Decision 148/2015: Ms Helen McArdle and Strathclyde Partnership for Transport Register of Interests Reference No: 201500476 Decision Date: 23 September 2015 Summary On 8 December 2014, Ms McArdle asked Strathclyde Partnership for Transport (SPT) for information held in its Register of Interests pertaining to named individuals. SPT provided some information, but informed Ms McArdle that it was withholding other information as it considered this to be third party personal data, disclosure of which would breach the data protection principles. Following a review, Ms McArdle remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that SPT was entitled to withhold the personal data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 8 December 2014, Ms McArdle made a request for information to SPT. The request was for a list of all conflicts lodged on SPT's Register of Conflicts, by six named SPT executives, from January 2010 to the present.

2. SPT acknowledged receipt of Ms McArdle's request on 16 December 2014, seeking further clarification as it was unable to identify the information requested from the details provided. It explained SPT did not hold a Register of Conflicts, but did hold a Register of Interests, and asked Ms McArdle to clarify whether her request related to the latter.

3. On 16 December 2014, Ms McArdle confirmed that her request referred to entries lodged on the Register of Interests.

4. SPT responded on 19 January 2015, providing a redacted extract of its Register of Interests which disclosed some information in relation to five of the six individuals named in Ms McArdle's request. SPT informed Ms McArdle that there were no entries in respect of the remaining individual, and so it held no relevant information on that individual. SPT refused to provide Ms McArdle with the redacted information, as it deemed this to be personal data, disclosure of which would breach the first data protection principle: it was therefore exempt from disclosure under section 38(1)(b) of FOISA.

5. On 10 February 2015, Ms McArdle wrote to SPT requesting a review of its decision. She noted that SPT was a publicly-funded body whose executives were charged with allocating public funds. She believed that where any such officials had a potential conflict of interest, this should be a matter of public, not private, record. Ms McArdle suggested there was a public interest in full transparency, as withholding the information could leave the system of awarding contracts open to abuse.

6. SPT notified Ms McArdle of the outcome of its review on 10 March 2015, upholding its original decision in full. It explained the redacted information was essentially about the private lives of the individuals concerned.

7. On 10 March 2015, Ms McArdle wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. Ms McArdle stated she was dissatisfied with the outcome of SPT's review because it had refused to provide the information in full, without redactions. She believed there was a public interest in knowing what conflicts of interest existed, particularly in relation to the awarding of contracts. If it was not possible to disclose the information in full, Ms McArdle believed a compromise could be reached.

Investigation

8. The application was accepted as valid. The Commissioner confirmed that Ms McArdle made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

9. On 7 April 2015, SPT was notified in writing that Ms McArdle had made a valid application. SPT was asked to send the Commissioner the information withheld from her. SPT provided the information and the case was allocated to an investigating officer.

10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. SPT was invited to comment on this application and answer specific questions, with particular reference to its application of section 38(1)(b) of FOISA.

11. As SPT was withholding some information under the exemption in section 38(1)(b), Ms McArdle was also invited to comment on her legitimate interest in obtaining this information.

12. SPT provided its submissions to the Commissioner on 9 July 2015.

13. Ms McArdle did not provide any further submissions on her legitimate interest in obtaining the withheld information.

Commissioner's analysis and findings

14. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Ms McArdle and SPT. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal information

15. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, (2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

16. SPT submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first data protection principle. It therefore argued that the information was exempt under section 38(1)(b) of FOISA.

17. In order to rely on this exemption SPT must show, firstly, that any such information would be personal data for the purposes of the DPA and, secondly, that disclosure of that data would contravene one or more of the data protection principles to be found in Schedule 1.

18. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

19. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

20. SPT submitted that the information it was withholding under section 38(1)(b) was personal data as defined by section 1(1) of the DPA. It explained that the information withheld in this case essentially related to the private lives of the SPT officers involved, being either information relating to membership of organisations unrelated to the individual's work, or personal data relating to third parties.

