Decision 165/2011 Mr Ian Benson and University of Glasgow
Number of staff suspended from work
Reference No: 201100287
Decision Date: 15 August 2011
Summary
Mr Benson asked the University of Glasgow (the University) for details of the number of staff suspended from duty in a specified three year period, along with details of the number of staff who were currently (i.e. as at the date of his request) suspended from duty. The University answered the first part of his request in full, but advised him that "less than five" members of staff were currently suspended from duty.The University withheld the actual figure on the basis that disclosing the true figure could lead to the staff who were suspended being identified.The University believed that the actual number was exempt under section 38(1)(b) of FOISA on the basis that disclosure would breach the data protection principles.Following a review, Mr Benson remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that disclosing the actual number of staff who were suspended would not lead to their identification and that the number did not comprise personal data.He therefore found that the exemption in section 38(1)(b) did not apply, and ordered the University to disclose the figure to Mr Benson.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5) (definition of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Part 1 of Schedule 1 (The data protection principles ? the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Common Services Agency v Scottish Information Commissioner [2008] UKHL 47 www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
Department of Health v Information Commissioner [2011] EWHC 1430 (Admin) http://www.bailii.org/ew/cases/EWHC/Admin/2011/1430.html
Craigdale Housing Association and others v Scottish Information Commissioner [2010] CSIH 43 http://www.scotcourts.gov.uk/opinions/2010CSIH43.html
Background
1.On 26 April 2010, Mr Benson wrote to the University asking:
a)During the period 01/01/07 to 31/12/09 how many staff at your institution were suspended?Please break down the figure into those on full pay, reduced pay and no pay.
b)At the present time, how many staff at your institution are currently suspended?Please break down the figure into those on full pay, reduced pay and no pay.
Mr Benson explained that, by "suspended", he meant any situation where a member of staff is under a contract of employment, but involuntarily carrying out reduced or no duties for the University.
2.The University responded on 25 May 2010. The University advised him, in response to part a) of his request, that nine members of staff were suspended during the relevant period and that all were suspended on full pay.In response to part b) of his request, the University notified him that "less than five" members of staff were currently suspended, all on full pay.It withheld the actual figure on the basis that it was personal data, which was exempt from disclosure under section 38(1)(b) of FOISA, on the basis that disclosure breach of the first, second, sixth and eighth data protection principles of the Data Protection Act 1998 (DPA).
3.On 28 December 2010, Mr Benson wrote to the University requesting a review of its decision. In his request for review, he commented that more than 125 other higher education institutions in the UK had already provided him with full responses to these questions without relying on "banded" data.Mr Benson also asked the University to explain why knowing that there were, for example, two suspensions rather than "less than four [sic] suspensions" could lead to the identification of an individual.
4.The University reviewed its initial response and notified Mr Benson of the outcome of its review on 24 January 2011. It upheld its original response, confirming that it was withholding the number of staff suspended from duty in terms of section 38(1)(b) of FOISA.The University did not directly address the question Mr Benson had posed in his request for review, but did advise that its policy of using banded data is founded on its concern that statistical information relating to staff or students has the potential to constitute personal data since, if linked to other information held by the University or to information already in the public domain, disclosing the statistical information could lead to individuals being identified.
5.On 13 February 2011, Mr Benson wrote to the Commissioner, stating that he was dissatisfied with the outcome of the University's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Benson had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 17 February 2011, the University was notified in writing that an application had been received from Mr Benson and was asked to provide the Commissioner with the number of staff suspended as at the date of Mr Benson's request.The University provided the number and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the University, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the University was asked to justify its reliance on section 38(1)(b) of FOISA.
9.The University responded on 1 April 2011.
10.The submissions received from both Mr Benson and the University are (where relevant) summarised and considered in the Commissioner's analysis and findings section below.
Commissioner's analysis and findings
11.In coming to a decision on this matter, the Commissioner has considered the information which has been withheld and the submissions made to him by both Mr Benson and the University, and is satisfied that no matter of relevance has been overlooked.
The withheld information
12.The information which has been withheld in this case is the number of University staff suspended on full pay as at 26 April 2010.Mr Benson is aware that the figure is "less than five", but wants to know the actual figure.
Section 38(1)(b) of FOISA ? Personal information
13.The University withheld the true figure under section 38(1)(b) of FOISA.Section 38(1)(b), read with section 38(2)(a)(i) or (b), exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA and if disclosure of the information would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
14.This particular exemption is an absolute exemption, so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
Are the statistics personal data?
