Decision 163/2007 Mr F and the Scottish Prison Service

Open learning provision at a prison

Applicant: Mr F
Authority: Scottish Prison Service
Case No: 200700111
Decision Date: 13 September 2007

Kevin Dunion
Scottish Information Commissioner

Request for information concerning open learning provision at a prison ? whether information exempt under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 ? whether some of the information requested was not held ? whether the applicant's request for review had been dealt with in terms of section 21 ? exemptions upheld by the Commissioner

Relevant Statutory Provisions and other Sources

Freedom of Information (Scotland) Act 2002 (FOISA): section 17 (Notice that information is not held); section 21 (Review by Scottish public authority); section 38(1)(b) (Personal information).

Data Protection Act 1998 (the DPA): section 1 (Basic interpretative provisions); section 2 (Sensitive personal data); Schedule 1, Part 1, paragraph 1 (The first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of personal data).

The full text of these provisions is reproduced in the Appendix to this decision.The Appendix forms part of this decision.

Facts

Mr F wrote to the Scottish Prison Service (SPS) seeking information relating to open learning provision at Peterhead prison. The SPS provided Mr F with some of the information he had requested but withheld some information under section 38(1)(b) of FOISA on the grounds that to disclose it would breach the first data protection principle concerning fair processing.

Mr F requested a review of the SPS's response in relation to a number of the questions he had asked. The SPS carried out a review and withheld information under section 38(1)(b) of FOISA in relation to two of the questions.

Mr F was dissatisfied with this response and applied to the Scottish Information Commissioner for a decision.Following an investigation, the Commissioner found that the SPS had dealt with Mr F's request for information in line with Part 1 of FOISA.

Background

1.Mr F submitted a request for information to the SPS on 8 June 2006. His request consisted of 6 questions about different aspects of Learning, Skills and Employability (LSE) at Peterhead prison.

2.The SPS wrote to Mr F on 23 June 2006, informing him that his request was being processed. On 26 June 2006, the SPS responded to Mr F's request by providing information in relation to all but one of his questions (question 6), which was a request for a full list of approved study programmes within the LSE Centre at Peterhead prison in relation to which internet access had been provided over a specified period. The information was withheld by the SPS under section 38(1)(b) of FOISA on the basis that disclosure would enable the identification of individual students studying within the LSE Centre.

3.On 29 June 2006, Mr F wrote to the SPS and asked it to carry out a review of its response to his initial request regarding three of the questions he felt had not been responded to adequately, along with the decision to withhold information requested in question 6. The SPS responded to the request for review on 28 July 2006.

4.In its response, the SPS provided information that had been omitted in its original response and also attempted to answer the remaining questions that Mr F had raised in his request for review. In relation to questions 4 and 6 of Mr F's request, the SPS informed him that the information he had requested could not be supplied on the grounds that it would identify individual students and was exempt under section 38(1)(b) of FOISA

5.Mr F was dissatisfied with the outcome of the SPS's review and he applied to me for a decision on 24 January 2007. Mr F's appeal concerned the SPS's response to questions 3, 4 and 6 of his initial request. The appeal was validated on 5 February 2007 by establishing that Mr F had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the SPS to review its response to his initial request.

The Investigation

6.The SPS is an Executive Agency of the Scottish Ministers and a letter was sent to the Freedom of Information Unit of the then Scottish Executive (the Executive) on 5 February 2007 in line with agreed procedures, giving notice that an appeal had been received and that an investigation into the matter had begun. The Executive was asked to provide comments on behalf of the SPS in terms of section 49(3)(a) of FOISA, along with supporting documentation for the purposes of the investigation. The case was then allocated to an investigating officer.

7.The Executive responded on 2 March 2007, providing comments and copies of documentation that related to the SPS's handling of Mr F's request and his subsequent request for review. In its response the Executive stated that information which had been requested by Mr F had been supplied to him by the SPS where it was available. The Executive also set out its reasons for deciding to rely upon section 17 of FOISA in relation to questions 3 and 6 of Mr F's request on the grounds that the information was not held. In relation to question 4 of Mr F's request, the Executive set out its reasons for applying the exemption under section 38(1)(b) of FOISA to the information that had been requested in a particular format.

