Decision 162/2011 Mr B and Aberdeenshire Council
Names of staff with certificate of competency in SA07
Reference No: 201100779
ecision Date: 15 August 2011
Summary
Mr B asked Aberdeenshire Council (the Council) for information relating to assessments using SA07, a tool developed for assessing levels of risk in relation to sex offenders.The Council provided some information but withheld the name(s) of its social worker(s) who had carried out assessments.
After investigation, the Commissioner found that the Council had generally complied with Part 1 of FOISA in dealing with Mr B's request.He found that the information had been correctly withheld under section 38(1)(b) of FOISA, being personal data the disclosure of which would breach the first data protection principle.However, the Council had failed to comply with the technical requirements in FOISA, in failing to deal with his request for review within the requisite timescaleThe Commissioner did not require the Council to take any action in this case.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 21(1) (Review by Scottish Public Authority) and 38(1)(b), (2)(a)(i) and (b), and (5)(definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 4 December 2010, Mr B asked the Council to provide certain information relating to assessments made using SA07 (a tool used to assess the risk of a sex offender re-offending).Parts of Mr B's request was for the number of Council employees who had received training in relation to SA07, had reached the required competency and were in receipt of a confirmation certificate.He also asked for the names of these employees.
2.On 21 January 2011, the Council responded to Mr B's request.The Council advised that SA07 risk assessments were only undertaken by Social Workers who had successfully completed the relevant training. The Council advised Mr B that information about the names of individuals who carried out SA07 risk assessments could not be disclosed, but did not provide reasons for this decision.
3.On 29 January 2011, Mr B sent the Council a letter described as an appeal, in which he raised several points relating to the Council's response to his request.He explained that he wished to know if the person who had carried out a particular assessment using SA07 had reached the required competency and was in receipt of a confirmation certificate.
4.On 7 February 2011, the Council wrote to Mr B in relation to his letter of 29 January.While addressing the points he had raised, the Council indicated that was doing so with a view to resolving these matters without resorting to a formal review.In its detailed letter, the Council reiterated that all of its staff carrying out the relative assessments were fully trained and qualified.The Council also advised that information about the names of staff undertaking such assessments was considered to be personal information, exempt from disclosure under section 38 of FOISA.The Council provided its reasons for this decision.
5.On 12 March 2011, Mr B wrote to the Council again, complaining that it had failed to respond to his request for review and making a further request that the Council should provide him with a formal review of its response to his request.On 21 March 2011, the Council wrote to Mr B to explain that its letter of 7 February had been intended to provide clarification of the issues of contention still remaining, suggesting that it was unnecessary to pursue the review request.However, on 24 March 2011, the Council wrote to Mr B to advise that its Review Panel would review the response to his request during the first week in April 2011.
6.On 13 April 2011, the Council sent Mr B the outcome of its review.It provided the number of employees who had been trained on the SA07 assessment tool, and confirmed once more that all had reached the required competency and had received a confirmation certificate.The Council also confirmed that under section 38(1)(b) of FOISA it had withheld the names of employees in receipt of a confirmation certificate, and provided further reasoning in support of this decision.
7.On 25 April 2011, Mr B wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.Mr B was dissatisfied with the decision to withhold the names of employees who had received a certificate of competency in relation to their training on SA07.He also complained that the Council had failed to treat his letter of 29 January 2011 as a request for review.
8.The application was validated by establishing that Mr B had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
9.On 13 May 2011, the Council was notified in writing that an application had been received from Mr B (as required by section 49(3)(a) of FOISA).The case was then allocated to an investigating officer.
10.The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was invited to provide further explanation of its decision to withhold information under section 38(1)(b) of FOISA, and to comment on the way it had responded to Mr B's letter of 29 January 2011.
11.On 21 June 2011, the Council provided the Commissioner with further information and comments in relation to Mr B's application, and advised that it also wished to rely upon the arguments set out in its correspondence with Mr B.The Council's submission (where relevant) is summarised and considered in the Commissioner's analysis and findings section below.
Commissioner's analysis and findings
12.In coming to a decision on this matter,the Commissioner has considered all of the withheld information and the submissions made to him by both Mr B and the Council and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? personal information
13.The Council has withheld the names of employees trained to use the SA07 assessment tool and who have received a confirmation certificate showing that they have reached the required level of competency.The Council has found this information to be exempt from disclosure under section 38(1)(b) of FOISA.
14.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and if its disclosure to a member of the public otherwise than under FOISA would breach any of the data protection principles set out in Schedule 1 to the DPA.
15.The exemption in section 38(1)(b) is an absolute exemption, not subject to the public interest test laid down by section 2(1)(b) of FOISA.
Is the information personal data?
16.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
17.The Commissioner accepts that the withheld information is personal data as defined in section 1(1) of the DPA, as it relates to living individuals who can be identified from that information.The Commissioner will go on to consider whether this information is exempt from disclosure under section 38(1)(b) of FOISA.
Would disclosure breach the first data protection principle?
18.The Council argued that disclosure of the information requested by Mr B would breach the first data protection principle, which requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
19.The Commissioner does not consider any of the personal data withheld in this case to be sensitive personal data.He will therefore consider whether any of the conditions in Schedule 2 to the DPA would permit disclosure of the information.