15.The Commissioner will first consider whether the figure in question comprises personal data.If the figure does not comprise personal data, it will not be exempt under section 38(1)(b) of FOISA.
16."Personal data" is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).The DPA gives effect to Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (the Directive) and so the DPA should, if possible, be interpreted in a manner which is consistent with the Directive.
17.In considering the definition of "personal data", the Commissioner has also taken account of the opinions delivered by the House of Lords in Common Services Agency v Scottish Information Commissioner, by the High Court of England and Wales in Department of Health v Information Commissioner and by the Court of Session in Craigdale Housing Association and others v Scottish Information Commissioner.
18.The University submitted that, as it is in direct possession of information which can identify these individuals, the numbers constitute personal data.
19.This argument suggests that, if a data controller holds underlying identification data, information will always be personal data, regardless of the size of the statistic.(As noted above, the University's practice is to disclose data of five or more, but to band figures of less than five.)If it were the case that the statistics were personal data simply because the University held the identifying information, then the figures which were disclosed would also comprise personal data.
20.This approach to the definition of personal data has not been followed by the courts.In the Common Services Agency case, which involved a request for statistics relating to childhood leukaemia statistics in Dumfries and Galloway, the House of Lords concluded that the definition of "personal data" in the DPA must, in terms of recital 26 of the Directive, be taken to permit the disclosure of information which had been rendered fully anonymous in such a way that individuals were no longer identifiable from it, without having to apply the data protection principles.
21.Lord Hope's view (which attracted majority support in the Common Services Agency case) was that the definition of personal data under section 1(1) of the DPA provides for two means of identification: identification will either be from the data itself (which would not apply in the case of anonymous statistics) or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller.
22.Lord Hope's approach is to ask whether the "other information" (if provided to a hypothetical member of the public) add anything to the statistics which would enable them to identify the underlying individuals.If the answer is no, the statistics are not personal data.The words in italics are important: if identification can be achieved from the "other information" in isolation (i.e. rather than when added to the statistics) then the statistics themselves are truly anonymous, and are not personal data.
23.This approach was considered by the High Court of England and Wales in the Department of Health case.That case involved a request for abortion statistics held by the Department of Health.As the University has here, the Department of Health argued that, because it held the data which would identify individual patients, the numbers of abortions which had been carried out were, given definition (b), personal data.However, this approach was rejected by the High Court by Cranston J, who commented:
"If that were the case, any publication would amount to the processing of ? personal data ?Thus, the statistic that 100,000 women had an abortion ? would constitute personal data about each of these women, provided that the body that publishes this statistic has access to information which would enable it to identify each one of them.That is not a sensible result ?."
24.The Commissioner has therefore concluded that the information withheld from Mr Benson is not personal data simply because the University holds other information which would identify the individuals.
25.However, the University also argued that the statistic was personal data on the basis that there is other information in the public domain (other than that which Mr Benson has direct access to) which would lead to the identification of the members of staff who have been suspended by other people.The University argued that in this case it is possible that work colleagues would be able to identify a member of staff who was suspended.
26.The Commissioner has noted the approach taken by the Court of Session in the Craigdale Housing Association case.The Court of Session referred to Recital 26 of the Directive, which states that, when determining whether a person is identifiable, account should be taken of all the means likely reasonably to be used to identify the data subject.As noted by the Court of Session, the test is therefore whether disclosure of the information would lead to the identification of an individual or whether there is other information in the public domain which, when taken with the information, would reasonably allow for such identification.
27.Guidance entitled "Determining what is personal data[1]" which has been issued by the (UK) Information Commissioner (who is responsible for enforcing the DPA throughout the UK) states that, in considering whether a person can be identified, it should be assumed that it is not just the means reasonably likely to be used by the ordinary man in the street to identify a person, but also the means which are likely to be used by a determined person with a particular reason to want to identify the individual.(This guidance was also referred to by the University during the investigation.)
28.The Commissioner therefore considered whether the number requested by Mr Benson, together with other information already in the public domain (or as a result of action likely to be taken by a determined person to identify the individuals if the numbers were to be disclosed) would reasonably allow individual members of staff to be identified.If disclosure of the number would reasonably allow for identification, then the number comprises personal data and cannot be disclosed unless there is a condition in Schedule 1 to the DPA which would permit it to be disclosed.If disclosure of the number would not reasonably allow for identification, then the number does not comprise personal data and the exemption in section 38(1)(b) would not apply.
