|
Decision 146/2011 Mr Paul Hutcheon and the Scottish Ministers
Payments to consultants
Reference No: 201100778
Decision Date: 2 August 2011 |
Summary
Mr Hutcheon requested from the Scottish Ministers (the Ministers) information relative to the number of consultants engaged by the First Minister's office and the amounts paid.The Ministers responded indicating that there had been one consultant, withholding the name of the consultant and the amount paid under section 38(1)(b) of FOISA (which relates to personal data).Following a review, Mr Hutcheon remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Ministers had failed to deal with Mr Hutcheon's request for information in accordance with Part 1 of FOISA, by wrongly applying the exemption in section 38(1)(b) of FOISA to withhold the information.He required the Ministers to provide the information to Mr Hutcheon.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information).
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data");Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6).
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 19 January 2011, Mr Hutcheon wrote to the Ministers requesting the following information, in respect of the period since Alex Salmond had become First Minister:
a.The names of everyone who had been seconded to work in the Office of the First Minister, and
b.How much had been paid to external consultants/consultancies by the Office of the First Minister, broken down by individual/organisation.
2.The Ministers responded on 22 February 2011. Mr Hutcheon was informed that no individuals had been seconded to the Office of the First Minster over the period in question.He was also informed that there had been one consultant, although the amount paid to that individual was personal information and exempt under section 38(1)(b) of FOISA: release of this, the Ministers submitted, would be in breach of the data protection principles because the individual concerned would have no expectation that their information would be released.
3.On 24 February 2011, Mr Hutcheon wrote to the Ministers requesting a review of their decision.He drew the Ministers' attention to their own website, which named the consultants it hired and the amounts they received.He also drew attention to decision recently issued by the Commissioner on payments from the Water Industry Commissioner for Scotland to a sole trader, which had required the payment details in that case to be released.
4.The Ministers notified Mr Hutcheon of the outcome of their review on 11 April 2011 upholding their original decision and expanding on their reasons for doing so.
5.On 23 April 2011 Mr Hutcheon wrote to the Commissioner's office, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Hutcheon had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 10 May 2011, the Ministers were notified in writing that an application had been received from Mr Hutcheon and asked to provide the Commissioner with the information withheld from him. The Ministers responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions.In particular, the Ministers were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested.These focused on the requirements of section 38(1)(b) of FOISA, the Ministers also being asked to consider the relevance of certain information the investigating officer noted was available online.
9.The Ministers responded, disputing the relevance of the online information cited to the case under consideration.The Ministers maintained that the withheld information was exempt under section 38(1)(b) of FOISA, providing reasons for this position.
10.The relevant submissions obtained from Mr Hutcheon and the Scottish Ministers will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
11.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Hutcheon and the Ministers and is satisfied that no matter of relevance has been overlooked.
12.The Commissioner notes that Mr Hutcheon's request included a breakdown of payments by individual/organisation, in response to which the Ministers withheld both the name of the consultant and the amount paid.While the Commissioner notes that certain information on the consultancy (which does appear to him to be relevant to this case) is available online, he acknowledges that it is questionable whether this information could be said to be reasonably obtainable to the applicant without further information being provided to assist him to locate it.The Ministers have not, in any event, claimed section 25(1) of FOISA (Information otherwise accessible) as it relates to the name of the consultant, and in the circumstances the Commissioner will consider whether the Ministers correctly withheld the information in terms of section 38(1)(b) only.
Section 38(1)(b) - Personal Information
13.The Ministers submitted that the withheld information was personal data for the purposes of the DPA and that disclosure of this information would contravene the first data protection principle on fair and lawful processing of personal data.Consequently, they argued that the information was exempt under section 38(1)(b) of FOISA.
14.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts information from disclosure where that information is personal data and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles in Schedule 1 to the DPA.
15.In considering the application of this exemption, the Commissioner must first determine whether the information in question is personal data as defined in section 1(1) of the DPA and then, if it is, whether any of it is sensitive personal data as defined in section 2 of the DPA.If he is satisfied that the information is personal data, he will go on to consider whether its disclosure would breach any of the data protection principles, considering the implications of its status as sensitive personal data as and where appropriate.
16.It must be borne in mind that this particular exemption (i.e. section 38(1)(b) read in conjunction with section 38(2)(a)(i) or (b)) is an absolute exemption.This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
17."Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."
