Decision 155/2010 Mr Y and the University of Glasgow
Academic staff salaries
Reference No: 200902069
Decision Date: 06 September 2010
Summary
Mr Y requested from the University of Glasgow (the University) details of the salaries of all academic staff at the University. The University withheld the information under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA). Following a review, Mr Y remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the University had dealt with Mr Y's request for information in accordance with Part 1 of FOISA, by correctly applying section 38(1)(b) to the salary information.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), 2(a)(i), 2(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal Information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions ? definition of "personal data") and Schedules 1 (The data protection principles ? the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? conditions 1 and 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Decision 027/2009 Highland News Group and Highlands and Islands Enterprise
Background
1.On 10 September 2009, Mr Y emailed the University requesting a range of information including the name and salary of each of the University's professors and other academic staff.
2.The University responded on 5 November 2009. It provided Mr Y with some information in response to his requests but advised him (inter alia) that it considered the information concerning the salaries of staff to be exempt from disclosure under section 38(1)(b) of FOISA.
3.On the same day, Mr Y emailed the University requesting a review of its decision to withhold the information on salaries. In particular, he considered that the University, as a body funded by the public, should be more transparent about matters such as this.
4.The University notified Mr Y of the outcome of its review on 3 December 2009 upholding its previous decision in relation to staff salaries without amendment.
5.On 4 December 2009, Mr Y wrote to the Commissioner, stating that he was dissatisfied with the outcome of the University's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Y had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 17 December 2009, the University was notified in writing that an application had been received from Mr Y and was asked to provide the Commissioner with any information withheld from him. The University responded with the information requested (which comprised the names and salary details of over 2500 members of staff) and the case was then allocated to an investigating officer.
8.The investigating officer contacted the University on 1 February 2010, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the University was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested.
9.The University responded on 1 March 2010 providing full submissions on its application of the exemption in section 38(1)(b) of FOISA which are summarised and considered in the analysis and findings section below.
10.The investigating officer also contacted Mr Y during the investigation seeking his submissions on the matters to be considered in the case. Mr Y's submissions are also summarised and considered in the analysis and findings section below.
11.Following discussions with the investigating officer, the University agreed to provide Mr Y with information showing the numbers of relevant staff receiving salaries within bandings of ?10000. This information was provided to Mr Y on 4 May 2010. At this stage, the investigating officer asked Mr Y whether he wished to withdraw his application without the need for a decision from the Commissioner. However, Mr Y indicated that he wished the Commissioner to continue with his investigation and issue a decision as to whether the specific information which he had requested should be provided to him.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Y and the University and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) of FOISA
13.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)) exempts information from disclosure if it is "personal data", as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
14.In order for a public authority to rely on this exemption, it must show firstly that the information which has been requested is personal data for the purposes of the DPA and secondly that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.
15.The University submitted that the information requested by Mr Y was personal data, the release of which would contravene the first, sixth and seventh data protection principles.
Is the information personal data?
16.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
17.In this case, the Commissioner is satisfied that the withheld information clearly relates to living individuals (i.e. employees of the University) who can be identified from that information and other information in the possession of the University. He is therefore satisfied that this information is the employees' personal data.
Would disclosure breach the first data protection principle?
18.The University has argued that the release of the information would breach the first data protection principle.
19.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure in response to Mr Y's information request.
20.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the personal data in this case does not fall into any of the relevant categories.It is therefore not necessary to consider the conditions in Schedule 3 in this case.
21.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
22.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed.If any of these conditions can be met, he must then consider whether the disclosure of this personal data would be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
23.The University was asked whether consent to disclosure of the information had been sought or received from the data subjects, since such consent would mean that condition 1 could be met. The University's response indicated that it had been judged impractical to seek consent to disclosure given the number of individuals concerned, and the fact that a number no longer worked for the universitySince consent to disclosure was neither sought no given, condition 1 is not applicable in this case.
24.In the circumstances, condition 6 would appear to be the only condition which would permit disclosure to Mr Y. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individuals to whom the data relate).
25.In its submissions, the University asserted that condition 6 in Schedule 2 of DPA could not be met, and identified no other relevant condition. The Commissioner accepts that none of the other conditions in Schedule 2 would allow processing by disclosure in this case.
26.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met.These are:
Does Mr Y have a legitimate interest in obtaining the personal data?
If yes, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?
Even if the processing is necessary for Mr Y's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr Y must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the personal data to Mr Y.
Does the applicant have a legitimate interest?
27.In its submissions, the University submitted that it did not consider that Mr Y had a legitimate interest in obtaining the requested information. The University noted that it already publishes the salary details of its Principal in its Annual Financial Statementalong with information on the remuneration of higher paid staff.
28.Within his submissions to the Commissioner, Mr Y has argued that there is a legitimate interest in scrutinising the spending of a publicly funded body, and ensuring academics are providing good value for money.
