Decision 143/2015: Mr R and the Scottish Prison Service Employment of prisoners in prison kitchen Reference No: 201500852 Decision Date: 7 September 2015 Summary On 16 February 2015, Mr R asked the Scottish Prison Service (SPS) for information pertaining to the employment of prisoners in the HMP Edinburgh prison kitchen. The SPS provided Mr R with some of the information he had requested, and informed him that certain information was otherwise available to him. The SPS refused to provide the remainder of the information as it considered it to be third party personal data, disclosure of which would breach the data protection principles. The Commissioner investigated and found that the SPS had responded to Mr R's request for information in accordance with Part 1 of FOISA.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 16 February 2015, Mr R made a request for information to the SPS. He requested a list of prisoners working or employed in the Kitchen Pantry from 2014 to date, to include:

(i) prisoners in part-time and full-time employment

(ii) activity level classification and performance description/grade

(iii) the actual rate of payment for each activity/work session

(iv) numbers of attendance per session weekly

(v) weekly attendance - number of times the prisoner attended

(vi) weekly wages.

2. The SPS responded on 11 March 2015, providing some information in response to parts (iv) and (v) of Mr R's request. It advised Mr R, in terms of section 25(1) (Information otherwise accessible) of FOISA, that the information covered by parts (ii) and (iii) of his request was already available to him by other means. For parts (i) and (vi), the SPS refused to provide the information requested, as it considered it to be personal data relating to third parties, which it considered to be exempt from disclosure under section 38(1)(b) (Personal information) of FOISA.

3. On 31 March 2015, Mr R wrote to the SPS requesting a review of its decision on the basis that he did not believe the information amounted to third party personal data. In any event, he argued that section 38(1)(b) did not apply in this case, even if the information were personal data. Mr R accepted that some information was otherwise available, but argued that this, along with the information already provided by the SPS, was not sufficient to meet the terms of his request.

4. The SPS notified Mr R of the outcome of its review on 30 April 2015, upholding its original decision. It did not consider the personal data could be redacted to maintain the anonymity of the individuals concerned.

5. On 5 May 2015, Mr R wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. Mr R stated he was dissatisfied with the outcome of the SPS's review because of its refusal to provide information it considered to be about a third party.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr R made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 22 May 2015, the SPS was notified in writing that Mr R had made a valid application. The SPS was asked to send the Commissioner the information withheld from him. The SPS provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SPS was invited to comment on this application, and answer specific questions, with particular reference to its application of section 38(1)b) of FOISA.

9. Mr R was also invited to comment on his legitimate interest in obtaining the information withheld under section 38(1)(b). He was also asked to clarify the scope of any wider dissatisfaction he might have.

10. The SPS provided its submissions to the Commissioner on 30 June 2015.

11. Although he had asserted that he had a legitimate interest (without any further detail) in seeking a review, Mr R did not provide any submissions on his legitimate interest in response to the investigating officer's request for further comments. Neither did he provide further comments on any other areas of dissatisfaction relating to the handling of his request. Consequently, this decision will consider Mr R's dissatisfaction with the SPS's application of section 38(1)(b) of FOISA only .

Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr R and the SPS. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal information

13. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, (2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

14. The SPS submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first and sixth data protection principles. It therefore argued that the information was exempt under section 38(1)(b) of FOISA.

15. In order to rely on this exemption, the SPS must show, firstly, that any such information would be personal data for the purposes of the DPA and, secondly, that disclosure of those data would contravene one or more of the data protection principles to be found in Schedule 1.

16. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

17. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

18. The SPS told the Commissioner that it understood Mr R's request to be for information pertaining to timetabled hours, attendance, individual rates of pay and personal wage payments to each prisoner who had worked in the kitchen pantry since 2014. The request asked for a "list of prisoners". It submitted that all of the information it had withheld related to living individuals and that living individuals could be identified from those data.

19. The Commissioner has considered the submissions received from the SPS on this point, along with the withheld information. She is satisfied that the information withheld is personal data. These are records of the employment of specific individuals, including their attendance at work and associated payments. It is possible to identify living individuals from the information itself, in line with the definition of personal data. The Commissioner accepts that all of the information relates to these individuals, who can be identified from it. It is therefore those individuals' personal data, as defined by section 1(1) of the DPA.

20. As indicated above, the Commissioner considers all of the withheld information to be the personal data of the individuals concerned. In the circumstances, including the terms of the request and the actual information held, she does not consider it would be possible to disclose any of the withheld information without a real risk remaining that the data subjects could be identified: consequently it would remain their personal data, even following any redaction.

Would disclosure contravene the first data protection principle?

21. In its submissions, the SPS argued that the disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully. The processing in this case would be the disclosure of the information into the public domain, in response to Mr R's request.

22. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met.

23. The Commissioner will first consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the information would be fair and lawful.

24. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

25. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the information to Mr R. In any event, neither Mr R nor the SPS has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

26. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does Mr R have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr R's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

27. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Mr R must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the SPS was correct to refuse to disclose the personal data to Mr R.

Does Mr R have a legitimate interest in obtaining the personal data?

28. In his requirement for review, Mr R stated he required the information to enable him to pursue a legitimate purpose, but did not describe that purpose. In his application to the Commissioner, Mr R explained he required the information to support a complaint initiated against the SPS in relation to work structure and prisoners' wages. He was given the opportunity to provide further information on his legitimate interest, but did not do so.

29. The SPS submitted that Mr R had made several complaints in relation to wages, including one relating specifically to the prison kitchen. The SPS considered Mr R was seeking to prolong his complaint by other means. The SPS referred to the Prisoner Wage Earnings Policy already provided to Mr R, which defined the wage earning parameters and bonus system. It explained that wages were paid in consequence of ability and aptitude, and payments to one individual should not be understood to be relative to payments made to another.

30. The SPS submitted that Mr R wished to know individually what others in the work party had been paid. It did not consider Mr R's interest to be legitimate, as it was not necessary for him to know what others had been paid in order to know what the policy stated he should be paid.

31. The Commissioner has considered all relevant submissions she has received on this point along with the withheld personal data, and does not accept that Mr R could be said to be pursuing a legitimate interest in this case. She accepts that there may be a general public interest in transparency so the public can have confidence in the authority's policies and actions, and that there may be a more specific interest in Mr R's case in being satisfied that he has been paid appropriately in accordance with the relevant policy, but the disclosure of the requested information on an individual basis would contribute nothing of any substance to fulfilling either interest.

32. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the requested information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA. In reaching this conclusion, she has not found it necessary to consider the sixth data protection principle, also referred to in the SPS's submission.

Decision The Commissioner finds that the Scottish Prison Service complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr R.

Appeal

Should either Mr R or the Scottish Prison Service wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse

Head of Enforcement

7 September 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?