Decision 161/2016: Mr Tom Gordon and the University of Glasgow Professorial appointment of Michael Russell MSP Reference No: 201600172 Decision Date: 14 July 2016 Summary On 25 November 2015, Mr Gordon asked the University of Glasgow (the University) for all information relating to the appointment of Michael Russell MSP as Professor of Scottish Culture and Governance. The University disclosed some information to Mr Gordon, but withheld other information. Following a review, Mr Gordon remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that the University had failed to respond to Mr Gordon's request for information in accordance with Part 1 of FOISA. It failed to identify and disclose all relevant information to Mr Gordon in response to his request and it wrongly withheld some information under section 33(1)(b) (Commercial interests and the economy) and section 38(1)(b) (Personal information) of FOISA. The Commissioner requires the University to provide Mr Gordon with the information it wrongly withheld.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2)(a)(i) and (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first, second, sixth and eighth data protection principles) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 25 November 2015, Mr Gordon made a request for information to the University. The information requested was:

"[A]ll items of information held in relation to the appointment of Michael Russell MSP as Professor of Scottish Culture and Governance in the University of Glasgow. This should include, but not be limited to, all information on the creation of the post, interview procedures and scores, reports, assessments, minutes, contractual information and all associated correspondence."

2. The University responded on 17 December 2015. It provided Mr Gordon with some information but withheld other information under section 38(1)(b) of FOISA.

3. On 23 December 2015, Mr Gordon wrote to the University requesting a review of its decision. He commented that the University appeared to have made no attempt to provide him with all of the information he had requested. Mr Gordon also queried whether it had applied the exemption in section 38(1)(b) of FOISA correctly.

4. The University notified Mr Gordon of the outcome of its review on 25 January 2016. It provided him with a summary of the appointment process, explaining that Mr Russell first met with the University Principal, Professor Anton Muscatelli, then with Professor Murray Pittock, Professor Roibeard O Maolalaigh, and Professor Anne Anderson to assess and confirm the extent to which he would fulfil the requirements for the position.

5. On 26 January 2016, Mr Gordon applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He was dissatisfied with the outcome of the University's review because it had only disclosed "a truncated summary of events", rather than all the information requested. Mr Gordon also queried the University's application of section 38(1)(b) of FOISA.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Gordon made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 22 February 2016, the University was notified in writing that Mr Gordon had made a valid application. The University was asked to send the Commissioner the information withheld from Mr Gordon. At this point, the University identified more information covered by Mr Gordon's request, and sent him redacted copies, withholding some information under section 33(1)(b) (Commercial interests and the economy) and section 38(1)(b) (Personal information) of FOISA. The University provided the Commissioner with the withheld information and the case was allocated to an investigating officer.

8. During the investigation, the University disclosed information to Mr Gordon which had been identified after a further review of its records. It apologised that this information had not been disclosed sooner.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The University was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Gordon and the University. She is satisfied that no matter of relevance has been overlooked.

11. During the investigation the University disclosed information to Mr Gordon but withheld some information under section 33(1)(b) and section 38(1)(b) of FOISA. Mr Gordon was not satisfied with this partial disclosure and asked the Commissioner to reach a view as to whether the University had now identified all relevant information and whether it had correctly applied the exemptions it had relied on to withhold information from him.

Withheld information

12. The University is withholding information in documents 8 and 9 under section 33(1)(b) of FOISA.

13. The University is withholding information in documents 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14 and document 15 under section 38(1)(b) of FOISA.

14. The University is withholding some information in document 15 on the basis that it is outwith the scope of Mr Gordon's request.

Did the University identify all relevant information?

15. Mr Gordon queried whether the University had provided him with all of the information that fell within the scope of his request. Mr Gordon noted that some of the emails he received appeared to stop halfway through. Additionally, there were references to "MR" in early correspondence, but nothing to show why both parties already knew that "MR" referred to Michael Russell MSP.

