Decision 159/2016: Mr Roy Mackay and Scottish Borders Council Information in relation to the Curators ad Litem etc. legislation Reference No: 201500951 Decision Date: 19 July 2016 Summary On 19 October 2014, Mr Mackay asked Scottish Borders Council (the Council) about an investigation into the Curators ad Litem and Reporting Officers (Panels) (Scotland) Regulations 2001 and associated matters at the Council. At review, the Council disclosed information to Mr Mackay, but withheld some information under several exemptions in FOISA. Mr Mackay was dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that the Council had partially failed to respond to Mr Mackay's request for information in accordance with Part 1 of FOISA. The Council had correctly withheld some information in terms of FOISA, but had incorrectly applied exemptions to other information. She required the Council to disclose information to Mr Mackay.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA sections 1(1) and (6) (General entitlement); 2(1), (2)(a) and (e)(ii) (Effect of exemptions); 25(1) (Information otherwise accessible); 30(b) and (c) (Prejudice to effective conduct of public affairs); 36(1) (Confidentiality); 38(1)(a) and (b), (2)(a)(i) and (b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA): section 1(1) (Basic interpretative provisions) (definition of "personal data"); 2 (Sensitive personal data); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6) Schedule 3 (Conditions relevant for the purposes of the first principle: processing of sensitive personal data) (conditions 1 and 5)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. In 2014, the Council commissioned the City of Edinburgh Council (the CEC) to investigate its procedures under the Curators ad Litem and Reporting Officers (Panels) (Scotland) Regulations 2001 ("the 2001 Regulations") and its handling of Mr Mackay's enquiries relating to this issue. In June 2014, the CEC's investigating officer provided the Council with a report containing findings and recommendations, which the Council accepted in their entirety. The main findings were provided to Mr Mackay.

2. On 19 October 2014, Mr Mackay made the following request to the Council:

"Please supply the following information in relation to [the 2001 Regulations] investigation & associated matters at [the Council].

1. All records relating to - including, but not limited to the consideration of, planning of, preparation for, information gathering for - an invitation dated 20 February 2014 inviting me to meet with Ms Tracey Logan (Chief Executive) and [the then Head of Corporate Governance at the Council], to discuss matters including concerns about the Council's performance of [its] statutory obligations relating to the [2001 Regulations] and the Council's handling of related complaints and requests for information.

2. All records relating to - including, but not limited to the consideration of, planning of, preparation for, information gathering for - the meeting that took place at 14:00 on 8 April 2014 between me, Ms Tracey Logan (Chief Executive) and [the Service Director Regulatory Services] at [the Council], to discuss the matters outlined in 1 above.

3. All records relating to the meeting itself (identified in 2 above) - including recording of any kind - and all matters including all enquiries and investigations arising as a result of that meeting.

4. All records relating to the (Independent) Investigation Ms Logan undertook to commission at the meeting (identified in 2 above), including - but not limited to - its specification, objectives, scope, limitations, exclusions, terms of reference, tendering, commissioning, conduct, monitoring, revising, editing, recording, approval, authorisation, evidence, documentation & reporting.

5. All records relating to claims for and/or payment of any and all fees and/or expenses and/or disbursements in relation to any/all the above."

3. On 18 November 2014, having received only an acknowledgement to his request, Mr Mackay wrote to the Council requesting it to review its failure to respond to him.

4. The Council notified Mr Mackay of the outcome of its review on 20 November 2014. It apologised for its delay in responding to his initial request. It disclosed information, but withheld some information under sections 30(b)(i), 30(b)(ii), 30(c), 36(1), 38(1)(a) and (b) of FOISA. For parts 3 and 5 of the request, the Council gave notice, in terms of section 17 of FOISA, that it held no recorded information.

5. On 19 May 2015, Mr Mackay applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of the Council's review because information had been withheld from him, and because he believed that the Council held more information than had been identified. He also questioned whether the Council had properly considered the public interest when withholding information.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Mackay made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 15 June 2015, the Council was notified in writing that Mr Mackay had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr Mackay. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

9. Mr Mackay accepted that the Council did not hold any information covered by parts 3 and 5 of his request, but believed that it held more information relating to part 4 of the request.

10. Unfortunately, the numbering of the documents supplied to the Commissioner by the Council does not correspond with the numbering of the documents which the Council disclosed to Mr Mackay. Indeed, often the numbering used by the Council on the documents provided to the Commissioner did not correspond to the numbering in the document schedule. In other places, the description on the schedule appears to relate to a different document. The Council has apologised for any confusion caused, but this has contributed to the delay in issuing this decision.

11. Some of the information related to this investigation has been the subject of two decisions by the Commissioner: Decision 031/2015: Mr Roy Mackay and City of Edinburgh Council[1] and Decision 087/2016: Mr Roy Mackay and City of Edinburgh Council[2]. For example, in Decision 087/2016, the Commissioner found that the report compiled by the CEC (document 79 in this case) had been wrongly withheld and required the CEC to disclose the report to Mr Mackay. It was disclosed to Mr Mackay last month.

Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Mackay and the Council. She is satisfied that no matter of relevance has been overlooked.

Identification of the information

Part 1

13. The information withheld from Mr Mackay is largely made up of correspondence between Mr Mackay and the Council, internal Council communications, and communications between the Council and the CEC. The Council supplied a considerable amount of information to Mr Mackay after reviewing its initial response to his request.

14. Part 1 of Mr Mackay's request is for information relating to a meeting invitation which he received from the Council. Much of the information which has been withheld is about Mr Mackay's previous dealings with the Council, rather than the invitation request. The Council was asked by the investigating officer to explain why it considered all the information withheld for part 1 of the request fell within the terms of that part of Mr Mackay's request. The Council responded on 4 April 2016 that it had been "seeking to be comprehensive in identifying the history, as ultimately it was the entire history that led to the Chief Executive considering it was appropriate to invite Mr Mackay to a meeting".

15. The Commissioner accepts that Mr Mackay's request was potentially wide-ranging, but takes the view that it would have been equally reasonable to interpret the request more narrowly. As noted in paragraph 13, many of the documents withheld in relation to this part of the request comprise correspondence between the Council and Mr Mackay. It would be reasonable to assume that Mr Mackay did not need to request this correspondence under FOISA. In such situations, it is good practice to contact the requester to establish which interpretation of their request meets their requirements.

16. The Commissioner notes that very little of the withheld information relates specifically to the meeting invitation or the meeting itself. The Council was asked by the investigating officer how it had ensured that all information falling within the terms of the request had been located, and whether it could confirm that it held no further internal communications about the meeting preparation or invitation.

17. The Council confirmed (4 April 2016) that it held no further information covered by this or any other parts of the request.