The Commissioner's Analysis and Findings

8.In coming to a decision on this matter, I have considered all of the information and the submissions that have been presented to me by both Mr F and the SPS and I am satisfied that no matter of relevance has been overlooked.

9.Mr F's initial request consisted of 6 questions relating to open learning provisions at Peterhead prison. In his application to me, Mr F stated that he was dissatisfied with the responses he had received from the SPS in relation to questions 3, 4 and 6 of his initial request.

Section 17 ? Notice that information is not held

10.In its responses to Mr F, the SPS provided information in relation to question 3 (providing clarification of that information following his request for review) and withheld information regarding question 6 on the basis that it was exempt under section 38(1)(b) of FOISA. In its submission to me, the Executive provided a detailed analysis of its reasons for relying upon section 17 of FOISA in relation to questions 3 and 6 of Mr F's request.

Question 3

11.In question 3 of his initial request, Mr F submitted the following request for information to the SPS: "For each of the 'open learning' sessions listed in response to Query 1 please provide: (a) the total number of participants in the session; (b) the number of participants studying 'approved topics'; (c) the number of students engaged in 'approved study programmes'."

12.In its response to Mr F the SPS supplied a summary table which provided details of the number of students attending each Open Learning Session and the number studying approved topics/approved study programmes.

13.Mr F was not satisfied with this response and, in his request for review, complained that the SPS had failed to account for any difference in the designation of approved 'topics' and 'programmes' according to current SPS LSE policy. He argued that the response he had received did not appear to draw any distinction between those students studying approved 'topics' and those studying approved 'programmes'.

14.Mr F asked if the response should be taken to indicate that the two subsets of students were mutually inclusive, or whether the designations were interchangeable. He also questioned whether Open Learning Sessions could be attended by a student who was not studying an approved 'topic' or 'programme'.

15.In its review the SPS informed Mr F that the designations 'topics' and 'programmes' were interchangeable and could mean the same or similar things. The SPS stated that a range of other terms could be used in place of either or both 'topic' and 'programme' e.g. subject, module, unit and course. In this context a 'topic' could be regarded as part of a more extensive programme of study comprising several different but nevertheless related 'topics' and could be studied concurrently or consecutively.

16.The SPS also pointed out that each 'topic' within any 'programme' might be able to be studied stand-alone allowing a student to gain certification on a 'topic' by 'topic' basis and that all students who attended the LSE Centre during Open Learning Sessions were authorised to be there to study their approved 'topic/programme'. It added that any apparent anomaly whereby a student could be present during some Open Learning Sessions who was not studying an approved topic/approved study programme was a consequence of a requirement to record only qualifying prisoner learning hours for the establishment Performance Contract.

17.In the Executive's submission concerning question 3, it stated that a table indicating the number of students attending each session had been provided to Mr. F in response to his initial request. The total number of students studying 'approved' topics/study programmes was also provided.However, the Executive maintained that the SPS was not able to provide figures for approved topics/study programmes separately.

18.The Executive stated that the General Terms of Provision of LSE Centre Facilities for Distance Learning Students at Peterhead Prison was a locally produced and relevant document which referred to the term 'approved topics' at paragraph 4 (i.e. "the session must be used for legitimate quiet study of relevant, approved topics on an individual basis?"). To describe a topic or study programme as approved could mean that subjects, topics or programmes were supported by the SPS via its open learning (fee waiver) structure and/or by the SPS/Open University Higher Education Access Board with respect to applications for higher open learning.

19.The Executive added that the term could also relate to other subjects, topics or programmes 'approved' at a local level, as being appropriate for study within Peterhead prison. In other words, the terms 'approved topics' and 'approved study programmes' could be taken to mean the same or similar things.It was explained that a topic might be seen as part of a more extensive programme of study comprising several different though related topics.These topics could be studied together, concurrently or progressively, so that ultimately the student would achieve, for example, a Group Award.However, each topic within that particular award could be capable of study as a stand-alone intervention, allowing the student to gain certification on a one-by-one basis.