18.The Ministers submitted that the name of the data subject and the amount paid is clearly personal data, in that it related to a living individual who could be identified from those data.The Commissioner is satisfied that the information withheld is the personal data of the consultant concerned.
Would disclosure breach the first data protection principle?
19.The Ministers argued that disclosure of the name of the consultant and the amount paid would breach the first data protection principle.
20.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure in response to Mr Hutcheon's information request.
21.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the withheld information in this case does not fall into any of the relevant categories.It is therefore not necessary to consider the conditions in Schedule 3 in this decision.
22.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
23.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
24.During the investigation, steps were taken to establish whether condition 1 (which applies where the data subject consents to the processing of their personal data) might be met in this case.The Ministers indicated that the data subject had previously objected to release of this information (with regard to a different request) and had verbally stated that they had not reconsidered their position.They advised that the data subject had been given the opportunity to comment on the response to this request but had not offered any further views.
Condition 6
25.In the circumstances, the Commissioner considers that condition 6 would appear to be the only condition which might permit disclosure to Mr Hutcheon. In any event, the Ministers have not argued that any other condition would be relevant.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual to whom the data relate).
26.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met.These are:
a.Does Mr Hutcheon have a legitimate interest in obtaining the personal data?
b.If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?
c.Even if the processing is necessary for Mr Hutcheon's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA.Accordingly, the legitimate interests of Mr Hutcheon must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Hutcheon.
Does the applicant have a legitimate interest?
27.In responding to Mr Hutcheon's request for review, the Ministers acknowledged that the requested information related to the expenditure of a publicly accountable office and therefore there was a legitimate interest in this level of transparency regarding the information.In their submissions to the Commissioner, the Ministers acknowledged that Mr Hutcheon, as a journalist, might consider it to be in the public interest for information related to the use of public funds by the First Minister's office to be released into the public domain.
28.Mr Hutcheon submitted that he and the public had a legitimate interest in knowing who had received payment from the public purse, and how much, in the interests of transparency.
29.Having considered all relevant submissions he has received on this point, together with the nature of the consultancy, the Commissioner accepts that Mr Hutcheon, as a journalist, has a legitimate interest in the withheld information, and that this interest extends to the wider public.
Is disclosure of the information necessary to achieve those legitimate interests?
30.The Commissioner must now consider whether disclosure of the requested information is necessary for achieving the legitimate interests he has identified, and in doing so he must consider whether these interests might reasonably be met by any alternative means.The Ministers submitted the processing of the data in this case was not necessary for the purposes of any legitimate interest.The applicant, on the other hand, could not identify any alternative means of meeting his legitimate interest.
31.Having considered the actual information withheld, the Commissioner concludes that Mr Hutcheon's legitimate interests could not be met in any way other than by the release of the information under consideration.In the circumstances, he concludes that disclosure is necessary to meet those legitimate interests.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
32.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject, the consultant. As noted above, this involves a balancing exercise between the legitimate interests of Mr Hutcheon and the individual consultant.Only if the legitimate interests of Mr Hutcheon outweigh those of the consultant can the information be disclosed without breaching the first data protection principle.
33.The Commissioner's guidance on the exemptions in section 38[1] identifies a number of factors which should be taken into account in carrying out this balancing exercise.These include:
a.whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);
b.the potential harm or distress that might be caused by the disclosure;
c.whether the individual has objected to the disclosure;
d.the reasonable expectations of the individual as to whether the information would be disclosed.
34.The Ministers considered disclosure of the information to be unwarranted by reason of prejudice to the rights and freedoms and legitimate interests of the data subject.They argued that disclosure would breach the first principle due to the sensitive and private nature of the information and its potential commercial status.They further submitted that the particular nature and sensitivity of the withheld information would cause unwarranted distress to the data subject.They considered that the individual's legitimate expectations as data subject and the obligations of the Scottish Government as a data controller, alongside article 8 of the European Convention on Human Rights and the general law of confidentiality, should all take precedence over any possible interest in disclosure.
35.The Ministers went on to submit that the data subject could reasonably have expected the information requested to be kept private, as the individual was engaged as a sole trader and therefore details of their remuneration were much more closely linked to personal finances than those of a company or consortia of consultants.The information, they argued, clearly related to the consultant's commercial and financial business position.