Part 4

18. Mr Mackay believed that the Council had failed to disclose some key documents covered by part 4 of his request: these were the Council's letter to him of 23 June 2014 and an email from the Council to CEC, which the CEC had disclosed (in redacted form) in response to a separate information request. Mr Mackay supplied a copy of the email to the Commissioner.

19. In its submission of 7 October 2015, the Council said it could not comment on why the CEC had disclosed this email, and stated that it no longer held the email.

20. The email disclosed by the CEC confirms that the CEC had been asked to investigate whether there had been any failings in the way the Council met its statutory duties under the 2001 Regulations. The Council was asked about this email again by the investigating officer. On 20 January 2016, the Council confirmed that, contrary to its previous statement, it did hold this email. It explained that the email was "no longer in any live, accessible forum" but the Council had instructed "an extraordinary search of [its] vaults" which had located it.

21. Some other documents were not initially identified by the Council as containing any withheld information. However, during the investigation, it became clear that personal data had been redacted from the information disclosed to Mr Mackay. Whether this information was correctly withheld will be considered by the Commissioner below.

Outcome

22. The Commissioner is satisfied, on balance of probabilities, that by the end of her investigation, the Council had identified and located all of the relevant information it held.

23. As noted above, some information falling within Mr Mackay's request was only located during the investigation. The Commissioner therefore finds that the Council failed to locate all the information falling within the scope of Mr Mackay's request when it responded to his request and therefore failed to comply in full with section 1(1) of FOISA.

Section 25(1) - information otherwise accessible

24. Under section 25(1) of FOISA, information which an applicant can reasonably obtain other than by requesting it under section 1(1) of FOISA is exempt information. The exemption in section 25(1) is absolute, in that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.

25. The Council did not refer to section 25(1) in the schedule of withheld information that it supplied to the Commissioner, nor did it refer to section 25(1) in its review response to Mr Mackay. The Council's submission of 7 October 2015 made reference to section 25 of FOISA in relation to the email by which the Council instructed the CEC to carry out an investigation, but at that time the Council's position was that it no longer held the email in question. As noted in paragraph 20 the Council retrieved a copy of the email during the Commissioner's investigation. It then submitted that the exemption in section 25(1) applied because Mr Mackay was known to have obtained a copy of the email from CEC.

26. Later, on 20 January 2016, the Council submitted that section 25 of FOISA also applied to information in another document (a letter from the Council to Mr Mackay: document 81).

27. Although much of the withheld information comprises correspondence between the Council and Mr Mackay and is already available to Mr Mackay, the Council has not applied the exemption in section 25 of FOISA to any information apart from the email of instruction disclosed by the CEC and the letter to Mr Mackay in document 81.

28. The Council is correct that document 81 is otherwise accessible to Mr Mackay: it pre-dates his request and Mr Mackay has indicated to the Commissioner that he has a copy. The exemption in section 25(1) of FOISA would therefore apply to this information.

29. In relation to the email of instruction, which has no number in the Council's schedule as it was located late in the Commissioner's investigation, the Council has not produced any evidence to show that the information was already available to Mr Mackay at the time he made his information request to the Council (19 October 2014). Mr Mackay included a redacted copy of this email in his application to the Commissioner. However, so far as the Commissioner can discern, Mr Mackay received the email from CEC on 19 February 2015, some time after the date of his request to the Council. Consequently, section 25(1) could not apply to this email at the time the Council reviewed its response to Mr Mackay's request. At the time of review, the Council had not identified that it held this email. The exemption has therefore been wrongly applied to the information in this email.

30. The email of instruction was also withheld under section 36(1) of FOISA. This exemption is considered below.

Section 36(1) - Confidentiality

31. Section 36(1) of FOISA exempts from disclosure information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings. This includes communications subject to legal professional privilege. The Council maintained that both aspects of legal professional privilege - legal advice privilege and litigation privilege - applied to the information withheld under this exemption.

32. The Council initially relied on this exemption to withhold information in three documents, but, during the investigation, submitted that it applied to more information. The Council has relied on this exemption to withhold the following information: documents 41, 42, 54, 65, 68, 79, 80[3] and the unnumbered email of instruction to the CEC.

Legal advice privilege

33. Legal advice privilege applies to communications in which legal advice is sought or provided.

34. For legal advice privilege to apply, certain conditions must be fulfilled.

(i) The communications must involve a professional legal adviser, such as a solicitor or an advocate. This may include an in-house legal adviser or an external solicitor engaged by the Council.

(ii) The legal adviser must be acting in his/her professional capacity, and

(iii) The communications must occur in the context of the legal adviser's professional relationship with his/her client.

35. In relation to document 79 (the CEC Report), the Commissioner notes that the investigation was carried out, and the report drafted, by a solicitor employed by the CEC. In the circumstances, the Commissioner would need to be satisfied that the CEC's solicitor was commissioned to provide the Council with legal advice in this particular case.

36. The Council stated that there was no pre-existing or ongoing legal relationship with CEC's solicitors other than the provision of a particular piece of legal work. To that extent, and in respect of that piece of work, the Council considered that the CEC solicitor acted as a legal adviser to the Council, contracted for that sole purpose.

37. In order to accept that legal advice privilege would apply to the information in document 79, the Commissioner would need documentary evidence establishing a legal professional relationship in this particular case. She has not seen any such evidence, and is not satisfied that the CEC solicitor was commissioned to provide legal advice, in their professional capacity. That may be the view taken by the Council and the CEC, after the event, but it is not borne out by the correspondence between the councils at the time.

38. The Council instructed the CEC to carry out a wide-ranging review of its handling of certain statutory processes, complaints and information requests. What the Council was asked to do was described by the Council as an "independent review": it was intended to address potential failures in meeting the Council's statutory duties, but only as part of a wider whole. At no point did the terms of reference specify the professional skills required: the officer concerned was chosen by the CEC. The Council has referred to expectations of confidentiality set out in the investigation report, but these do not, in themselves, create a professional solicitor/client relationship: they may be relevant to the application of other exemptions in FOISA.

39. As stated in Decision 087/2016: Mr Roy Mackay and City of Edinburgh Council, the nature of the work carried out by the CEC appeared analogous to that covered by the information under consideration by the Commissioner in Decision 180/2012: Cal Solutions Ltd and Scottish Water^[4]. In Decision 180/2012, the Commissioner did not accept that legal advice privilege applied: the skills of a lawyer might have been helpful in the task they were instructed to do, but the task did not require these skills.

40. Decision 180/2012 was drawn to the Council's attention. No further submissions were received on the relevance of legal advice privilege and the Commissioner is unable to accept that it could apply on the basis of the submissions she has received.

41. For document 79, the Council went on to submit that the information was subject to litigation privilege, another aspect of legal professional privilege, given that litigation privilege was found to apply to the information in Decision 180/2012. The Commissioner will consider these arguments below.