20.The Executive added that there were other terms that might be used in place of 'topic' e.g. subject, module, unit, course, learning intervention etc.Which one was the most accurate description of what was being studied within a given context at any one time, was therefore open to interpretation. As such, the Executive argued that the terms used by Mr. F were not identifiable criteria and it was therefore not possible to provide the information he had requested. The information was therefore deemed to be information not held under the terms of section 17 of FOISA.

Conclusion

21.In response to Mr F's initial request the SPS supplied him with a table which provided details of the numbers attending each Open Learning Session and the number studying approved topics/approved study programmes. However, Mr F complained that the SPS had not distinguished between students studying approved 'topics' and those studying approved 'programmes'.

22.In his application to me, Mr F complained that the SPS's review response lacked clarity given that the scheme about which the request was made referred to approved programmes of study and to approved topics of study. However, in its response to Mr F's request for a review, the SPS had informed him that the designations 'topics' and 'programmes' were interchangeable and could mean the same or similar things. The Executive reiterated this point in its submission to me (i.e. that the terms 'approved topics' and 'approved study programmes' could be taken to mean the same or similar things).

23.Having considered all of the submissions presented to me on this matter, therefore, I am of the view that the Executive was correct to assert that the terms used by Mr F were not identifiable criteria (i.e. the number of participants studying 'approved topics' and the number of students engaged in 'approved study programmes'). Consequently, it was not possible for the SPS to provide the information requested and I find that the information was therefore not held by the SPS in terms of section 17 of FOISA. It should be noted that I am of the view that the information which the SPS initially provided in response to question 3 of Mr F's request was a satisfactory response based on a reasonable and appropriate interpretation of his request.

Question 6

24.In question 6 of his information request, Mr F submitted the following request for information to the SPS: "Please provide a full list of 'approved study programmes' within the LSE Centre at Peterhead prison in relation to which internet access has been provided pursuant to the 'General Terms of Provision' of 'Facilities for Distance Learning Students' between 1 September 2005 and 2 June 2006."

25.In its response the SPS informed Mr F that upon examining the records of requests for the LSE manager to access the Internet in support of approved study programmes it became apparent that to list the 'approved study programmes' would enable the identification of individual students studying within the LSE centre. Therefore this information was held to constitute third party personal data and was withheld under section 38(1)(b) of FOISA.

26.Mr F was not satisfied with this response and asked the SPS to review its decision not to disclose the information. Mr F questioned the SPS's assertion that the information constituted personal data and added that he found it difficult to envisage how the list he had requested would be more likely to reveal the names of individual students studying within the LSE Centre than the lists of 'topics'/'programmes' and assessments that had already been provided in response to other questions.

27.In its review the SPS reiterated its view that the information that had been requested about internet access would identify individual students and was therefore exempt from disclosure under section 38 of FOISA. The SPS informed Mr F that it was firmly of the view that it would be improper to provide information that may contribute to the identification of individual students without their consent and therefore maintained that its original response was pertinent.

28.In his submission to me, Mr F claimed that the information was not 'personal' in any meaningful sense and that it was in the public interest for such information to be made available. It was also argued that this kind of information was commonly made public by educational institutions and, within the Learning Centre at the prison, certificates of achievement of successful candidates were displayed on the walls.

29.Mr F argued that public funding was used to provide these courses and in some cases where no public funding was used to provide courseware (e.g. in the case of a self-funded student) there remained an element of public funding for learning support (access to PCs, printers, supervision, etc.).

30.In its submission to me, the Executive stated that internet access was not provided in the LSE Centre pursuant to the 'General Terms of Provision of Facilities for Distance Learning Students'. It was explained that where it was necessary for study material to be obtained through the internet, the LSE Centre manager would download the information, in the absence of the prisoner, and pass it on to them. This was explained to Mr F in response to a previous information request, on 6 June 2006, where the SPS had informed him that it was SPS policy that prisoners should not have direct access to the internet.

31.The Executive was therefore of the view that the requested information could not be provided as it was information not held under the terms of section 17 of FOISA.