29.As noted above, when it provided submissions to the Commissioner, the University, with reference to Recital 26, took the view that the disclosure of the number could, taken in combination with other information already in the public domain, identify a member of staff of the University.
30.The investigating officer subsequently sought examples from the University as to how it considered that individual members of staff could be indentified from the number requested by Mr Benson, when used in conjunction with other information.
31.The University acknowledged that it is a large organisation, employing more than 6,000 people, and that it had considered the small numbers concerned in the context of such a large number of employees. However, the University maintained that, despite its overall size, it is very devolved in nature, due to the fact that, historically, schools and service areas often acted as devolved communities within the overall organisation.The University argued that, since a suspension (by its very nature), means that a member of staff will be absent from work, there is a strong possibility that staff in the same area may be able to surmise that a colleague who is absent is absent because he/she has been suspended. The University also notes that the statistic relates to the number of staff suspended on full pay, and is concerned that this reveals the terms of a staff member's suspension.
32.The University argued that it is appropriate not just to consider the intentions and abilities of Mr Benson, but those of any individual who may be inclined to attempt to identify individuals from the information in question for any reason (the University noted, correctly, that information released under FOISA is considered to be released to the public at large).In light of this, the University considered it appropriate to mask such small numbers to provide some protection to the individuals behind the statistics so that any individual, determined or otherwise, who may wish for whatever reason to discover their identity, is prevented from doing so.
33.The University commented that Mr Benson is open to the fact that he wishes to collate reports relating to the Higher Education sector to publish on his website.The University notes that this information will be available to anyone viewing his website.The University considers that the data could be directly linked back to individuals suspended by those individuals themselves or by others within the University of Glasgow.The University notes that public disclosure of the statistics on Mr Benson's website may contribute to the fear of suspended staff that their identity being discovered by others.Given that a member of staff may be suspended pending an investigation, and that the outcome of that investigation may clear the employee of all wrong doing, the University submits it would be inappropriate to reveal that person's identity.
34.While the submissions from the University highlight the fact that some of its staff may already suspect that an absent colleague may have been suspended,the University has not shown how disclosure of the statistic requested by Mr Benson would lead to the identification of a suspended University employee who was not previously identifiable; in other words, it has not shown why disclosure of the actual number of staff suspended (rather than the banded data) would "unlock" the figures and permit identification of any of the individuals represented in the statistic.
35.The Commissioner accepts that, where a person already knows that an individual is suspended from duty (this may be the individual him/herself), disclosure of the figure in question could permit that person to confirm that the individual is one of those person(s) referred to in the figure.However, this in itself does not make the figure personal data; it is not the disclosure of the figure which would identify the individual.
36.The University clearly has concerns that, if a person already knows that a member of staff has been suspended, but is not aware of the terms of that suspension (i.e. whether they are on full, reduced or no pay), then disclosing the fact that a person is on full pay will involve the processing of personal data about that individual.However, the University has already publicly disclosed the fact that all of its employees suspended as at the date of Mr Benson's request were suspended on full pay.Therefore, it is not the release of the true number which would disclose this fact; this fact is already in the public domain.
37.The Commissioner considers that the University has failed to demonstrate that disclosure of the true figure would be the decisive factor leading to the identification of one or more suspended employees, or would make identification possible where it was previously impossible.As the University has recognised, it is a large organisation, with over 6,000 staff; the very fact that it is devolved will, in the Commissioner's view, make it even more unlikely that individual members of staff will be identified from the disclosure of the statistic, given that the lack of connection between schools or faculties.As such, the Commissioner must conclude that the disclosure of the statistics would not identify an individual suspended from duty and that the statistics are not, therefore, personal data, as defined by section 1(1)(a) of the DPA.
38.Having come to this conclusion, the Commissioner finds that the exemption in section 38(1)(b) of FOISA cannot apply to the withheld information.
DECISION
The Commissioner finds that the University of Glasgow (the University) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Ian Benson, by wrongly withholding the actual number of staff suspended on full pay as of 26 April 2010 under section 38(1)(b) of FOISA.As such, the Commissioner finds that there has been a breach of section 1(1) of FOISA.
The Commissioner therefore requires the University to disclose the figure to Mr Benson by 29 September 2011.
Appeal
Should either Mr Ian Benson or the University of Glasgow wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
15 August 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.ico.gov.uk/~/media/documents/library/Data_Protection/Detailed_specialist_guides/PERSONAL_DATA_FLOWCHART_V1_WITH_PREFACE001.ashx
