Decision 148/2007 Ms X and the University of Paisley
Request for information relating to the payments made by the University of Paisley
to higher paid staff as compensation for loss of office.
Applicant: Ms X
Authority: University of Paisley
Case No: 200700078
Decision Date: 22 August 2007
Kevin Dunion
Scottish Information CommissionerKinburn Castle
Request for information relating to compensation paid by the University of Paisley to higher paid staff for loss of office in the year ending July 2005 ? application of section 38(1)(b) of FOISA upheld by the Commissioner.
Relevant Statutory Provisions and Other Sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement); 38(1)(b) and 38(2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 section 1(1) (Basic interpretative provisions) (definition of "personal data"); Part 1 of Schedule 1 (The data protection principles ? first data protection principle)
The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Facts
Ms X requested information on the amounts paid to higher paid staff as compensation for loss of office by the University of Paisley (the University) for the year ending July 2005. The University responded by providing some of the requested information, but withholding the remainder in terms of 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA). Ms X was not satisfied with this response and asked the University to review its decision. The University carried out a review and, as a result, notified Ms X that it upheld its original decision to withhold the information. Ms X remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the University had dealt with Ms X's request for information in accordance with Part 1 of FOISA. He did not require the University to take any action.
Background
1. On 23 June 2006, Ms X wrote to the University requesting the information relating to a statement on page 21 of the University's Financial Accounts for the year ended 31 July 2005 that the "amounts provided in respect of compensation for loss of office of Higher Paid Staff totalled ?264,000?" Ms X requested:
1. The total number of employees that this payment(s) were paid to;
2. The sex of the employees that this payment(s) were paid to; and
3. Under what circumstances was this payment(s) paid namely;
a) ill health pension ex-gratia payment;
b) compensation for early termination of contract and if so how many years and or months did this payment relate to;
c) any formula used in order to calculate this payment; or
d) other, please details
2. On 24 July 2006, the University wrote to Ms X in response to her request for information. The University provided Ms X with a response to the part of her request at 3c) above but withheld the remainder of the information in terms of section 38(1)(b) of FOISA, as it constituted personal data relating to the individual(s) concerned.
3. On 1 August 2006, Ms X wrote to the University requesting a review of its decision. In particular, Ms X was of the view that it was in the public interest for this information to be disclosed and asserted that it was possible for the information to be made available without breaching the Data Protection Act 1998 (DPA).
4. On 15 September 2006, the University wrote to notify Ms X of the outcome of its review. The University informed Ms X that it upheld its original decision to withhold the information in terms of section 38(1)(b), read in conjunction with 38(2)(a)(i).
5. On 11 January 2007, Ms X wrote to my office, stating that she was dissatisfied with the outcome of the University's review and applying to me for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Ms X had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to that request.
7. My Office wrote to Ms X on 14 February 2007, advising her that a full investigation would now be carried out into her case.
8. A letter was also sent to the University on 14 February 2007, giving notice that an application had been received and that an investigation into the matter had begun, and inviting comments from the University as required under section 49(3)(a) of FOISA. The University was also asked to provide my office with copies of the information it had withheld from Ms X. The case was then allocated to an investigating officer.
The Investigation
9. The University responded in full on 13 March 2007. In its response it provided my office with copies of the withheld information and commented on the matters raised by Ms X and on the application as a whole.
Submissions from the University
10. The University submitted that the information withheld constituted the personal data of the individual(s) receiving the payment(s) concerned, and that disclosure would breach the first data protection principle. Consequently, it confirmed that it considered the information exempt in terms of section 38(1)(b) of FOISA.
11. The University asserted that the number of staff involved was so small that it disclosure would allow identification of the individual(s) concerned by others.
12. The University also provided background information on the departure of the individual(s) concerned from employment with the University, and its correspondence with them to establish whether they would consent to the disclosure of the information requested by Ms X.
Submissions from Ms X
13. Ms X argued that, as the information she sought does not include the names or identities of any third parties, the data could be disclosed without breaching the DPA, and so section 38(1)(b) of FOISA does not apply in this case.
14. Ms X argued that, as the University has terminated and continues to terminate staff contracts, it is in the public interest that the University makes the requested information available. Ms X further argued that transparency on these matters, through the disclosure of the information, would reveal whether any of the decisions to terminate contracts have been taken on gender or disability grounds.