Conclusion

32.Taking into account the SPS's procedures concerning the provision of internet access in the LSE Centre pursuant to the 'General Terms of Provision of Facilities for Distance Learning Students', I am satisfied that Mr F was informed by the SPS, in its response of 6 June 2006, that no internet access was provided in such circumstances.I am therefore of the view that the information that had been requested in this instance could not be provided by the SPS as it was information which was not held in terms of section 17 of FOISA.

Section 38(1)(b) ? Personal Information

Question 4

33.In his correspondence, Mr F submitted the following request for information to the SPS: "Please provide a comprehensive list detailing: (a) 'approved topics'; (b) 'approved study programmes' being followed by 'open learning' participants at the LSE Centre at Peterhead prison pursuant to the 'General Terms of Provision' of 'Facilities for Distance Learning Students' at any time between 1 September 2005 and 2 June 2006, to include details of the courseware provider." This constituted question 4 of the 6 questions that he had initially submitted to the SPS.

34.In its response to Mr F the SPS provided a list of approved topics/approved study programmes followed by Open Learning participants between 1 September 2005 and 2 June 2006. A separate list of courseware providers was also supplied.

35.Mr F was not satisfied with this response and asked the SPS to review its decision not to disclose the information in full. Mr F stated that he had been a participant in the Open Learning sessions since their inception in October 2005 and questioned why neither programme which he had been pursuing via Open Learning nor the course topics followed during this period had been listed, notwithstanding that he had been subject to the General Terms of Provision throughout this period. He complained that the list of 'topics/approved study programmes' therefore did not appear to be comprehensive.

36.Mr F raised issues concerning other students involved in programmes of study. He also wanted to know why particular courses or topics had not been detailed separately in the list that had been provided and complained that a separate list of courseware providers had been supplied without linking directly to the 'topics'/'programmes'.

37.In its review the SPS informed Mr F that details had already been provided in response to another of his questions which set out the reasons why he was permitted to participate in Open Learning Sessions and why this participation did not conflict with the General Terms of Provision. The SPS added that the aforementioned response demonstrated the impracticality of attempting to produce a comprehensive list of topics/approved study programmes.

38.The SPS provided a response to Mr F's question concerning other students' programmes and informed him of the likelihood of study materials being related in some way. Finally, it was stated that the SPS was of the view that an exemption under section 38 of FOISA applied to the information requested on the grounds that the association of the list of topics/approved study programmes with the list of courseware providers would identify individual students.

39.In his submission to me, Mr F claimed that the information he had requested was not 'personal' in any meaningful sense and that it was in the public interest for such information to be made available. He argued that this kind of information was commonly made public by educational institutions. Mr F's arguments in relation to this question were the same as those he presented regarding question 6, as detailed in paragraphs 28 and 29 above.

40.In the Executive's submission it was explained that the list of approved topics/approved study programmes which had been provided to Mr F by the SPS in response to his initial request, in addition to a separate list of courseware providers, had been provided in a format that did not identify particular features within them and therefore would not contribute to identifying individual students. For example, one of the approved topics/approved study programmes was entitled "Business Studies" and could typically include any or all of accounting, book keeping, financial and other management or business related subjects.

41.The Executive stated that a separate list of courseware and subject matter providers had been provided by the SPS in that format so that no direct link could be made between them and study programmes and by so doing contribute to the identification of any individual student.

The application of the section 38 (1)(b) exemption

42.In its submission to me the Executive considered that it was not appropriate to release the information to Mr. F in the format he had requested as it was information which could be used to tie a particular prisoner to a particular course. Given the small number of students within Peterhead prison receiving support from HEAS (Higher Education Access Scheme) and the reality of living in a close community, the Executive was of the view that it would be easy for Mr F, with some basic information about the courses (such as title, course provider), to identify what individual prisoners were studying.

43.The Executive suggested that, for example, Mr F would only have to notice the text books a prisoner was working with to be able to deduce the exact course of study that prisoner was undertaking.The Executive argued that this would not be fair to the individual prisoners, and the SPS had therefore withheld any information which could lead to the establishment of a connection between an individual and a course of study. Therefore, the Executive argued, the information was exempt under section 38(1)(b) of FOISA, on the grounds that disclosure would breach the first data protection principle on fair processing.