42. For documents 65 and 68, the Commissioner accepts that the exemption in section 36(1) of FOISA applies. The Council submitted that the information comprised legal advice provided by one of its own solicitors. The solicitor was acting in a professional capacity and the information was provided in the context of a professional relationship with the Council. The Commissioner accepts that the Council has provided evidence to support this statement. The Commissioner has found that section 36(1) of FOISA was correctly applied by the Council to this information.

43. For document 54 the Council provided a similar submission, stating that it was a report provided by one of its own solicitors. The document itself gives no indication that it was prepared by the Council solicitor, and another document appears to suggest that it may have been prepared by another Council officer, who is not a solicitor. The Council was asked about this issue late in the investigation and responded that neither of the officers in question were still employed by the Council, so it was not possible to verify the author of the report. The Council commented that the report would have been compiled with input from both the solicitor and the non-solicitor. In the circumstances, the Commissioner is unable to accept that there is sufficient evidence to justify the use of section 36(1) of FOISA to withhold this information.

44. In relation to document 41, the Council submitted that it was a report prepared for the Council by one of the Council's solicitors. The Commissioner does not accept this description applies to any part of the information bundled together and supplied as document 41. Most of the information is correspondence to and from Mr Mackay regarding an information request he had submitted. There is also an agenda for a Review panel meeting of 1 October 2013, and a note to the review panel about the issues to be discussed. The Commissioner has concluded that the minutes of this meeting should also be considered as part of document 41, although they were supplied to her as part of document 42. As none of this information appears to be legal advice from a Council solicitor, the Commissioner finds that the exemption in section 36(1) was wrongly applied to document 41.

45. Document 80 is an email exchange with the CEC. Mr Mackay has obtained most of this from the Council (some personal data and comments have been redacted). The emails relate to the investigation that produced the report in document 79. As noted, the Commissioner has not accepted that legal advice privilege applies to the information in document 79. She therefore does not accept that the information in document 80 is covered by legal advice privilege, and finds that the information in these emails is not covered by the exemption in section 36(1) of FOISA, even where the senders or recipients are solicitors.

46. With regard to the unnumbered email of instruction which was located late in the investigation, the Commissioner finds that the Council has not provided any reasons to show why section 36(1) would apply to this information. Accordingly, she finds that the exemption in section 36(1) of FOISA cannot be upheld. She has already found that the exemption in section 25(1) of FOISA did not apply to this information when Mr Mackay made his request and request for review. As the Commissioner is satisfied that Mr Mackay now has access to this information (after receiving it from the CEC), she does not require the Council to provide him with another copy, even though it was wrongly withheld under FOISA.

Litigation privilege

47. The Commissioner has considered whether litigation privilege applies to information in document 79 (the report from CEC). If litigation privilege applies, the exemption in section 36(1) of FOISA applies.

48. Litigation privilege covers documents created in contemplation of litigation (also known as communications post litem motam.) Communications post litem motam are granted confidentiality to ensure that any person or organisation involved in or contemplating a court action can prepare their case as fully as possible, without the risk that their opponent/s or prospective opponent/s will gain access to the material generated by their preparations. The privilege covers communications at the stage when litigation is pending or in contemplation.

49. As indicated in Decision 180/2012, whether litigation privilege applies in any particular case will be a question of fact, the key question generally being whether litigation was actually in contemplation at a particular time. In that decision, given the history of dealings between Scottish Water and a third party, the Commissioner found it reasonable to accept that the report in question was prepared in contemplation of litigation, and was of a character which brought it within the scope of litigation privilege. Similar circumstances will need to be established wherever a Scottish public authority is seeking to rely on litigation privilege to withhold information under section 36(1) of FOISA.

50. The Council stated that the investigation by the CEC was instructed in contemplation of litigation. Mr Mackay had been in correspondence with the Council for some time through its complaints procedure and had made information requests to the Council on this matter. The Council commented that these complaints and information requests were made in the context of a backdrop of repeated, complex correspondence from Mr Mackay over an extended period of time. The Council believed it was evident that Mr Mackay was aggrieved and appeared to have reached a "point of considerably entrenched anger" against the Council. In the circumstances, the Council believed that litigation was likely, and sought advice from an independent solicitor in contemplation of that event.

51. All of the background narrated above may be true, but it does not necessarily follow that litigation was in contemplation at the time the investigation and report were instructed by the Council. There is nothing in the correspondence between the Council and CEC to indicate that litigation was contemplated. The Council has not provided the Commissioner with any documentary evidence to suggest that Mr Mackay was contemplating litigation at that time, and certainly none to the effect that he was threatening it. He was aggrieved at the actions of the Council and had conveyed that in lengthy correspondence. Many people do this without seriously contemplating litigation against the public authority in question.

52. Having considered the submissions received from the Council, the Commissioner cannot accept that any of the withheld information in item 79 was subject to litigation privilege. Consequently, she does not accept that the information was correctly withheld under section 36(1) of FOISA, on the basis of the submissions she has received. Having reached this conclusion, she is not required to consider the public interest test in section 2(1)(b) of FOISA, in relation to the information in document 79.

53. The Council has applied other exemptions to the information in document 79. These are considered later in this decision.

The public interest

54. The Commissioner has found that section 36(1) of FOISA was correctly applied by the Council to documents 65 and 68 (see above). She must therefore consider whether the public interest in disclosing the information outweighs the public interest in maintaining the exemption, as required by section 2(1)(b) of FOISA.

55. The Council submitted that there would be no benefit to the public in disclosing the information falling within section 36(1) and there was a significant public interest in ensuring that the confidentiality of legal advice is privileged and exempt from freedom of information requirements. Should a public body, or its legal adviser, be concerned that advice sought and given could find its way into the public domain, then the public authority or its adviser might feel restrained in seeking or giving that advice respectively. Should that become the case then public authorities might risk taking action without the benefit of proper legal advice.

56. Mr Mackay's public interest submissions were detailed and extensive: some were specific to section 36(1), but others were more general to the other exemptions applied by the Council. The Commissioner has considered all points put forward by Mr Mackay, but will summarise only some of them here.

57. Mr Mackay believed the Council had not considered the content and context of the specific information or the likely effect of its disclosure. He believed there were highly compelling, and unexamined, issues of public interest which outweighed the public interest in maintaining the exemption. He said that the Council had failed to carry out its statutory duties under the 2001 Regulations and had not adopted a proper interpretation of certain provisions of the 2001 Regulations. He said the 2001 Regulations relate to what are often described as the most difficult, demanding and troubling public law cases to come before the courts. The importance of each local authority "getting this right" could not be over-stated. It was therefore vital, in Mr Mackay's opinion, to obtain the information he sought.

