Decision 166/2007 ? Mr A and the University of Paisley

Information relating to an employment grievance

Applicant: Mr A
Authority: University of Paisley
Case No: 200600684
Decision Date: 17 September 2007

Kevin Dunion
Scottish Information Commissioner

Request for all information relating to the applicant's grievance with the University of Paisley

Relevant Statutory Provisions and other Sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement); 2(1) and (2)(c) and (e) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 35(1)(g) and (2)(b) and (2)(d)(ii) (Law enforcement); 36 (Confidentiality); 38(1)(a) and (b),(2)(a)(i) and (b) (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (definition of "personal data") and (2) (Basic interpretative provisions) and 2 (Sensitive personal data); Schedule 1 Part I (The data protection principles) (the first data protection principle); Schedule 2 condition 6(1) (Conditions relevant for purposes of the first principle: processing of any personal data) Schedule 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data)

The full text of each of these provisions is reproduced in Appendix 1 to this decision.Appendix 1 forms part of this decision.

Facts

Mr A made his information requests within the context of a long-running dispute with the University of Paisley (the University) which had caused him to initiate grievance procedures.He believed that the University was withholding information which would support his claims.

The University withheld over 200 documents from Mr A.The Commissioner agreed that the majority of these documents were exempt from release under FOISA.The Commissioner considered that it would be unfair to release the personal information of the third parties against whom the grievance had been raised; that much of the information had been provided to the University in confidence and on the understanding that it would not be put into the public domain and that release of the information would substantially prejudice the University's ability to deal properly with grievances in the future.

Background

1.In 2003 Mr A initiated grievance procedures against the University regarding a long-running dispute concerning the actions of another member of staff.On 20 December 2005 he asked the University to supply "all information held by the University regarding my grievance".

2.Mr A wrote again on 24 January 2006, repeating his request and specifying some of the types of information which his request would cover.His request included all information held about his grievance by six named individuals.In this letter he also made a subject access request under the Data Protection Act 1998 (the DPA) for his own personal information as it related to his grievance.

3.The University replied on 14 February 2006, enclosing some information from the files relating to Mr A's grievance.The University advised him that it was still determining whether any other information was held which would be covered by his request.Mr A was also informed that the University believed some of the information to be exempt from disclosure under FOISA; the University cited section 36(1) and (2), section 35(1)(g) and section 38(1)(b) as the relevant exemptions.

4.Mr A asked for a review of the University's response on 22 February 2006.On 21 March 2006 the University wrote to advise him that, after review, the original decision had been upheld.Additionally, the University had applied the exemptions in section 30(b) and (c) to some of the information withheld.

5.Mr A applied to me for a decision on 5 April 2006.He explained the background to his request and stated that he had consistently been denied access to information about his case.He complained that the University was deliberately withholding information that would support his claims, and asked that the University be required to release documents and witness statements which he had been unable to revoke or dispute.

6.The case was assigned to an investigating officer and the application validated by establishing that Mr A had made a request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to his request.

Investigation

7.The University was notified of the application made by Mr A and its comments were invited in terms of section 49(3)(a) of FOISA.The University was asked to provide copies of all information withheld from Mr A and to make it clear which exemptions it considered should apply to each document.

8.The University provided the information and comments requested.It explained that, in replying to Mr A's request, it had ignored his status as a member of staff and treated him as a member of the public.However, in considering the disclosure of personal information relating to third parties it had been mindful that Mr A has knowledge of staff that a member of the public would not.

9.The University stated that interviewees had been assured that information provided would be treated as confidential, and that Mr A had been given a summary of the interviews as part of the grievance procedure.The University took the view that most of the information collected is the personal data of the persons named in the grievance.It provided a schedule showing which exemptions in FOISA had been applied to each document withheld.

10.During the investigation the University provided further information and comment as requested, and revised the exemptions applied to some of the information.In particular, the University withdrew its reliance upon the exemptions in section 30(b)(i) & (ii) of FOISA and cited the exemption in section 30(c) in relation to the information in several documents.

The Commissioner's Analysis and Findings

11.In coming to a decision on this matter, I have considered all of the information and the submissions that have been presented to me by both Mr A and the University and I am satisfied that no matter of relevance has been overlooked.

12.It is particularly relevant to this case to point out that disclosure of information under FOISA effectively makes that information available to any person, not just the applicant.It is not possible to order disclosure of any of the information in this case on the understanding that it will be made available only to Mr A.

Information which has been withheld

13.The University applied several exemptions in FOISA to most of the documents withheld from Mr A.I have considered each of the exemptions in turn.Where I have found that the information should be withheld under one of the exemptions considered, I have not gone on to discuss whether the other exemptions cited should also be upheld.