44.The Executive maintained that prisoners would have no expectation that such information would be made publicly available, and asserted that it was not difficult to envisage a situation in which a prisoner might be the subject of verbal abuse if they were known to be studying a course of an unusual character.It was also argued that prisoners on more expensive study programmes could be the subject of envious recrimination.

45.The Executive advised that there was no suggestion from the above that Mr F would misuse this information.However, it stressed that the SPS had a duty to individual prisoners to protect their personal data and, given the low numbers in the education scheme at Peterhead prison, it was felt that the inevitable consequence of releasing course titles would be the identification of individuals' personal data.

46.With regard to the question of whether individual prisoners could be identified from the data, I am of the opinion that the likelihood of this would be largely dependent on the circumstances surrounding the potential release of the information. Given the confined social interactions that will inevitably exist within a prison environment, and the limited number of prisoners participating in study programmes within the prison, it is my view that the release of the information in the required format within the prison environment would enable the identification of individual prisoners and the programmes of study they were undertaking.

47.I am therefore of the view that in the circumstances of this particular case, the information requested by Mr F in his question 4 should be regarded as the personal data of the prisoners concerned. Having established that the information does constitute personal data, I must go on to consider whether disclosure of the information in the format required by Mr F would breach any of the data protection principles.

Would release breach the data protection principles?

48.In its submissions to my Office, the Executive argued on behalf of the SPS that release of the information requested by Mr F in question 4 of his request would breach the first data protection principle.

49.The first data protection principle states that personal data must be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 is met and, in the case of 'sensitive personal data', at least one of the conditions in Schedule 3 is also met. I have considered the information in question and I am satisfied that it does not constitute 'sensitive personal data' in terms of the DPA and therefore I am not required to consider whether any of the conditions in Schedule 3 could be met.

50.The Executive argued that it was not appropriate to release the information to Mr. F in the format he had requested as it was information which could be used to link a particular prisoner to a particular course or programme of study. The Executive was of the view that this would not be fair to the individual prisoners concerned, and therefore any information which might lead to establishing a connection between an individual and a course of study had been withheld under section 38(1)(b) of FOISA on the grounds that to disclose such information would breach the first data protection principle on fair and lawful processing.

51.The Information Commissioner, who is responsible for enforcing the DPA, has issued guidance on the consideration of the data protection principles within the context of freedom of information legislation (http://www.ico.gov.uk/upload/documents/library/freedom_of_information/detailed_specialist_guides/awareness_guidance%20_1_%20personal_information_v2.pdf). In this guidance, the Information Commissioner provides examples of the types of questions which should be considered by authorities when assessing whether the release of personal data would amount to 'fair' processing. These include:

Would disclosure cause unnecessary or unjustified distress or damage to the person who the information is about?

Would the third party expect that his or her information might be disclosed to others?

Has the person been led to believe that his or her information would be kept secret?

52.Persons undertaking a programme of study within a prison will normally have a reasonable expectation that information about themselves which relates to their studies will not be disclosed to a third party or to the wider public without their consent. While there may be circumstances in which it will be reasonable for such information to be used for a purpose not directly related to the individual's course of study, for example for reviewing or monitoring the overall performance of the HEAS, I consider that it would be understood that any information used for these purposes would be in a form, such as statistical information or generalised commentary, which ensured that the individuals concerned could not be identified. It therefore seems to me reasonable to conclude that if the SPS were to disclose the information in the format required by Mr F, and this information could be utilised within the prison environment to identify which programmes of study are being undertaken by particular prisoners, this would constitute an unwarranted invasion of the privacy of the individuals concerned.