58. The Commissioner acknowledges that there will be occasions where the significant public interest in favour of withholding legally privileged communications may be outweighed by the public interest in disclosing the information. For example, disclosure may be appropriate where:

? the privileged material discloses wrongdoing by/within an authority

? the material discloses a misrepresentation to the public of advice received

? the material discloses an apparently irresponsible and wilful disregard of advice

? a large number of people are affected by the advice

? the passage of time is so great that disclosure cannot cause harm.

59. After careful consideration, the Commissioner is satisfied that none of the considerations set out above (or any others of comparable weight) apply here to the information falling with section 36(1).

60. The courts have long recognised the strong public interest in maintaining the right to confidentiality of communications between legal adviser and client, on administration of justice grounds. In a freedom of information context, the strong inherent public interest in maintaining legal professional privilege was emphasised by the High Court (of England and Wales) in the case of Department for Business, Enterprise and Regulatory Reform v Information Commissioner and O'Brien [2009] EWHC164 (QB). Generally, the Commissioner will consider the High Court's reasoning to be relevant to the application of section 36(1) of FOISA.

61. The Commissioner agrees with Mr Mackay that there is a strong public interest the disclosure of information which would demonstrate whether the Council has correctly interpreted the 2001 Regulations (or, indeed, any legislative provisions). However, on balance, the Commissioner accepts that greater weight should be attached to the arguments which would favour withholding the information. There is a strong public interest in maintaining the right to confidentiality of communications between legal adviser and client, and she believes this outweighs the public interest in disclosing the information under consideration here.

62. In all the circumstances of this case, therefore, the Commissioner concludes that the public interest in disclosing the information was outweighed by that in maintaining the exemption in section 36(1). Consequently, she finds that the Council was entitled to withhold the legal advice (documents 65 and 68) under that exemption.

Section 30(b)(i) - Prejudice to effective conduct of public affairs

63. In its review response, the Council indicated that it was withholding some information that fell within Part 4 of Mr Mackay's request under section 30(b)(i) of FOISA. During the investigation, the Council confirmed (26 April 2016) that it had only applied this exemption to information in document 79 (the report from the CEC).

64. To rely on section 30(b)(i) of FOISA, the Council must show that disclosure of the information would, or would be likely to, inhibit substantially the free and frank provision of advice. This exemption is subject to the public interest test in section 2(1)(b) of FOISA. In assessing whether the disclosure of the information would, or would be likely to, cause such inhibition, the Commissioner will take account of factors such as the subject matter, the content of the information and the circumstances existing at the time of the request.

65. As set out in her guidance[5] on the exemptions in section 30(b) of FOISA, the Commissioner takes the view that, in order for the exemption in section 30(b)(i) to apply, the damage caused by disclosing the information must be both real and significant, as opposed to hypothetical or marginal. Also, the damage would have to occur in the near future, and not at some distant time. Furthermore, the harm in question should take the form of substantial inhibition from expressing advice in as free and frank a manner as would be the case if the information was not disclosed.

66. The Council believed it was inappropriate to disclose the report to the general public (the effect of disclosing it under FOISA), and that to disclose any aspect of the investigation undertaken by the CEC would significantly impact upon the Council's future ability to investigate fully and frankly any alleged misconduct and organisational failures. Disclosure would substantially inhibit the provision of free and frank advice.

67. Mr Mackay did not accept that the exemption in section 30(b)(i) of FOISA had been properly applied. He said that the independent investigation carried out by the CEC was commissioned as a direct result of the evidence that he had provided, and was intended to be an objective, independent investigation to re-examine and answer all the issues that he had raised. He argued that the Council had failed to demonstrate what particular level of harm would follow disclosure of the information, and had offered no reason or explanation why disclosure of specific and individual elements of the information in the report might cause substantial inhibition.

68. The Commissioner has considered the nature of the information, and the context in which it was created. In the Commissioner's view, where advice is communicated or received as part of an individual's expected day-to-day professional activities, then the risk of substantial inhibition resulting from the disclosure of that information will be diminished.

69. The document is largely a consideration of factual evidence: opinion, insofar as present, appears to reflect the expertise of the person providing it. There are indications within the document suggesting its access should be restricted or consent should at least be sought before any wider distribution.

70. Another relevant consideration is the manner in which the advice is expressed. The Commissioner has considered the level of candour contained within the information and, to the extent that options are discussed, the advice and views generally appear to be expressed in a measured and considered manner. It is difficult, in the circumstances, to accept that the author (or others in a similar situation) would refrain from providing full and adequate advice or views on similar questions in future, if the information in this report was disclosed under FOISA or that such advice would not be recorded adequately.

71. Finally, the Commissioner has also considered the timing of the request. Mr Mackay's request was made on 19 October 2014 and the Council's review is dated 18 November 2014. The report is dated 17 June 2014: enough time had passed for the Council to have considered the report and its recommendations before the request was received.

72. Therefore, the Commissioner is not satisfied that disclosure of the information in document 79 would, or would be likely, to substantially inhibit the provision of such advice in future. She has reached this view after considering the circumstances in which it was created and provided to the Council, and the nature of the advice. The Commissioner therefore finds that the Council was not entitled to apply the exemption in section 30(b)(i) to the withheld information under consideration.

73. As the exemption has been found not to apply, the Commissioner is not required to consider the application of the public interest test set out in section 2(1)(b) of FOISA.

74. The Council advised the Commissioner that if she did not accept that the exemption in section 30(b)(i) applied, it wished to rely on section 30(c). This is considered later in the decision.

Section 30(b)(ii) - Prejudice to effective conduct of public affairs

75. The Council applied the exemption in section 30(b)(ii) of FOISA to information in three documents. In its submission of 7 October 2015, it described the documents as (a) comments on a draft letter to Mr Mackay and (b) two sets of Minutes. In the schedule of withheld information provided by the Council, documents 41, 42 and 50 are listed as containing information withheld under section 30(b)(ii) of FOISA.

76. There are obvious discrepancies between the information described in the submission, the information listed in the schedule of withheld information, and the actual contents of the documents provided to the Commissioner. This has made it difficult to establish what information the Council seeks to withhold under section 30(b)(ii) of FOISA, and is evidence of poor practice by the Council.

77. Document 41 is listed in the schedule of withheld information as "Advice Group Agenda/Minute". The information withheld under section 30(b)(ii) is described as "Minutes of [FOI] review group" (October 2013)". The minutes were originally provided to the Commissioner as part of document 42 (see paragraph 44 for the Commissioner's conclusions on what information falls within document 41). Document 42 is described in the schedule of withheld information as the review response sent to Mr Mackay on 28 October 2013. The Council has stated that only the annotations on this draft letter have been withheld under section 30(b)(ii) of FOISA.

78. Document 50 is listed as an internal email sent on 22 January 2014 @ 11:24. It contains a draft version of a letter to Mr Mackay. The schedule of withheld information indicates that "minutes" have been withheld from this document under section 30(b)(ii) of FOISA. The Commissioner has not found any minutes attached to document 50.