16. When asked how it had identified all information covered by Mr Gordon's request, the University submitted that it searched the email accounts of members of its Senior Management Group involved in the appointment process as well as the email accounts of relevant members of the University's Human Resource Service. In order to ensure the searches were complete, the Deputy Secretary of the Court met with the Head of Principal's Office and the Executive Assistant to the Principal. The Deputy Secretary also spoke directly to the Director of Human Resources, the Human Resources Recruitment manager and Professor Pittock, and to the personal assistants of other Professors involved in the process.

17. The University submitted that it does not hold any further information relating to the professorial appointment of Mr Russell. It was asked to explain why Mr Russell was referred to as "MR" in correspondence, if there had been no earlier correspondence establishing that he was the "MR" in question. The University explained that Mr Russell is well known to the Principal and Professor Pittock in his previous capacity as Cabinet Secretary for Education and Lifelong Learning, and that there were early verbal discussions about approaching him to determine if he was interested in the Post of Professor in Scottish Culture and Governance. This meant that the Principal understood that the reference to "MR" was a reference to Michael Russell MSP.

18. On the basis of this explanation, the Commissioner accepts that the use of the initials "MR" does not indicate that earlier correspondence was exchanged, on the subject of Mr Russell's possible appointment. The Commissioner is satisfied that usage of "MR" to refer to Mr Russell was established during verbal discussions preceding the recorded correspondence.

19. After taking account of the University's submissions about the searches and enquiries it carried out in relation to Mr Gordon's request, the Commissioner is satisfied that the University has identified all recorded information falling within the scope of the request.

Section 33(1)(b) - commercial interests

20. Section 33(1)(b) provides that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). Section 33(1)(b) of FOISA is subject to the public interest test in section 2(1)(b).

21. There are a number of elements an authority must demonstrate are present when relying on this exemption In particular, it must show:

(i) Whose commercial interests would, or would be likely to, be harmed by disclosure;

(ii) The nature of those commercial interests; and

(iii) How disclosure would, or would be likely to, prejudice substantially those interests. The prejudice must be substantial: in other words, of real and demonstrable significance.

22. The University argued that disclosing the information redacted from documents 8 and 9 would be substantially prejudicial to the commercial interests of a named third party. The University explained that the information relates to a job offer made to Mr Russell by another body. The University noted that Mr Russell declined to take up that job offer and, instead, accepted its offer of an appointment. The University argued that disclosure of that fact could imply that that the body whose offer was rejected by Mr Russell was unable to attract the highest calibre of staff. This revelation would undoubtedly be damaging to the body's reputation and would have a detrimental impact on, and cause substantial prejudice to, their commercial interests, position and standing. It would undermine their competitiveness.

23. There are many factors that might influence a person's decision to accept a job offer, such as personal interests and contacts, the nature of the job on offer, geographical location, hours of work, salary and conditions. The Commissioner has been provided with no evidence to explain why Mr Russell accepted the offer from the University.

24. The Commissioner does not accept that disclosing that an individual rejected a job offer from one body in preference to an offer from another body would cause any significant detriment to the body that was rejected, in terms of the institution's commercial interests. The arguments put forward by the University on this point seem hypothetical and not founded on any evidence, or based on consultation with the other institution.

25. The Commissioner is not satisfied that disclosure of the information redacted under section 33(1)(b) of FOISA would, or would be likely to, prejudice substantially the commercial interests of the body whose offer to Mr Russell was rejected.

26. The Commissioner notes that the information redacted from document 8 also names a third body that was wrongly thought to have made a job offer to Mr Russell. The University has provided no explanation or reasoning as to why it withheld the name of this body under section 33(1)(b) of FOISA. The Commissioner does not accept that the exemption in section 33(1)(b) was correctly applied to this information.

27. As the Commissioner has concluded that the exemption contained in section 33(1)(b) of FOISA was wrongly applied to the information in documents 8 and 9, she is not required to consider the public interest test in section 2(1)(b) of FOISA. However, as this information was also withheld under section 38(1)(b), the Commissioner will go on to consider whether this exemption was correctly applied.

Section 38(1)(b) of FOISA - third party personal data

28. The University applied the exemption in section 38(1)(b) of FOISA to information in documents 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14 and 15.

29. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, section 38(2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

30. In order to rely on this exemption, the University must show, firstly, that any such information would be personal data for the purposes of the DPA and, secondly, that disclosure of that data would contravene one or more of the data protection principles to be found in Schedule 1.

