not given consent to the release of the information ? and indeed has stated that such consent will not be given.In the circumstances, the Commissioner would not expect the consent of any of the other data subjects to be sought.Consequently, the Commissioner is satisfied that condition 1 in Schedule 2 cannot be met in this case.
32.The Commissioner considers that condition 6 is the only other condition in Schedule 2 which might be considered to apply in this case. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
33.There are, therefore, a number of tests which must be met before condition 6 can apply. These are:
Does Ms N have a legitimate interest in obtaining these personal data?
If so, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject(s) (i.e. the individual(s) to whom the data relate)?
Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s)?As noted by Lord Hope in the above quoted judgement, there is no presumption in favour of the release of personal data under the general obligation laid down in FOISA.Accordingly, the legitimate interests of Ms N must outweigh the rights, freedoms or legitimate interests of the data subject(s) before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Ms N.
Does Ms N have a legitimate interest?
34.There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In published guidance[2] on section 38 of FOISA, the former Commissioner stated:
In some cases, the legitimate interest might be personal to the applicant ? e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
35.Ms N's views on her legitimate interest are apparent from her correspondence with the Council and with the Commissioner: namely, an interest in being able to assess fully, by means of viewing the information held by the Council, the source and nature of allegations of anti-social behaviour, and as a consequence being able to scrutinise the Council's actions in respect of the allegations and the effect on her tenancy (that is, her legitimate interest of securing her right to a settled home and family life).
36.The Council acknowledged to the Commissioner that Ms N had a legitimate interest in information as to the name of the complainer.
37.The Commissioner accepts that Ms N as an individual has a legitimate interest in understanding the actions of the Council in respect of a complaint concerning her tenancy, in order that she can assess the nature of the complaint and whether the Council has complied with its statutory duties in dealing with it. The Commissioner accepts, therefore, that Ms N has a legitimate interest in the withheld personal data.
Is disclosure of the information necessary to achieve these legitimate interests?
38.The Commissioner must now consider whether disclosure of the withheld personal data is necessary for the purposes of the legitimate interests identified above, and in doing so she must consider whether these interests might reasonably be met by any alternative means.
39.Ms N made the point consistently in her correspondence with the Council and the Commissioner that it was a breach of her human rights not to be informed of the source and content of the complaint against her.She could not scrutinise and test the Council's actions adequately without the information.
40.The Council, in its correspondence with Ms N and with the Commissioner, did not accept that her human rights been breached by its actions.In any event, it considered Ms N to have been adequately informed as to the nature of the complaint.
41.It is not for the Commissioner to put herself in the place of the Council as the body responsible for dealing with the complaint against Ms N.The Commissioner must confine herself to Ms N's entitlement to the information under FOISA.The Commissioner accepts the Council's submission that Ms N has been informed to a certain extent about the nature of the complaint.On balance, having considered the submissions of both parties, the Commissioner acknowledges that (in providing the complainer's identity and evidence) disclosure of the withheld personal data would allow a degree of additional scrutiny in relation to the complaint which could not be achieved by any alternative means.To that extent, the Commissioner accepts that disclosure is necessary for the purposes of Ms N's legitimate interests.
Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
42.Ms N contended that this was not a case where the release of the information would be unwarranted.She considered the complaint to have been volunteered to the Council by the complainer or complainers, without apparent fear of having their identity or identities disclosed.This was an imbalance, in that the data subject could do anything ? and the Council act upon it ? without giving the applicant a chance to carry out investigations herself.
43.The Council's submissions to the Commissioner also argued strongly that disclosure would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the complainer.Its more detailed arguments on this point are considered below.
44.The Commissioner has considered these arguments carefully. She has also taken into account the guidance on this point in the former Commissioner's briefing on the section 38 exemptions(see paragraph 34 above), which identifies relevant factors as including:
whether the information relates to the individual's public or private life
the potential harm or distress that may be caused by disclosure
whether the individual has objected to disclosure
the reasonable expectations of the individual as to whether their information would be disclosed.
45.In this instance, all the personal data under consideration relate to individuals' private lives: that of the complainer and those identified in the complaint.Although there are no absolute rules in this regard, generally it will be the case that where information relates to an individual's private life (i.e. their home, family, social life or finances) it will deserve greater protection than information about them acting in an official or work capacity (i.e. their public life).Indeed, Ms N's submission on her legitimate interest referred to her right to a settled home and family life (a right not unique to her).
46.The Council submitted that the complainer would not reasonably expect the information to be disclosed ? and indeed had explicitly refused consent to its disclosure.In the circumstances, it submitted, it was unlikely that the information would have been provided had the complainer expected that it would be disclosed.Having considered the information, together with the submissions received from both the Council and Ms N, on balance the Commissioner accepts the Council's submissions on this point.In all the circumstances, she also accepts that disclosure would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the other individuals to whom the information relates.
47.In this particular case, therefore, having balanced the legitimate interests of the data subjects against those identified by Ms N, the Commissioner finds that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused to the rights and freedoms or legitimate interests of the data subjects.The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in this case.
48.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject as described above, the Commissioner must also conclude that its disclosure would be unfair.As no condition in Schedule 2 to the DPA can be met, she must also find disclosure to be unlawful.In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information in the withheld personal data and that this information was properly withheld under section 38(1)(b) of FOISA.
49.Having accepted the Council's submission that the information was properly withheld in terms of section 38(1)(a) and 38(1)(b) of FOISA, the Commisisoner is not required to go on to consider whether the exemption in section 35(1)(g) was applicable.
DECISION
The Commissioner finds that North Lanarkshire Council (the Council) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Ms N.
Appeal
Should either Ms N or North Lanarkshire Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
28 August 2012
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
(i) paragraphs (a), (c) and (d); and
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
(a) personal data of which the applicant is the data subject;
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