15. Ms X suggested that the fact that the figure for early termination of contracts was stated separately within the publicly available financial accounts is indicative of significant and exceptional circumstances and that further detail of this payment should therefore be provided.
The Commissioner's Analysis and Findings
16. In coming to a decision on this matter, I have considered all of the information and the submissions that have been presented to me by both Ms X and the University and I am satisfied that no matter of relevance has been overlooked.
Application of 38(1)(b)
17. Under section 38(1)(b) of FOISA (read in conjunction with section 38(2)(a)(i) or, as appropriate section 38(2)(b)), information is exempt information if it constitutes personal data and the disclosure of the information to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in Schedule 1 to the DPA.
18. In this case, the University has stated that disclosure under FOISA of the information requested by Ms X would breach the first data protection principle.
19. In considering this exemption, I am required to consider two separate matters: firstly, whether the information under consideration is personal data and, if so, whether the release of the information to Ms X would indeed breach any data protection principles.
20. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
21. "Personal data" are defined in section 1(1) of the DPA 1998 as follows:
"data which relate to a living individual who can be identified:
a) from those data
b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller"
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
22. I am satisfied that information about payments made in the context of departure from employment, if linked to an identifiable individual, is personal data under the terms of the DPA. However, the question I must first consider in this case is therefore whether a living individual can be identified from the data requested by Ms X.
23. The University has submitted that, although Ms X did not request information about the recipient(s) of the payment(s) concerned, she had requested the number of employees who had received the payments as well as their gender. The University argued that the number of people involved is so small that disclosure of this number in combination with the release of gender type would allow identification of the individual(s) concerned by employees or others associated with the University. Consequently, the University submitted that the very real risk of identification from the requested anonymised information entailed that the information was personal data.
24. Having considered the definition of personal data contained in section 1(1) of the DPA, I agree that in this case the information requested by Ms X relates to one or more living individual(s), who could be identified from this information. Given that the number of individuals concerned is so small, the number alone (plus the knowledge that one or more people had left the University) is likely to lead to the identification of the individual(s). If information were also to be released about the gender of the individual and the reason for departure, this would significantly increase the possibility of identification. Therefore, I have concluded that the University was correct to judge this to be personal data.
Would the release of the information breach the first data protection principle?
25. I now turn to the question of whether disclosure of this personal data would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 (of the DPA) is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 (again, of the DPA) is also met.
26. I have considered the definition of "sensitive personal data" in section 2 of the DPA and do not consider that the information sought by Ms X falls into this category.
27. Having considered the information provided to my office, I accept that the expectations of the individual(s) concerned would be that the information about the payments they received would not be disclosed without their consent. The University has sought consent to disclosure and this has not bee provided.
28. It will normally be the case that the higher the position and the greater the authority of an individual, the greater is the argument for openness, transparency and accountability. In this case, the information relates to payment(s) to 'higher paid staff' and such employees would clearly possess a level of seniority within the University. However, in decision FS50071454, the UK Information Commissioner expressed the view that information which might be deemed "HR Information" e.g. a person's individual tax code, their pension contributions, and other information normally held by an organisation's Human Resources department should normally remain private.
29. Given the expectations of the data subject(s) that exist in this case, and the nature of the information concerned, I am satisfied that release of the information withheld in response to Ms X's information request would amount to unfair processing. I have noted Ms X's comments with respect to transparency and the public interest, but in all the circumstances of the case, I am satisfied that none of the conditions laid out in schedule 2 of the DPA could be met. I am therefore satisfied that the University would be in breach of the first data protection principle were it to disclose the information requested by Ms X in response to her request.
30. Consequently, I am satisfied that the information relating to third parties which has been withheld is exempt from release in terms of section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or 38(2)(b).
Decision
I find that the University of Paisley (the University) acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Ms X.
I do not require the University to take any action in response to this decision.
Appeal
Should either Ms X or the University of Paisley wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this decision notice.
Kevin Dunion
Scottish Information Commissioner
22 August 2007
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
38 Personal information
(1) Information is exempt information if it constitutes-
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires-
?
"personal data" means data which relate to a living individual who can be identified-
(a) from those data, or
(b) from those data and other information which is in the possession of,or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
Part I of Schedule 1: The data protection principles
1 Personal data shall be processed fairly and lawfully and, in particular, shall
not be processed unless-
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