21. SPT confirmed it did not consider any of the information to be sensitive personal data.

22. The Commissioner has considered the submissions received from SPT on this point, along with the withheld information. She is satisfied that the information comprises personal data. The information records the involvement of the individuals concerned with activities outwith their employment, and also employment details of third parties related to some of these individuals. Given the nature of the information, it is possible to identify living individuals from it. It is about those individuals and so can be said to relate to them. It is therefore those individuals' personal data, as defined by section 1(1) of the DPA.

23. As indicated above, the Commissioner considers all of the withheld information to be the personal data of the individuals to whom it relates. In the circumstances, including the terms of the request and the actual information held, she does not consider it would be possible to disclose any of the withheld information without a real risk remaining that the data subjects could be identified: consequently it would remain their personal data, even following any redaction.

Would disclosure contravene the first data protection principle?

24. In its submissions, SPT argued that disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully. The processing in this case would be the disclosure of the information into the public domain, in response to Ms McArdle's request.

25. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for her to consider the conditions in Schedule 3.

26. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the information would be fair and lawful.

27. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

28. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the information to Ms McArdle. In any event, neither Ms McArdle nor SPT has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

29. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does Ms McArdle have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for Ms McArdle's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

30. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Ms McArdle must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that SPT was correct to refuse to disclose the personal data to Ms McArdle.

Does Ms McArdle have a legitimate interest in obtaining the personal data?

31. In her application to the Commissioner, Ms McArdle questioned the transparency of SPT as a public body. She submitted that where its executives had responsibility for allocating public funds, the public had a right to know what conflicts of interests these individuals may have.

32. Ms McArdle referred to a press article alleging that a particular SPT executive, with responsibility for recommending the award of subsidised contracts to bus companies, had not declared publicly at meetings awarding such contracts that he had a relative at a bus company that benefitted from the contract awards. Ms McArdle explained that although SPT had confirmed the executive in question had declared this particular interest on its Register of Interests, this was impossible to verify, as SPT considered the information held on the Register to be private, and disclosure would breach data protection. This prompted Ms McArdle to submit her request.

33. Ms McArdle submitted that the information in the Register of Interests should be disclosed in full, without redactions, in the interests of transparency. She argued that withholding this information would mean there was nothing to stop SPT executives awarding contracts to friends, family or business associates, safe in the knowledge that the connection would be "kept secret".

34. Ms McArdle also questioned why an executive would declare a conflict of interest in relation to membership of a particular organisation, if it was "unrelated" to their employment: how, she asked, could this be a potential conflict of interest?

35. Ms McArdle was given the opportunity to provide further information on her legitimate interest, but did not do so.

36. SPT did not accept that Ms McArdle had a legitimate interest. It explained that, in terms of its Code of Conduct for Employees, employees should inform senior officers of any private interest which might reasonably be seen to be influencing their work decisions. It emphasised that it was "interests" that were declared, and not "conflicts of interest".

37. SPT explained that the Register of Interests formed part of its internal governance framework: it was therefore subject to review by internal and external audit, and could be reviewed by SPT's Audit and Standards Committee. SPT provided the Commissioner with a copy of its Audit and Standards Committee's terms of reference in support of this position. It confirmed that, in line with normal public authority practice and necessary management controls for staff information, its Register of Interests was not available for inspection by members of the public or SPT members.

38. SPT acknowledged a public interest in knowing that any potential conflicts of interest were declared and monitored. It submitted that, as the information withheld in this case essentially related to the private lives of the SPT officers involved, disclosure of this information would be unnecessary and unfair.

39. In both its review outcome and its submissions to the Commissioner, SPT referred to the case of Mr Greenwood v the ICO and Bolton Metropolitan Borough Council, and Bolton Metropolitan Borough Council v the ICO and Mr Greenwood (EA/2011/0131 and 0137, 17 February 2012[1]) where the Information Rights Tribunal decided that it would be fair to release the details of Chief Officers' interests, but not their home address or their membership of other organisations unrelated to their work, or information that constituted personal data of third parties.