36.The Ministers submitted that disclosure of the information was likely to significantly prejudice the livelihood and right to privacy of the individual, particularly should that individual decide to return to consultancy work (which they were not engaged in at present).Noting that the information related to payments made to the data subject when contracted as a private consultant, they considered disclosure would reveal commercially sensitive information which might prejudice the consultant's future business.They referred to the conclusions of the reviewer (who, they submitted, had extensive experience in assessing the accounts and financial standing of businesses), to the effect that the business income of a sole trader consultant could be assumed to relate much more closely to the individual's private income than would be the case for a sole trader with more significant business overheads.
37.There appears to be some confusion as to whether the withheld information relates to the data subject's private or professional life, although the Commissioner acknowledges that there may be a fine line between business and personal income in the case of consultancy work carried out by sole traders without substantial overheads.The question, however, is whether it would be reasonable for the Commissioner to conclude that unwarranted prejudice to the data subject's rights and freedoms or legitimate interests would follow from disclosure of the information under consideration in this particular case.
38.In this connection, the Commissioner must note that the information under consideration here was already some years old at the time the Ministers dealt with Mr Hutcheon's request.Reference has been made by the Ministers to the potential relevance ? and sensitivity ? of the information should the data subject return to consultancy work of this kind, but no indication has been given as to whether this is likely or when (assuming it is) it would be likely to happen.In the absence of any further information on this point, it appears to the Commissioner that any commercial relevance this information may have had will have diminished significantly already and will continue to do so as further time passes, particularly as the information relates to relatively limited period of time.In the circumstances, it is difficult for the Commissioner to accept that the data subject would have no reasonable expectation of disclosure, even if an objection to disclosure might have carried greater weight when the information was more current.
39.Given the context outlined above, and in the absence of more specific submissions, the Ministers' submissions on distress and more significant harm seem somewhat overblown.
40.The Commissioner has, however, given consideration to the Minister's comments regarding the general law of confidentiality and article 8 of the ECHR taking precedence over any public interest in disclosure.He has, however, received no more detailed submission as to why the information should be considered confidential, or as to any obligation (explicit or implicit) under which it was obtained.Given his findings above on the submissions he has received, and having considered the information itself, he can identify no basis for pursuing the question of confidentiality further.
41.Equally, the Commissioner is always mindful of the right to respect for individuals' private and family life provided by article 8, but again he has received no submissions on this point in addition to those considered above.In the circumstances, given his conclusions on the question of prejudice, he can see no basis for giving further consideration to the application of article 8.
42.Having balanced the legitimate interests of Mr Hutcheon and those of the data subject in this particular case, therefore, the Commissioner has concluded that the legitimate interests identified by Mr Hutcheon outweigh any prejudice to the rights and freedoms and legitimate interests of the consultant.He is satisfied that disclosure of the withheld information therefore would not be unwarranted by reason of such prejudice, and therefore that condition 6 in Schedule 2 of the DPA can be met in this case.
Would disclosure be fair and lawful?
43.Having reached this conclusion, the Commissioner has gone on to consider whether (as required by the first data protection principle) disclosure of the information concerning the data subject would be fair and lawful.
44.The Commissioner considers that disclosure would be fair, for the reasons already outlined in relation to condition 6.The Ministers have not put forward any further specific arguments as to why the disclosure of the information would be unlawful, although their references to the general law of confidence the rights under Article 8 of the ECHR could be considered relevant to this question.For the reasons set out above when considering these points, however, the Commissioner is satisfied that disclosure would not be unlawful on either ground.The Commissioner can identify no other reason why disclosure should be considered unlawful.
45.Having found disclosure of the withheld information to be both fair and lawful, and in accordance with condition 6, the Commissioner therefore concludes that disclosure of the withheld information would not breach the first data protection principle.
46.The Commissioner therefore concludes that Ministers were not entitled to withhold the information under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that the Scottish Ministers failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Hutcheon.He finds that the name of the consultant and the amount paid to them were not exempt from disclosure under section 38(1)(b) of FOISA, and so by withholding this information the Ministers failed to comply with section 1(1) of FOISA.
The Commissioner requires the Ministers to provide the withheld information to Mr Hutcheon by 17 September 2011.
Appeal
Should either Mr Hutcheon or the Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
2 August 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6 (1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