31. This exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information under consideration personal data?

32. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual".

33. The withheld information includes personal email addresses, written signatures and information about employment conditions. The Commissioner has considered all the information withheld under section 38(1)(b) of FOISA, and is satisfied that living individuals could be identified from disclosure of this information, which relates to those individuals in a biographical sense and is their personal data.

34. Having accepted that the withheld information is personal data, the Commissioner will now go on to consider whether it is exempt from disclosure under section 38(1)(b).

35. The University submitted that disclosure would breach the first, second, sixth and eighth data protection principles. The Commissioner will begin by considering the first data protection principle.

Would disclosure contravene the first data protection principle?

36. As noted above, the University submitted that disclosing this information would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. The processing in this case would be making the information publicly available in response to Mr Gordon's request.

37. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. A condition in Schedule 3 is also required if the information is sensitive personal data, but the Commissioner is satisfied that none of the information under consideration falls into this category.

Can any of the conditions in Schedule 2 be met?

38. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1], that the conditions require careful treatment in the context of a request for information under FOISA. They were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).

39. It appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Mr Gordon. In any event, neither Mr Gordon nor the University have suggested that any other condition would be relevant.

40. Condition 6 allows personal data to be processed where that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

41. There are a number of different tests which must be met before condition 6 can be met. These are:

(i) Does Mr Gordon have a legitimate interest or interests in obtaining the personal data?

(ii) If yes, is the disclosure necessary to achieve those legitimate interests? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate interest be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if disclosure is necessary for Mr Gordon's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

42. As noted by Lord Hope in the above judgment, there is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Mr Gordon must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit disclosure. If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the information to Mr Gordon.

Is Mr Gordon pursuing a legitimate interest or interests?

43. There is no definition in the DPA of what constitutes a "legitimate interest." The Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance on section 38 of FOISA[2] states:

In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

44. The University submitted that Mr Gordon did not have a legitimate interest in obtaining the withheld personal data.

45. In the Commissioner's view, Mr Gordon (and the wider public) has a legitimate interest in obtaining the withheld personal data under consideration. As a political journalist, Mr Gordon has an understandable interest in knowing how Michael Russell MSP was appointed to his post at the University. The Commissioner considers that there is also a wider public interest in information about the appointment of MSPs to salaried posts in the public sector.

Is disclosure of the information necessary to achieve these legitimate interests?

46. Having concluded that Mr Gordon has a legitimate interest in obtaining the personal data under consideration, the Commissioner must now consider whether disclosure of the personal data is necessary to achieve those legitimate aims, or whether these legitimate aims can be achieved by means which interfere less with the privacy of the data subjects.

47. Having reviewed the withheld information, the Commissioner cannot identify any other viable means of meeting Mr Gordon's interests which would interfere less with the privacy of the data subjects than providing the withheld personal data. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mr Gordon's legitimate interests.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

48. The Commissioner is satisfied that disclosure of the withheld personal data is necessary to fulfil Mr Gordon's legitimate interests, but must now consider whether that disclosure would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. This involves a balancing exercise between the legitimate interests of Mr Gordon and the data subjects in question. Only if the legitimate interests of Mr Gordon outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

49. In the Commissioner's briefing on the personal information exemption, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

(i) whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

(ii) the potential harm or distress that may be caused by disclosure

(iii) whether the individual objected to the disclosure

(iv) the reasonable expectations of the individual as to whether the information should be disclosed.

50. The University stated that the data subjects were entitled to their privacy and not to have their personal information disclosed to Mr Gordon.

51. The Commissioner has considered all of the submissions made to her when balancing the legitimate interest in this case. She accepts that the data subjects were unlikely to expect their personal data to be disclosed into the public domain.