29.Having considered the submissions of both parties, the Commissioner accepts that Mr Y has a legitimate interest (as indeed do the wider public) in knowing how public money is spent and that scrutiny of this type of expenditure is a matter of general legitimate interest.
Is disclosure of the information necessary to achieve those legitimate interests?
30.The Commissioner must now consider whether disclosure is necessary for those legitimate interests and in doing so he must consider whether these interests might reasonably be met by any alternative means.
31.In this case, the Commissioner can identify no viable means of meeting Mr Y's legitimate interests which would interfere less with the privacy of the relevant data subjects other than by obtaining the exact information requested.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
32.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Mr Y and the employees in question. Only if the legitimate interests of Mr Y outweigh those of the employees in question can the information be disclosed without breaching the first data protection principle.
33.In his submissions, Mr Y commented that the salaries of a number of individuals such as senior politicians, senior civil servants and local authority Chief Executives are already in the public domain. He argued that this does not cause unwarranted prejudice to the rights and freedoms of those individuals and, consequently, knowing the salaries of University staff members would not cause unwarranted prejudice to their rights and freedoms either.
34.In its submissions, the University argued that it would be beyond the reasonable expectation of such staff for the University to disclose such information. It also argued that the direct comparison between high level public servants and University academic staffdid not have any merit with the differences between the two groups outweighing any similarity.
35.The Commissioner has previously considered requests for details of an individual's remuneration in previous decisions, including Decision 027/2009 Highland News Group and Highlands and Islands Enterprise. In particular, here and in other cases, he has referred to the guidance note produced by the Information Commissioner (who is responsible for the enforcement of the DPA throughout the United Kingdom).The most recent (and renamed) version of this guidance is entitled "Public sector salaries: how and when to disclose"[1].
36.This guidance makes it clear that those who are paid from the public purse should expect some information about their salaries to be made public.However, it also notes that salary information relates to individuals' personal financial circumstances and so deserves some protection.
37.This guidance asks authorities to consider the individual's expectations as to public scrutiny in relation to their role and disclosure of their salary (taking account, for example, of whether salaries for that type of post are generally made public and legitimate public interests in relation to disclosure), and also the level of intrusion that would follow from disclosure, but which should also take account of any particular intrusion deriving from the salary in question or the individual's own circumstances). It identifies exceptional circumstances in which disclosure might be justified, for example where there are legitimate concerns about wrongdoing or where there are current controversies or credible allegations, but generally it would appear from the guidance that disclosure of precise or detailed information on the salaries of junior staff will be considered unfair.
38.Although the Commissioner recognises that employees of public authorities should be open to scrutiny and accountability because their jobs are funded by the public purse, he also recognises that not all staff should be subject to such a level of scrutiny and draws a distinction between what information should be released about senior staff compared to what should be disclosed about less senior staff. The Commissioner accepts that, in this case, the staff under consideration are neither employed in senior management roles within the University nor responsible for decision making on major policy and financial initiatives and consequently, should not expect such scrutiny of their salaries. The Commissioner is also unable to identify any exceptional circumstances or concerns which would justify disclosure.
39.Accordingly, the Commissioner accepts that there was no reasonable expectation that information of this kind in respect of individual salaries would be made known. Having taken account of the submissions of both parties along with relevant decisions and guidance, overall he accepts the arguments made by the University as to intrusion into the privacy of the employees concerned. While noting the arguments put forward by Mr Y, he is not satisfied in the circumstances that any of these are sufficient to outweigh that intrusion. Therefore, on balance the Commissioner concludes that disclosure of the information requested would in this case be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects. He must therefore conclude that condition 6 is not met.
40.Having accepted that disclosure of the information requested would lead to unwarranted intrusion into the privacy of the individuals concerned, the Commissioner must also conclude that disclosure would be unfair. As condition 6 is not met, he would also regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure and therefore that the withheld information was properly withheld under section 38(1)(b) of FOISA.
41.As noted above, during the investigation, the University has provided Mr Y with the numbers of staff receiving salaries within bandings of ?10000. Whether any other method of providing some information to Mr Y might have been employed has not been considered, as Mr Y has sought adecision specifically on whether the particular information he requested should be disclosed.
42.As the Commissioner is satisfied that the first data protection principle would be breached by disclosure of the information, he has not gone on to consider whether any of the other data protection principles cited by the University would also be breached by disclosure.
DECISION
The Commissioner finds that the University of Glasgow complied with Part 1 of the Freedom of Information (Scotland) Act 2002in responding to the information request made by Mr Y for information about the salaries paid to professors and other academic staff.
Appeal
Should either Mr Y or the University wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
06 September 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
...
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
1.The data subject has given his consent to the processing.
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.ico.gov.uk/upload/documents/library/freedom_of_information/practical_application/salary_disclosure.pdf