79. After careful consideration, the Commissioner has concluded that the exemption has been applied to the minutes of the Review panel meeting contained in document 41; annotations made to a draft letter to Mr Mackay (document 42); and the text of a suggested amendment to a letter to be sent to Mr Mackay in January 2014 (document 50).

80. For document 41, the Council said the Minutes were a record of internal meetings reflecting decisions made and actions to be taken. The Council stated that these were not public meetings, but meetings of Council officers, and the purpose was to record decisions and actions for officers' own use as a reminder of what was agreed. To enable the free and frank provision of advice and/or the frank and frank exchange of views, those attending meetings must be able to express advice or views freely without fear that their comments will make their way into the public domain.

81. In order for the Council to rely on the exemption in section 30(b)(ii) of FOISA, it must show that disclosure of the information would, or would be likely to, inhibit substantially the free and frank provision of views for the purposes of deliberation. Each request should be considered on a case-by-case basis, taking into account the effects on the future exchange of views anticipated from disclosure of the particular information involved.

82. In applying the exemption, the chief consideration is not whether the information constitutes opinion, but whether the disclosure of that information would, or would be likely to, inhibit substantially the exchange of views. The Commissioner expects authorities to be able to demonstrate a real risk or likelihood that actual harm will occur at some time in the near (certainly the foreseeable) future, not simply that harm is a remote possibility. Also, the harm in question should take the form of substantial inhibition from expressing views in as free and frank a manner as would be the case if disclosure could not be expected to follow. The word "substantial" is important here: the degree to which a person will be, or is likely to be, inhibited in expressing themselves has to be of some real and demonstrable significance.

83. The Commissioner has considered the content of the Minutes of the Review panel meeting of 1 October 2013 (part of document 41). There is nothing in this information which is candid or sensitive, or would otherwise lead individuals to be more cautious in providing views in future, if this information was disclosed. The information in the minutes reflects Council officials carrying out their professional duties in relation to the Council's obligations under FOISA, and that such information was likely to have been thoroughly considered before created. In this instance, the information relates to the way in which the Council was reviewing the response given to an information request under FOISA. Transparency and accountability are requirements of this process. The Commissioner has concluded that it is highly unlikely that Council officials involved in similar duties at the same level would change their practices to any significant extent, when providing or recording similar information in future. The Commissioner does not accept that the exemption in section 30(b)(ii) was correctly applied to this information.

84. In relation to the comment added to the draft letter in document 42, the Commissioner does not accept that its disclosure is likely to inhibit officials from providing similar comments in future. The annotation is not obviously controversial, but simply corrects a statement in the letter. The Commissioner cannot provide further explanation without disclosing the withheld information. She does not accept that the exemption in section 30(b)(ii) of FOISA applies, and therefore is not required to consider the public interest test in relation to this information.

85. Document 50 contains a draft letter to Mr Mackay, circulated to other officers for comment. The content appears to be uncontroversial. The Commissioner does not accept that disclosure of this information would, or would be likely, to inhibit Council officials from providing similar suggestions in future, to a substantial degree. She finds that the exemption in section 30(b)(ii) of FOISA was wrongly applied to this information.

86. Given that the Commissioner has not upheld the use of section 30(b)(ii), she is not required to go on to consider the public interest test in section 2(1)(b) in relation to this exemption.

Section 30(c) - prejudice to effective conduct of public affairs

87. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs." The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.

88. The prejudice in question must be substantial, and therefore of real and demonstrable significance. The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future not simply that such prejudice is a remote or hypothetical possibility. Each request should be considered on a case by case basis, taking into consideration the content of the information and all other relevant circumstances (which may include the timing of the request).

89. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

90. The Council applied section 30(c) of FOISA to information in documents 25 (part), 26 (part), 54, 62, 63, 64, 65 (part) and 79.

91. The information withheld under this exemption related to a potential data breach by the Council and the ensuing investigation, steps taken and conclusion. (For the avoidance of doubt, this is not the investigation that is the subject of the CEC report in document 79.) The Council submitted that:

"Clearly the Scottish Information Commissioner will recognise that the protection of personal data is a matter of public interest. There is a significant risk that should the information gathered in such investigations find its way into the public domain future investigations would be less full and frank than is desired?the Council must be allowed to fully and frankly investigate potential breaches, and contain any breaches which occur."

92. In its response to Mr Mackay's request for review, the Council considered that disclosure of the information withheld under section 30(c) of FOISA would prejudice "the effective operation of procedures intended to address and contain such incidents" (i.e. alleged breaches of the DPA). The Council stated that the prejudicial effect of disclosure would not be limited to this, but it did not elaborate further.

93. The Council did not provide submissions relating to individual pieces of information withheld under section 30(c) of FOISA. Instead, the Council made a general argument to the effect that disclosure of the information would prevent future investigations being completely full and frank. The Council has not explained why this would be a consequence of disclosure of the particular information withheld under section 30(c).

94. Documents 25, 26, 62, 63 and 64 comprise communications between the Council and Mr Mackay, so Mr Mackay is already aware of the content of the redacted information. While the information relates to the discovery of the alleged data breach, there is nothing in the information which the Commissioner regards as frank or particularly sensitive. The communications are factual, courteous and professional. The Council has not provided any submissions which refer explicitly to the information in these documents and explain why it should be withheld under section 30(c) of FOISA. On the basis of the submissions received, and after considering the withheld information, the Commissioner does not accept that disclosure would, or would be likely to, prevent the Council from carrying out a full investigation of any future data breach. It follows that she does not accept that the exemption in section 30(c) of FOISA was correctly applied to the information in these documents.

95. Document 54 is different in nature, in being internal to the Council, rather than correspondence with Mr Mackay. It is a report to the Council's FOI Advice Group, and does not relate to the alleged data breach: the arguments relating to documents 25, 26, 62, 63 and 64 therefore do not apply to the information in document 54. The Council has not given any other reason why the information in document 54 should be withheld under section 30(c) of FOISA. The Commissioner therefore finds that the exemption was wrongly applied to this information.

96. Item 65 is a report prepared by the Council's solicitor, part of which has been withheld under section 30(c) of FOISA. The report records the outcome of the investigation into the alleged data breach. The Commissioner accepts the arguments put forward by the Council in relation to the degree of harm likely to be caused by disclosure of the information. She accepts that disclosure of the information may have the effect of undermining the functioning of the Council, if it had to investigate a future alleged breach of the DP, or other legislation. She is satisfied that disclosure of the information would have a significant impact on the ability of the Council to carry out its statutory functions in relation to the DPA, and to ensure that any failure to comply is properly investigated. She therefore accepts that the Council was correct to consider the withheld information exempt under section 30(c) of FOISA.