40. SPT submitted that its contracts were subject to open and robust public procurement arrangements, and subsequently decisions to award contracts were made by the Partnership (i.e. its Board), all in terms of its standing orders.

41. Turning to the press article referred to by Ms McArdle (paragraph 32 above), SPT confirmed that the executive concerned made relevant declarations in the Register of Interests, from November 2013, regarding his relative's employment. It explained that these declarations were referred to in a statement made by the Chair, and minuted, at the Partnership meeting on 19 December 2014: the minute was publicly available on the SPT website[2].

42. The Commissioner has considered all relevant submissions she has received on this point, along with the withheld personal data.

43. While the Commissioner accepts that Ms McArdle might have a specific interest in knowing whether a specific potential conflict of interest (if one existed) was declared in the context of the particular contract awards referred to in paragraph 32 above (which would not necessarily mean public disclosure to a meeting of the Partnership), she does not consider this interest could be met by disclosure of the information withheld in this case (which relates to the Register of Interests).

44. The Commissioner can also identify a broader public interest in transparency, so the public can have confidence in SPT's policies and actions in relation to the awarding of public contracts, and the recording and monitoring of interests which might reasonably be seen to impact on such awards. This would be addressed, at least in part, by disclosure of the information withheld in this case. In this regard, therefore, the Commissioner accepts that Ms McArdle has a legitimate interest in obtaining the withheld personal data.

Is disclosure necessary to achieve those legitimate interests?

45. The Commissioner must now go on to consider whether disclosure of the withheld personal data would be necessary to meet the legitimate interest she has identified above. As also indicated above (see paragraph 29(ii)), this will include consideration of whether the legitimate interest might be met by alternative means which interfered less with the privacy of the data subject.

46. In this case, the Commissioner has considered all relevant submissions she has received carefully. Some information from the Register of Interests has been disclosed to Ms McArdle, meeting the more general legitimate interest in transparency, if not Ms McArdle's concerns directly. Even if these do not involve making information available to the public, this legitimate interest is also catered for, to some extent, through the audit/review provisions referred to in paragraph 37 above: this is also reflected in the attention given to the matter by the SPT at its meeting on 19 December 2014.

47. The Commissioner accepts, however, that the legitimate interest in transparency in relation to the awarding of public contracts cannot be met in full without disclosure of the withheld personal data. To that extent, disclosure is necessary, so she must go on to consider whether it would nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Would disclosure nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

48. The Commissioner has taken account of the submissions by both parties, again noting that the information withheld records the involvement of the individuals concerned with activities outwith their employment, and also employment details of third parties related to some of these individuals. She has considered fully the Information Rights Tribunal decision cited by SPT.

49. The Commissioner has also taken account of her own briefing on the exemptions relating to personal data, published on her website[3]. Insofar as the withheld personal data relate to employees of SPT, she acknowledges that those employees can be considered senior. On the other hand, it is also reasonable to regard the data in question as relating to the private or family life of the individuals concerned, which means that disclosure will generally be more likely to be unwarranted.

50. Some of the data also relate to individuals who may be related to SPT senior employees, but are not themselves those employees. In relation to all the individuals concerned, it is appropriate to consider what reasonable expectations they would have in relation to disclosure of the information concerned. In all the circumstances, having considered the data in question and all relevant submissions, she does not believe they would have a reasonable expectation of disclosure.

51. Having considered these competing interests, the Commissioner must balance them. Having done so, in this particular case, the Commissioner finds that the legitimate interest in transparency is outweighed by the prejudice to the rights and freedoms of the data subject that would result from disclosure. On balance, therefore, she must find that the requirements of condition 6 cannot be met here.

52. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the requested information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA. 

Appeal

Should either Ms McArdle or Strathclyde Partnership for Transport wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

23 September 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

..

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met,

?

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

---

[1]

[2]

[3]