53.Taking into account the information that has already been provided to Mr F concerning the programmes of study carried out by other prisoners, in response to this and other requests (and bearing in mind in particular my conclusions in decision 201/2006, also involving Mr F and the SPS), I am of the view that disclosure of the information in the format requested by Mr F would serve to identify individual prisoners and the programmes of study which they were undertaking, regardless of those individuals' willingness or otherwise to disclose that information. I therefore consider that disclosure of the detailed topics/programmes undertaken by prisoners in conjunction with details of the relevant course providers in this instance would enable such information to be linked to individual prisoners and that this would be unfair to the data subjects concerned.

54.I am of the opinion therefore that the SPS was correct to rely upon section 38(1)(b) of FOISA in this instance on the grounds that to disclose the information in the format requested would be unfair to those individuals whose personal data it was and this would therefore constitute a breach of the first data protection principle.

The SPS's handling of Mr F's information request

55.In his application to me, Mr F stated that he was of the view that the SPS had not responded to his request for review within the required statutory timescale. Section 21 of FOISA sets out the statutory requirements for responding to a request for review.

56.Section 21(1) of FOISA specifies that a Scottish public authority receiving a request for review must comply promptly and in any event by not later than the twentieth working day after receipt by it of the requirement (unless that requirement is withdrawn, is considered to be vexatious or the request for information to which the requirement for review related was one with which, by virtue of section 14 of FOISA (which relates to vexatious or repeated requests), the authority was not obliged to comply).

57.Mr F's request for review was submitted to the SPS by recorded delivery on Thursday 29 June 2006. The earliest date on which the request for review could have been received by the SPS was the next day, Friday 30 June 2006. The 20 working day period for responding to a request for review begins from the next working day after the date of receipt of the request (in this instance Monday, 3 July 2006). The SPS issued its response to Mr F on 28 July 2006. This was the 20th working day after receipt of the request for review. Therefore the SPS complied fully with the requirements for responding to a request for review as set out in section 21(1) of FOISA.

Decision

I find that the Scottish Prison Service (SPS) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in dealing with Mr F's request.

I find that the SPS was correct to rely upon section 17 of FOISA in relation to questions 3 and 6 of Mr F's request on the basis that the information was not held.

I find that the SPS was correct to rely upon section 38(1)(b) of FOISA in relation to question 4 of Mr F's request on the basis that the information in question constituted personal data the disclosure of which would breach the first data protection principle of the Data Protection Act 1998, which requires that personal data shall be processed fairly and lawfully.

Appeal

Should either Mr F or the SPS wish to appeal against this decision, there is a right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this notice.

Kevin Dunion
Scottish Information Commissioner
13 September 2007

APPENDIX

Relevant Statutory Provisions

Freedom of Information (Scotland) Act 2002:

17Notice that information is not held

(1)Where-

(a)a Scottish public authority receives a request which would require it either-
(i)to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

(2)Subsection (1) is subject to section 19.

(3)Subsection (1) does not apply if, by virtue of section 18, the authority instead gives the applicant a refusal notice.

21Review by Scottish public authority

(1)Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.

(?)

(8) Subsection (1) does not oblige a Scottish public authority to comply with a requirement for review if-

(a) the requirement is vexatious; or

(b) the request for information to which the requirement for review relates was one with which, by virtue of section 14, the authority was not obliged to comply.

(?)

38Personal information

(1) Information is exempt information if it constitutes-

(?)

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(?)

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress); and

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(3) The second condition is that, by virtue of any provision of Part IV of that Act, the information is exempt from section 7(1)(c) of that Act (data subject's right of access to personal data).

(4)In determining for the purposes of this section whether anything done before 24th October 2007 would contravene any of the data protection principles, the exemptions in Part III of Schedule 8 to that Act are to be disregarded.

(?)

Data Protection Act 1998

1. ? Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

(?)

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

(?)

2. Sensitive personal data.

In this Act "sensitive personal data" means personal data consisting of information as to?

(a) the racial or ethnic origin of the data subject,

(b) his political opinions,

(c) his religious beliefs or other beliefs of a similar nature,

(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),

(e) his physical or mental health or condition,

(f) his sexual life,

(g) the commission or alleged commission by him of any offence, or

(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

Schedule 1 ? The Data Protection Principles

Part 1 The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

(?)

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

(...)

6. ?
(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.