97. The Council also applied the exemption in section 30(c) of FOISA to the report in document 79 largely for similar reasons, that is, that withholding the information was necessary to allow investigation of its compliance with legislation (in this instance, FOISA and the 2001 Regulations). Having viewed the information in item 79 that has been withheld under section 30(c) of FOISA, the Commissioner does not accept that the exemption applies.

98. Her reasoning in this respect is largely the same as stated above for section 30(b)(i). The report in document 79 is largely a consideration of factual evidence: where opinions are expressed, they appear to reflect the professional expertise of the person providing them. The report appears to be expressed in a measured and considered manner. It is difficult, in the circumstances, to accept that the author (or others in a similar situation) would be deterred from conducting a full investigation and reporting their conclusions, if the information in this report was disclosed under FOISA. The Commissioner therefore does not accept that disclosure of information from document 79 would prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs in the sense of the Council being able to investigate fully or commission a complete and rigorous investigation into any concern, complaint, allegation, or any alleged misconduct and organisational failure.

The public interest

99. The exemption in section 30(c) is subject to the public interest test in section 2(1)(b) of FOISA. Having found that the exemption applies to some of the withheld information is exempt, the Commissioner is required to consider whether the public interest in disclosing that information is outweighed by the public interest in maintaining the exemption.

100. The Council's submission of 7 October 2015 referred to the public interest arguments that it had given in relation to other exemptions. Mr Mackay's arguments on the public interest are set out at paragraph 57 above.

101. The Commissioner accepts that there is a public interest in the sound investigation of concerns or incidents relating to a public authority's compliance with legislation. There is also a general public interest in accountability and transparency, in relation to decisions and actions of a public authority.

102. The Commissioner is of the view that a reasonable balance must be struck in this case between informing the public on the issues reflected in the withheld information without disclosing information which would be likely to have a substantially prejudicial effect on the Council's investigations or reports. She has concluded that the public interest in disclosure has been met by disclosure of other relevant information released by the Council, and that further disclosure is not required, in terms of the public interest.

103. Consequently, the Commissioner has concluded that the public interest in maintaining the exemption and avoiding prejudice to the Council's ability to investigate alleged failure to comply with legislative requirements outweighs the public interest in disclosing the withheld information in this case. She is satisfied that the Council was correct to withhold information in document 65 under section 30(c) of FOISA.

Section 38(1)(a) of FOISA - Personal information

104. Where information is the personal data of the applicant, that information is exempt from disclosure under section 38(1)(a) of FOISA. This is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

105. The definition of personal data in section 1(1) of the DPA is set out in Appendix 1.

106. The Council's submission of 7 October 2015 stated that the definition of personal data in the DPA "is extremely wide" and it thought Mr Mackay's email address would be considered personal data as it contains his name and clearly identifies him. The Council explained that it had taken "a particularly cautious approach in connection with what is clearly Mr Mackay's personal data".

107. The Commissioner is satisfied that the Council correctly applied section 38(1)(a) of FOISA to the information it regarded as Mr Mackay's personal data. The information relates to Mr Mackay as an individual and he can be identified from those data.

108. The Commissioner has found that other information should also have been identified as Mr Mackay's own personal data, besides his email address and name. There is other information in the withheld documents which would permit identification of Mr Mackay and which relates to him. For example, within the withheld information are comments or opinions expressed by Mr Mackay. The Council withheld some such information, but the Commissioner has found other instances. This information is exempt under section 38(1)(a) and need not be disclosed.

Section 38(1)(b) of FOISA - personal information

109. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

110. The Council applied section 38(1)(b) of FOISA to most of the information it withheld. The Council submitted that the withheld information was personal data for the purposes of the DPA, and that its disclosure would contravene the first data protection principle. This is an absolute exemption, which means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

111. The first data protection principle requires that personal data be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In this case, "processing" means disclosing the information into the public domain in response to Mr Mackay's request.

112. When considering the conditions in Schedule 2 to the DPA, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[6] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject(s) (i.e. the named individuals to which the data relates).

Is the information personal data?

113. The definition of "personal data" is set out in Appendix 1. The Council submitted that the withheld information was personal data as it concerned names of living individuals who can be identified, and so the information falls within section 1 of the DPA.

114. The Commissioner has considered the submissions received from the Council on this point, along with the withheld information. She is satisfied that the information withheld under this exemption is personal data: the data relate to living individuals who can be identified from the data.

115. The Council focused on the personal data of its own employees, when explaining why the exemption in section 38(1)(b) was applied. However, other individuals are also identifiable from the withheld information.

116. The Commissioner accepts that, for the most part, the Council has correctly identified information which is personal data. The exception is in document 16, where some corporate email addresses have been withheld. The Commissioner does not accept that this is personal data, and finds that the corporate email addresses were wrongly withheld under section 38(1)(b) of FOISA.

Is any of the withheld information sensitive personal data?

117. In its submissions, the Council submitted that the information included sensitive personal data. The definition of sensitive personal data is contained in section 2 of the DPA (see Appendix 1).

118. The Council referred to document 9 and highlighted what it regarded as the highly sensitive nature of the information in that document. (Again, there are some difficulties with the way in which the documents have been numbered. While the Council sometimes referred to document 9 in this context, it is clear to the Commissioner that the Council meant document 10: the letter attached to Mr Mackay's email of 1 April 2013 to the Council.)

119. The Commissioner is satisfied that this letter contains sensitive personal data, as defined in section 2 of the DPA. The Commissioner will not confirm which type of sensitive personal data it is, as to do so would increase the likelihood of identification of the data subjects.

First data protection principle: sensitive personal data

120. Given the additional restrictions surrounding the disclosure of sensitive personal data, it is sensible to consider whether there are any conditions in Schedule 3 which would permit the sensitive personal data to be disclosed before considering the Schedule 2 conditions. The Commissioner has considered the conditions in Schedule 3 to the DPA as well as the additional conditions for processing sensitive personal data contained in legislation such as the Data Protection (Processing of Sensitive Personal Data) Order 2000.

121. Guidance issued by the Commissioner regarding section 38(1)(b) notes that, generally, only the first and fifth conditions in Schedule 3 of the DPA are likely to be relevant when considering a request for sensitive personal data under FOISA. Condition 1 would allow personal data to be disclosed where the data subject has given explicit consent to their disclosure. Condition 5 would allow personal data to be disclosed if the information contained in the data has been made public as a result of steps deliberately taken by the data subject.

122. The Commissioner accepts that would be inappropriate and unreasonable for the Council to ask the data subjects for consent to disclose the sensitive personal data in document 10, and that condition 1 cannot be met in this case. She accepts that the information has not been made public as a result of steps deliberately taken by the data subjects, and so condition 5 cannot be met in this case.