Can any of the conditions in Schedule 2 to the DPA be met?
20.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.
21.The Commissioner considers that condition 6 of Schedule 2 of the DPA would appear to be the only condition which might permit disclosure of the personal data requested by Mr B (it was, in any event, the only condition considered by the Council as potentially relevant). Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
22.There are a number of different tests which must therefore be satisfied before condition 6 can be met.These are:
Does Mr B have a legitimate interest in obtaining the personal data?
If he does, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?(In this case, the data subjects are the Council employees covered by the terms of Mr B's request.)
Even if the processing is necessary for Mr B's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
23.There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.Accordingly, the legitimate interests of Mr B must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr B.
Does Mr B have a legitimate interest?
24.Mr B explained that he wished to know whether the social worker(s) who had carried out a particular SA07 assessment was / were professionally accredited, and in receipt of a confirmation certificate; he did not believe this to be the case.
25.The Commissioner notes that Mr B's request of 4 December 2010 did not specify that he required the name(s) of the employees who carried out a specific assessment; what he asked for were the names of employees who were in receipt of a" confirmation certificate" relating to their competency in using SA07. Mr B has already been informed (13 April 2011) that all the Council employees who carry out SA07 assessments have completed the relevant training and have received a certificate confirming their competency to carry out such assessments. He is therefore already aware that the employee(s) who carried out the assessment in question had been awarded a certificate confirming their competency in relation to SA07.
26.For the avoidance of doubt, the Commissioner asked the Council to provide documentary evidence that the social worker(s) who carried out the assessment in question had received a confirmation certificate.This evidence was provided to the Commissioner.
27.The Commissioner finds that Mr B has failed to demonstrate any legitimate interest which would require disclosure of the name(s) of the social worker(s) who carried out the assessment to which he referred, or (as he actually requested) the names of all Council employees in receipt of a confirmation certificate.Possession of the relevant certificates can be (and has been) confirmed without the disclosure of names.
28.Because the Commissioner does not accept that Mr B has a legitimate interest in the names of the Council employees who have received a confirmation certificate, he finds that condition 6 of Schedule 2 of the DPA cannot be met in this case.In the absence of a condition permitting disclosure, disclosure would be unlawful.Disclosure of the information would therefore contravene the first data protection principle, which means that the information is exempt from disclosure under section 38(1)(b) of FOISA.
29.The Commissioner therefore finds that the Council was correct to withhold the information in question under section 38(1)(b) of FOISA.
Section 21 ? Review by Scottish public authority
30.Under section 21(1) of FOISA, a Scottish public authority has 20 working days from the day after receipt of a requirement for review to provide a response to this (subject to certain exceptions which are not applicable in this case).
31.As noted in paragraph 3 above, Mr B wrote to the Council on 29 January 2011, stating that he was making an appeal, in writing, before contacting the Commissioner.He then listed his reasons for dissatisfaction with the Council's response to his request.The Council responded within 20 working days (7 February 2011) and addressed some of the issues raised by Mr B, but subsequently made it clear that this letter was not intended as the outcome of a formal review of the way in which it had dealt with Mr B's request.
32.The Council explained that it hoped to deal less formally with the points raised by Mr B in his letter of 29 January 2011, and by doing so, to reach a point where he was satisfied with the information provided and no longer required a formal review.The Commissioner notes that the Council's letter of 7 February 2011 invited Mr B to seek a review if he remained dissatisfied, which suggests that, as stated, the Council did not intend this letter to be taken as its response to a request for review.
33.Mr B was initially advised by the Commissioner's office (21 February 2011) that he should make a request for review as advised in the Council's letter of 7 February 2011.However, the Commissioner now accepts that Mr B's letter of 29 January fulfilled all the requirements of a request for review under section 20 of FOISA, a point in any event acknowledged by the Council.
34.Although it is clear that the Council acted with the best of intentions in trying to resolve Mr B's complaints informally, without requiring the intervention of its review panel, the Commissioner finds that this led to a failure to comply with section 21(1) of FOISA in that the Council did not comply with Mr B's request for review within 20 working days.The Commissioner considers that the Council should have made it clearer to Mr B that it hoped to resolve his complaint informally, while acknowledging that his legal right to a review was not affected by this approach, should it be unsuccessful.
35.Given that a full review was eventually carried out, the Commissioner does not require the Council to take any further action in relation to this failure in response to Mr B's application.
DECISION
The Commissioner finds that Aberdeenshire Council (the Council) generally complied with Part 1 of FOISA in responding to the information request from Mr B.The Council was correct to withhold information under section 38(1)(b) of FOISA.However, the Council failed to comply with the requirements of section 21(1) of FOISA and, in doing so, failed to comply completely with Part 1 of FOISA.
The Commissioner does not require the Council to take any steps in relation to this failure in response to Mr B's application.
Appeal
Should either Mr B or Aberdeenshire Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
15 August 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2Effect of exemptions
(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a)the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
...
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a)at least one of the conditions in Schedule 2 is met, and
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
