Decision 155/2008 Mrs Celia Pattle and Scottish Borders Council
Copy of a statement
Reference No: 200800322
Decision Date: 09 December 2008
Summary
Mrs Celia Pattle requested a copy of a statement provided to Scottish Borders Council (the Council) by a specified individual in reference to a grant application for the removal and replacement of a lead water supply. The Council responded by withholding the information requested under section 38 of FOISA, as personal data the disclosure of which would contravene the data protection principles. Following a review, Mrs Pattle remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Council had dealt with Mrs Pattle's request for information in accordance with Part 1 of FOISA, on the basis that it was correct to withhold the information under section 38(1)(b). Therefore the Commissioner did not require the Council to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2 (Effect of exemptions); 38(1)(b) and (2) (Personal information).
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1).
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 29 September 2007, Mrs Pattle wrote to the Council requesting a copy of a statement written by a named individual in relation to a grant for the removal and replacement of a lead water supply.
2.The Council responded on 6 November 2007. In its response the Council withheld the information on the basis of section 38 of FOISA. It confirmed that such information as it had released from the statement related specifically to Mrs Pattle.
3.On 15 November 2008, Mrs Pattle wrote to the Council requesting a review of its decision.
4.The Council notified Mrs Pattle of the outcome of its review on 17 December 2007. The Council upheld its original decision to apply section 38 of FOISA in withholding the statement requested by Mrs Pattle, submitting that its disclosure without the author's consent (which had been refused) would contravene the data protection principles. However, it also advisedthat it was prepared to release paperwork supporting the statement (given that it related to a grant of public money), which it went on to provide.
5.On 29 February 2008, Mrs Pattle wrote to the Commissioner's Office, stating that she was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mrs Pattle had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 10 April 2008, the Council was notified in writing that an application had been received from Mrs Pattle and asked to provide the Commissioner's Office with any information withheld from the applicant. The Council responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
9.The Council responded on 17 June 2008. In its response, the Council confirmed its position that the statement (apart from the extracts which had already been provided to Mrs Pattle) was exempt from disclosure under section 38(1)(b) of FOISA. The Council argued that disclosing the remaining content of the statement without the consent of the data subject would breach the data protection principles.
10.The investigating officer sought further submissions from the Council with a view to establishing which data protection principles the Council concluded it would breach if the information were disclosed and also whether any of the conditions in Schedule 2 of the DPA would allow the statement to be disclosed.
11.When responding with further comments, the Council also confirmed that it wished to rely on the exemption in section 36(2) of FOISA, as it felt it owed the author of the statement a duty of confidentiality and was of the view that disclosure of the statement would constitute a breach of confidence actionable by that person.
Commissioner's analysis and findings
12.In coming to a decision in this matter, the Commissioner has considered all the withheld information and the submissions that have been presented to him by both Mrs Pattle and the Council and he is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) (Personal information)
13.The information withheld in this case is contained in a statement written in response to allegations made to the Council by Mrs Pattle, relating to the approval and subsequent payment of a grant to the author of the statement and his wife in 1994/1995. The grant was paid by the then Tweeddale District Council (TDC) and was for the removal and replacement of a lead water supply. The Council submitted that apart from the extracts that had already been provided to Mrs Pattle (which related directly to her and were therefore considered to be her own personal data), the remainder of the statement in question represented the author's personal data and the disclosure of this information would breach the first data protection principle. Consequently, the Council maintained that the information requested was exempt under section 38(1)(b) of FOISA.
14.Section 38(1)(b) of FOISA, read in conjunction with (as appropriate) section 38(2)(a)(i) or (2)(b), provides basically that information is exempt if it is personal data (as defined in section 1(1) of the DPA) and its disclosure to a member of the public other than under FOISA would contravene any of the data protection principles contained in Schedule 1 to the DPA
15.Section 38(1)(b) is an absolute exemption when read in conjunction with these provisions in section 38(2) and therefore is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
16.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (see Appendix).