123. Having concluded that no there is no lawful basis for disclosing the sensitive personal data, the Commissioner finds that its disclosure would breach the first principle of the DPA. The sensitive personal data within document 10 is therefore exempt from disclosure under section 38(1)(b) of FOISA.

124. The Commissioner will now go on to consider the non-sensitive personal data.

First data protection principle: non-sensitive personal data

125. Non-sensitive personal data can only be disclosed if one of the conditions in Schedule 2 to the DPA can be met.

126. Guidance issued by the Commissioner on section 38(1)(b) states that, in a FOISA context, only conditions 1 and 6 of Schedule 2 are likely to be relevant.

127. The first condition allows information to be disclosed where the data subjects have given their consent to the processing (in this case, "processing" means disclosing the information into the public domain in response to Mr Mackay's FOISA request).

128. The Council stated that its officers did not and do not consent to their names being released.

129. In relation to consent, the Council has referred only to its employees, and not to the other data subjects whose personal data is contained within the withheld information. However, as the Commissioner is satisfied that the Council does not have the data subjects' consent to disclose the requested information, the Commissioner is satisfied that condition 1 cannot be met in this case.

130. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

131. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

(i) Does Mr Mackay have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for the legitimate purposes of Mr Mackay, would it nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects? This will involve a balancing exercise between the legitimate interests of Mr Mackay and those of the data subjects. Only if (or to the extent that) the legitimate interests of Mr Mackay outweigh those of the data subjects can the personal data be made available.

Does Mr Mackay have a legitimate interest?

132. There is no definition in the DPA of what constitutes a "legitimate interest." The Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance on section 38 states:

"In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

133. The Council said Mr Mackay had no legitimate interest in the personal data. In the Council's opinion, a legitimate interest has to be something more than a person's curiosity or personal interest. The Council submitted that it would not assist Mr Mackay to know the names of the individuals which have been withheld.

134. Mr Mackay framed his submission in terms of the public interest, rather than his own legitimate interests. He took the view that the public interest was best served by maximum transparency around the Council's compliance with legislation - in particular the 2001 Regulations, but also other legislation such as FOISA and the DPA.

135. The Commissioner has carefully considered the submissions from both parties and concludes that Mr Mackay was pursuing a legitimate interest in seeking some of the personal data. The Commissioner accepts that Mr Mackay (and the general public) has a legitimate interest in information relating to the Council's compliance with its legal obligations. She accepts that this interest may extend to knowing the identities of those involved in issues relating to the Council's compliance with such legislation, where this is necessary in order to gain a full understanding of the Council's actions and decisions. Whilst the Council is correct to say that correspondence from, and actions by, employees of the Council are on behalf of the Council, it must be acknowledged that it may be relevant to know whether an action was undertaken, or a piece of correspondence issued or viewed, by a person of seniority or specialist skill (e.g. a legal practitioner), in order to understand the processes followed by the Council.

Is disclosure of the information necessary to achieve those legitimate interests?

136. Most of the information withheld under section 38(1)(b) of FOISA comes from correspondence to or from Mr Mackay. The Commissioner does not accept that disclosure of the information which Mr Mackay already has is necessary, in terms of his legitimate interest. (Mr Mackay has confirmed he has retained copies of his correspondence with the Council.) She notes Mr Mackay's view on the importance of having all such information (including his own and others' personal data) in the public domain to allow "full scrutiny", but she does not accept that this is necessary here.

137. The Commissioner therefore finds that condition 6 of Schedule 2 to the DPA cannot be met, in relation to the personal data withheld under section 38(1)(b) of FOISA, from the following documents: 2, 4, 5-7, 9, 12-14, 17, 20-27, 29, 31-40, 42-46, 49, 51-53, 55, 56, 58, 59, 61-64, 70, 71, 73, 74. The Commissioner finds that as none of the conditions in Schedule 2 apply, disclosure of the personal data in these documents would be unlawful and would breach the first data protection principle. Accordingly, the exemption in section 38(1)(b) of FOISA was correctly applied to this information.

138. The remaining information withheld under section 38(1)(b) is in documents which were not directly sent or received by Mr Mackay. Some of these documents could be described as essentially administrative emails which simply forward Mr Mackay's email correspondence to another Council employee. These are documents 3, 11, 15, 18, 19, 28, 30, 48, 57, 60, 69, and 72. The Commissioner does not consider that the personal data redacted from these documents would add substantially to public understanding of the Council's actions, in relation to Mr Mackay's complaints and concerns. She therefore finds that disclosure is not required, in order to meet Mr Mackay's legitimate interests. Condition 6 of Schedule 2 to the DPA therefore cannot be met, in relation to this information. As none of the conditions in Schedule 2 have been found to apply, disclosure would be unlawful and would breach the first data protection principle. Accordingly, the exemption in section 38(1)(b) of FOISA was correctly applied to this information.

139. Documents 75 - 78 and 80 include the contact details and/or name of an individual who works for another public authority. She does not accept that disclosure of this personal data is required in order to meet Mr Mackay's legitimate interests. Mr Mackay knows that the report was created by a CEC solicitor. The Council has disclosed the correspondence (with some redactions) it had with that solicitor. In the circumstances, the Commissioner finds that disclosure of the name of the solicitor is not necessary here, and finds that the exemption in section 38(1)(b) was correctly applied to this information.

140. Some information has been withheld from documents 1, 8, 10, 16, 41, 47, 50, 54, 62-64, and 75-80 which do not simply forward Mr Mackay's emails within the Council. In most instances, the personal data relates to the Council officials involved in dealing with Mr Mackay's concerns and correspondence. Other individuals are also named, within the correspondence. The Commissioner accepts that the legitimate interest in understanding the process, background and timescales involved in the Council's implementation of its duties in terms of the 2001 Regulations and other legislation cannot be met in full without disclosure of this personal data. To that extent, disclosure of the withheld information is necessary.

Is disclosure unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

141. This involves a balancing exercise between the legitimate interests of Mr Mackay and those of the data subjects. Only if the legitimate interests of Mr Mackay outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

142. In the Commissioner's briefing on personal information, she notes that a number of factors should be taken into account in carrying out the balancing exercise. These include:

? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

? the potential harm or distress that may be caused by disclosure

? whether the individual objected to the disclosure

? the reasonable expectations of the individuals as to whether the information should be disclosed.

143. Some of the remaining withheld information relates to individuals who are Council officers, while some relates to individuals not employed by the Council.

144. The Council's arguments were framed largely in terms of its own officers. The Council argued that Mr Mackay's interest in obtaining the information did not outweigh the third parties' right to privacy. The Council emphasised that, in this particular case, it considered its duty of confidence to its employees to be paramount. The Council suggested that this duty of confidence is more important than Mr Mackay's right to know which Council officer sent or received emails containing his personal data.