52. Having considered the competing interests in this particular case, the Commissioner finds that, with regard to all of the information redacted from documents 2, 3, 4, 6, 7, 8, 10, 11, 12, 13, 14 and some of the information redacted from documents 9 and 15, Mr Gordon's legitimate interests are outweighed by the prejudice to the rights and freedoms of the data subjects that would result from disclosure. While disclosure would increase transparency around the professorial appointment of Mr Russell, the University has already disclosed sufficient information for Mr Gordon to understand the circumstances surrounding this appointment. Obtaining specific salary information, personal contact details and signatures of University staff would not reveal anything further about the decision-making processes of the University and it would constitute an unfair intrusion into the privacy of the data subjects. On balance, the Commissioner finds that the requirements of condition 6 cannot be met here.

53. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 of the DPA which would permit disclosure of all of the information withheld in documents 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14 and some of the information withheld in documents 9 and 15. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) by the University under section 38(1)(b) of FOISA.

Document 9

54. Some of the information that has been withheld from document 9, is similar to information which has already been disclosed by the University. The Commissioner acknowledges that it is not a duplicate of that information, but the information in question relates to matters which have already been disclosed. In these circumstances, she considers that the data subjects must have some expectation that the information in document 9 would also be disclosed.

55. Having drawn these conclusions, the Commissioner finds that condition 6 in Schedule 2 (to the DPA) can be met in this case in relation to disclosure of some of the withheld personal data in document 9.

56. As the Commissioner has not accepted that disclosure of the personal data would lead to unwarranted prejudice to the rights, freedoms or legitimate interests of the data subjects, the Commissioner also concludes, for the same reasons, that disclosure of the withheld information would be fair.

57. The Commissioner therefore finds that disclosure of some of the personal data redacted from document 9 would not breach the first data protection principle.

Would disclosure breach the second data protection principle?

58. The second data protection principle states that "Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes."

59. In Part II of the DPA "Interpretation of the principles in Part I" it states that in determining whether any disclosure of personal data is compatible with the purpose or purposes for which the data were obtained, regard is to be had to the purpose or purposes for which the personal data are intended to be processed by any person to whom they are disclosed.

60. The University has argued that disclosure of the data and subsequent processing is unlikely to be compatible with the purpose(s) for which they were obtained. However, the University has not detailed the purposes for which the personal data was obtained nor why such processing is likely to be incompatible with them.

61. Whilst disclosure under a request under FOISA is not listed as one of the purposes for which data is collected and processed, the Commissioner's view is that the processing of data, in respect of a request for information under FOISA, is for a lawful purpose. Release therefore would not be incompatible with the purposes for which the data were obtained, given the purpose for which the information has been requested. As such the Commissioner is of the opinion that the second principle would not be breached by the disclosure of the information.

Would disclosure breach the sixth data protection principle?

62. The sixth data protection principle states that "Personal data shall be processed in accordance with the rights of data subjects under this Act."

63. Paragraph 8 of Part II of Schedule 1 to the DPA sets out the contraventions of the DPA which are to be regarded as contravening the sixth principle, i.e. contraventions of section 7 (Right of access to personal data), 10 (Right to prevent processing likely to cause damage or distress), 11 (Right to prevent processing for purposes of direct marketing), 12 (Rights in relation to automatic decision-taking) and 12A (Rights of data subjects in relation to exempt manual data) of the DPA.

64. In relation to the sixth principle, the University argued that disclosure of personal data would not be in accordance with that individual's right to privacy. The University argued that if the data were disclosed, it would constitute processing for an unspecified purpose.

65. The University has not advised the Commissioner of any formal notice being served on it by the data subject(s) in terms of either section 10 or 12A of the DPA (and of no action taken by University in response to such a notice) and the Commissioner does not consider, particularly in the light of a lack of evidence from the University, that disclosure would contravene sections 7, 11 or 12 of the DPA.

66. As such, the Commissioner is unable to find that the disclosure of the data would breach the sixth data protection principle.

Would disclosure breach the eighth data protection principle?

67. The eighth data protection principle states that "Personal data shall not be transferred to a country or territory outside the European Economic Area [EEA] unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects."

68. The University has argued that disclosure of the personal data may result in a real risk of the individual's personal data being displayed on the internet and thus viewable outside the EEA.

69. As noted earlier, the information that is being considered in document 9 is information which is similar in content to information that the University has already disclosed to Mr Gordon under FOISA. Given that the information that has been disclosed to Mr Gordon is already in the public domain, the Commissioner finds it difficult to accept that disclosure of similar information in document 9 could breach the eighth data protection principle.