17.Having considered the content of the withheld information, the Commissioner is satisfied that it comprises the personal data of its author for the purposes of section 1(1) of the DPA. The information relates to a living individual (i.e. the author of the statement), who is identifiable from it. The information has that individual as its focus and is biographical about him in a significant sense, and consequently the Commissioner is satisfied that it relates to that individual and that he is the subject of it.
First data protection principle ? Personal data shall be processed fairly and lawfully
18.Having satisfied himself that the withheld information in the statement is the author's personal data, he must go on to consider whether its disclosure would contravene any of the data protection principles contained in Schedule 1 to the DPA. The Council has argued that to disclose the personal data in this case would breach the first data protection principle, which states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed (as it would be in the event of the information being disclosed to Mrs Pattle), unless at least one of the conditions in Schedule 2 (to the DPA) is met.
19.In the case of sensitive personal data, as defined in section 2 of the DPA, at least one of the conditions in Schedule 3 to the DPA must also be met. Having considered the categories of sensitive personal data listed in section 2, the Commissioner is satisfied that none of them apply to the withheld information in the statement.
20.The Council submitted that disclosing the statement would be unfair and unlawful. It maintained that because it did not inform the author that the information would be disclosed to any third party at the time he made the statement, to do so would be unlawful processing and therefore a breach of the first data protection principle.
21.The Council confirmed that on receiving Mrs Pattle's request for information it approached the author of the statement and asked whether he would agree to disclosure. He had made it clear that consent was refused.
22.In the circumstances of this case, the Commissioner has first considered the application of the conditions in Schedule 2 to the DPA.
Can a condition in Schedule 2 be met?
23.In order to determine that processing (in this case by disclosure) would be in accordance with the first data protection principle, the Commissioner would require to be satisfied that at least one of the conditions in Schedule 2 to the DPA was met. Condition 6 of Schedule 2 (see Appendix) would appear to be the only condition which might permit disclosure in the circumstances of this case. Condition 6 is met where:
"The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms of legitimate interests of the data subject."
24.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met.These are:
i)Does the applicant have a legitimate interest in obtaining this personal data?
ii)If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject(s)?
iii)Even if the processing is necessary for the legitimate purposes of the applicant, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s)?This will involve a balancing exercisebetween the legitimate interests of the applicant and those of the data subjects. Only if (or to the extent that) the legitimate interests of the applicant outweigh those of the data subject(s) can the personal data be disclosed.
25.The Council has argued that condition 6 is not met, submitting that the withheld information would not add in any way to that already provided to Mrs Pattle in other documents which had been released to her.
26.Mrs Pattle appears to have genuinely held concerns as to the proper obtaining and application of the grant monies to which the statement relates. In the circumstances, the Commissioner accepts that the wider general interest coincides with her legitimate interest in gaining access to information relating to the payment of the grant from public funds, including the withheld information in the statement which is the subject of this decision,
27.Moving on to the second test set out in paragraph 24 above, the Commissioner has considered whether disclosure of the withheld information is actually required to achieve the legitimate aims he has identified. Having considered the content of the withheld information, he can find nothing of substance contained within it which has not already been provided to Mrs Pattle within the other documents supplied in response to her information request. In the circumstances, he accepts the Council's contention that disclosure of the withheld information is not necessary in the circumstances to meet Mrs Pattle's legitimate interests.
28.As the Commissioner is not satisfied that disclosure of the withheld information from the statement is necessary for the purposes of Mrs Pattle's legitimate interests, he must conclude that condition 6 is not met and is not required to go on to consider the third test set out in paragraph 24 above. As condition 6 is not met, disclosure would contravene the first data protection principle and therefore the withheld information is exempt under section 38(1)(b) of FOISA.
29.As the Commissioner has found that the information was properly withheld under section 38(1)(b) of FOISA, he is not required to consider the application by the Council of the exemption contained in section 36(2) of FOISA.
DECISION
The Commissioner finds that Scottish Borders Council acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mrs Pattle.
Appeal
Should either Mrs Pattle or Scottish Borders Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
09 December 2008
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a)at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6.(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