145. The Council submitted that the right to protection of personal data contained within the DPA is of significance. That protection is afforded by law to all individuals. The regime established under the DPA makes it clear that the rights of data subjects should only be interfered with when there is a legitimate interest in that data being released; this is the appropriate starting point in considering these matters. The Council submitted that there requires to be a clear legitimate interest in the data being released. It argued that there was no clear interest in this case, so the personal data should not be released. The Council considered that an individual's rights and freedoms are not restricted by virtue of the single fact that those individuals are employees of a public body in this regard.

Individuals who are not Council employees - the Commissioner's conclusion

146. Having considered the competing interests in this case, the Commissioner finds that Mr Mackay's legitimate interests are outweighed by the prejudice to the rights, freedoms and legitimate interests of the third parties who are not Council employees. These individuals have not consented to disclosure and, in the circumstances, the Commissioner is satisfied that they would have no reasonable expectation that their personal data would be disclosed.

147. The Commissioner therefore finds that condition 6 of Schedule 2 to the DPA cannot be met, in relation to this information. As none of the conditions in Schedule 2 have been found to apply, disclosure would be unlawful and would breach the first data protection principle. Accordingly, the exemption in section 38(1)(b) of FOISA was correctly applied to this information.

148. Document 16 has been partly disclosed to Mr Mackay. It consists of an email sent to many recipients, including the Council. The Commissioner has already found that generic email addresses was wrongly withheld under section 38(1)(b) of FOISA as they did not comprise personal data.

149. The email also includes the names of individuals who work for other Scottish public authorities. The Commissioner did not accept that Mr Mackay has a legitimate interest in this personal data, and found that the exemption in section 38(1)(b) of FOISA was correctly applied to the parts of the email addresses which identify living individuals. However, she finds that the personal email addresses could be disclosed, if the first part of the email address was redacted in order to avoid identifying the individual recipient as the information would no longer comprise personal data.

150. Documents 8 and 41 include information about third parties who are not Council officials, and who would have no expectation that their names would be disclosed under FOISA, given the context associated with the correspondence. Having weighed up all of the above considerations, the Commissioner concludes, on balance, that disclosure of the information would be disproportionately intrusive, and would be likely to cause a degree of harm to the data subjects' legitimate interests. She therefore finds that condition 6 of Schedule 2 to the DPA cannot be met, in relation to the above information. As none of the conditions in Schedule 2 have been found to apply, disclosure would be unlawful and would breach the first data protection principle. Accordingly, the exemption in section 38(1)(b) of FOISA was correctly applied to this information.

Individuals who are Council employees

151. The remainder of information is made up of the names of Council officers involved in the correspondence. (For the avoidance of doubt, this includes names of Council officers in documents 1, 8, 10, 41, 47, 50, 54, 66-68, 75-78 and 80.) For the most part, the Commissioner does not accept that disclosure of these names, in the context of the correspondence in question, would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.

152. The personal data is almost entirely about the data subjects' professional activities as employees of the Council. The Commissioner has received no evidence to suggest that disclosure of the names and job titles of these individuals in the context of the withheld information would cause them significant harm or distress, and believes it is unlikely that disclosure would have this effect. She notes that some of the data subjects hold positions of seniority or responsibility within the Council, or are employed in a public-facing role, and, despite the fact that they have refused to consent to their names being disclosed to Mr Mackay, have a reasonable expectation that their identities will be made known to the public. The Commissioner therefore finds that condition 6 of Schedule 2 of the DPA can be met, in relation to this information.

153. Having concluded that disclosure of this information would not lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would not be unfair. As condition 6 can be met for this information, she would also not regard disclosure as unlawful.

154. In all the circumstances, therefore, the Commissioner finds that disclosing the personal data in question would not breach the first data protection principle. Accordingly, it is not exempt from disclosure under section 38(1)(b) of FOISA.

Documents 69 and 80

155. The Commissioner has taken a different view in relation to some personal data within documents 69 and 80, which is of a different nature and relates more closely to the data subjects as individuals as opposed to as public officials. The Commissioner accepts that disclosure of this information would be unwarranted, in terms of the rights, freedoms and legitimate interests of the data subjects, and concludes that condition 6 of Schedule 2 cannot be met in relation to this information. The information was correctly withheld under section 38(1)(b) of FOISA.

Conclusion

156. The Commissioner has found that the Council partially failed to comply with Part 1 of FOISA in responding to Mr Mackay's request. Some information was wrongly withheld. The Commissioner requires the Council to disclose information to Mr Mackay which has been wrongly withheld only to the extent that Mr Mackay was not the sender or recipient of the information. She has taken into account that Mr Mackay already has access to much of the withheld information, which consists of correspondence which he sent or received.

157. The Commissioner requires the Council to disclose the following information previously withheld from Mr Mackay:

? Document 16 - the corporate email addresses, the part of any email address which indicates the organisation that sent or received it, the name of the Council officer.

? Council officer names in documents 1, 8, 10, 47, 50, 54, 66, 67, 75-78.

? Document 41 (but not Mr Mackay's personal data or the personal data of any third parties)

? Document 42

? Document 50

? Document 54

? Document 79 - with redaction of personal data of Mr Mackay

? Document 80 - names of Council officers, with exception indicated in paragraph 155

Decision The Commissioner finds that Scottish Borders Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Mackay. The Commissioner finds that the Council breached Part 1 of FOISA by: ? failing to locate all the information falling within the terms of the request. As the Council located the information during the investigation, and as Mr Mackay has a copy of that information, the Commissioner requires no action of the Council in this respect. ? withholding information (as specified in the decision) under the exemptions in section 30(b)(i), 30(b)(ii), 30(c), 36(1) and 38(1)(b) of FOISA, but wrongly applied these exemptions to other information. The Commissioner requires the Council to provide Mr Mackay with the information specified in paragraph 157, by 2 September 2016.

Appeal

Should either Mr Mackay or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

19 July 2016

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

(a) section 25;

?

(e) in subsection (1) of section 38 -

(i) paragraphs (a), (c) and (d); and

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

25 Information otherwise accessible

(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.

?

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

?

(b) would, or would be likely to, inhibit substantially-

(i) the free and frank provision of advice; or

(ii) the free and frank exchange of views for the purposes of deliberation; or

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

36 Confidentiality

(1) Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information.

?

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

2 Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

(a) the racial or ethnic origin of the data subject,

(b) his political opinions,

(c) his religious beliefs or other beliefs of a similar nature,

(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),

(e) his physical or mental health or condition,

(f) his sexual life,

(g) the commission or alleged commission by him of any offence, or

(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Schedule 3 - Conditions relevant for the purposes of the first principle: processing of sensitive personal data

1. The data subject has given his explicit consent to the processing of the personal data.

?

5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

?

---