70. In conclusion, the Commissioner finds that disclosure of some of the personal data in document 9 which is under consideration would not breach any of the data protection principles. Accordingly, she finds that the exemption in section 38(1)(b) of FOISA was wrongly applied to this information, and requires the University to disclose it to Mr Gordon.

Document 15

71. The University has withheld some information in document 15 on the basis that it is not covered by the terms of Mr Gordon's request.

72. The Commissioner has reviewed this information and does not accept that all of it is outwith the scope of Mr Gordon's request. She is satisfied that some of the information is not relevant to Mr Gordon's request, but there is some information which does fall within its scope. With the exception of a mobile phone number which is exempt from disclosure under section 38(1)(b) of FOISA, the Commissioner finds that the information redacted from document 15 falls within the scope of the request and that the University should have considered disclosing it to Mr Gordon.

73. The University has not applied any exemptions to this information or provided any reason why it should not be disclosed. The Commissioner requires the University to disclose the information to Mr Gordon.

74. The Commissioner will provide the University with marked up versions of documents 9 and 15, and will indicate the information that is to be disclosed to Mr Gordon.

Commissioner's observations

75. The Commissioner acknowledges that once Mr Gordon appealed to her office, the University disclosed most of the information that fell within the scope of his request. The redactions made by the University were minimal and were largely focused on protecting the personal data of third parties. However, because it failed to identify and disclose information when responding to Mr Gordon's request or request for review, the University failed to comply with section 1(1) of FOISA.

76. Furthermore, the Commissioner notes that when the University did disclose information to Mr Gordon it took no steps to ensure that the information he received was meaningfully arranged or was in sequence. As a result, Mr Gordon queried whether the disclosures were complete as some pages seemed to stop mid-sentence.

77. Mr Gordon was not sure whether he had received entire email strings, or just part of them. The Commissioner notes that the documents given to Mr Gordon did not keep email strings together: the documents appeared to be organised randomly, with 4-page email strings split into two or three parts and separated by other email strings which, in turn, were not in sequence and were not chronologically arranged. The University appears not to have taken any care to ensure that Mr Gordon could follow the conversations contained within the information it disclosed. The difficulties caused by the disorganisation of the information he received increased Mr Gordon's dissatisfaction with the University's handling of his request.

78. The Commissioner would suggest that when disclosing email strings or other forms of sequential documentation, authorities take care to ensure that the information is presented meaningfully in order that the requester can follow the flow of information. If a requester cannot understand how the information flows, and considers that some email conversations have only been partly disclosed, they are more likely to seek a review or query whether all relevant information has been provided. During her investigation, the Commissioner required the University to provide Mr Gordon with a second set of documents, in which the emails were presented in sequence.

Decision The Commissioner finds that the University of Glasgow (the University) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Gordon. The Commissioner finds that: (i) the University failed to disclose information covered by the request which was not withheld under any exemption and which was later provided to Mr Gordon. In this respect, it failed to comply with section 1(1) of FOISA (ii) the University correctly withheld all of the information in documents 2, 3, 4, 6, 7, 8, 10, 11, 12, 13, 14 and some of the information in documents 9 and 15 under section 38(1)(b) of FOISA. However, the University wrongly withheld some information in document 9 under section 38(1)(b) of FOISA (iii) the University wrongly withheld information from documents 8 and 9 under section 33(1)(b) of FOISA (iv) the University failed to disclose information in document 15 which had not been withheld under any specific exemption. The Commissioner requires the University to provide Mr Gordon with the information wrongly withheld from documents 9 and 15 by 29 August 2016.

Appeal

Should either Mr Gordon or the University of Glasgow wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the University of Glasgow fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the University has failed to comply. The Court has the right to inquire into the matter and may deal with the University as if it had committed a contempt of court.

Rosemary Agnew
Scottish Information Commissioner

14 July 2016

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

33 Commercial interests and the economy

(1) Information is exempt information if-

?

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

?

6. Personal data shall be processed in accordance with the rights of data subjects under this Act.

?

8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level or protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---