14.A copy of the schedule of documents is set out in Appendix 2 to this decision notice showing whether the application of exemptions to each document was upheld (or, in light of the comments in the paragraph above, considered) or whether the information should be disclosed.

Information withheld under section 38(1)(a) ? personal data of the applicant

15.Section 38(1)(a) of FOISA exempts information from disclosure if it is personal data of which the applicant is the data subject.This is an absolute exemption and therefore is not subject to the public interest test set down in section 2(1)(b) of FOISA..

16.Where the University cited this exemption I found that it was justified in doing so.

17.In addition, I found other documents containing Mr A's personal data where the exemption in section 38(1)(a) of FOISA had not been cited.Because the exemption in section 38(1)(a) is an absolute exemption, I cannot order the University to disclose under FOISA any of Mr A's own personal data, even where it has not chosen to cite the exemption in section 38(1)(a).

18.However, in Appendix 2, I have indicated certain documents which I require the University to release, but which contain personal data relating to Mr A such as his name or other (non-sensitive) personal information.I would encourage the University to release these documents to Mr A without redacting his personal data, but would suggest that if another person were later to make a request for this information, Mr A's personal data should be redacted before the documents were released.

19.I note that Mr A has already made a subject access request under the DPA for his personal data in relation to his grievance.Since the question of Mr A's right to access this personal data is governed by the DPA, it is the Information Commissioner responsible for data protection matters throughout the UK who has the authority to deal with any complaint Mr A wishes to make in relation to this matter.

20.I have indicated on the attached schedule of documents where I consider that there is personal data relating to Mr A to be included in the documents withheld.

Information withheld under section 38(1)(b) ? third party personal information

21.The exemption under section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (b), is also an absolute exemption and so is not subject to the public interest test required by section 2(1)(b) of FOISA. In order for a public authority to rely on this exemption it must show that the information which has been requested is personal data for the purposes of the DPA, and that release of the information to a member of the public would contravene any of the data protection principles laid down in the DPA.

22.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met.In the case of sensitive personal data (as defined by section 2 of the DPA), at least one of the conditions in Schedule 3 must also be met.In this case I have found that some of the information withheld from Mr A falls within the definition of sensitive personal data.

23.Condition 6(1) of Schedule 2 to the DPA allows information to be processed (in this case, disclosed) where:

"The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject."

24.I must apply a number of tests to establish whether condition 6(1) supports disclosure of personal data in this case.The first test is whether it can be established that the third party or parties to whom the data would be disclosed has/have a legitimate interest in the processing of the personal data (in this case by disclosure to a member of the public) to which the request relates. The second is whether the processing is necessary for the purposes of those legitimate interests. The third is whether that processing can be seen to be unwarranted in this particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. Both competing interests must then be balanced.

25.In considering the first test, it seems to me that there is a legitimate interest in providing Mr A with information which would enable him to understand more fully the circumstances surrounding his complaint and so inform his engagement in the grievance procedure.More generally, the public may have a legitimate interest in knowing that a public authority, such as the University, is carrying out its functions in a fair and objective manner.

26.In determining whether disclosure is necessary for the purposes of the legitimate interests identified in the previous paragraph, I have considered whether these interests might be met equally effectively by any alternative means.I note that Mr A has already been given a summary of the interviews held as part of the grievance procedure.However, I have concluded that the legitimate interests in question cannot be fully met without disclosure of certain of the personal data withheld and therefore disclosure of these data is necessary for the purposes of the legitimate interests.

27.As mentioned above, I am required to balance Mr A's legitimate interests against those of the various data subjects (i.e. the people whose personal data he has asked to see).My findings in respect of each of the balancing exercises I have carried out are discussed below.

28.The University has stated that, in its view, data collected regarding a grievance against any particular member of staff is the personal data of that member of staff, and that disclosure of such information would cause damage or distress to members of staff and breach the first and second data protection principles.

29.I accept that any information which reveals that an identifiable individual was the subject of a grievance does constitute the personal data of that individual, particularly where the behaviour or professional performance of the individual is the focus of the grievance.

30.The University has stated that disclosure of the information would breach the first and the second data protection principles.The first principle requires personal data to be processed fairly and lawfully.Disclosure would be unlawful, for example, if there would be a breach of confidence.

31.The concept of "fairness" is harder to define. The kinds of questions which an authority should address are:

Would the disclosure cause unnecessary or unjustified distress or damage to the person who the information is about?

Would the third party expect that his or her information might be disclosed to others?

Had the person been led to believe that his or her information would be kept secret?

Has the third party expressly refused consent to disclosure of the information?

Personal data of the subjects of the grievance procedure

32.I accept that the people who were subjects of the grievance procedure were told that any information provided would be treated confidentially, and were also advised of the need to preserve confidentiality in relation to the proceedings.Both the ACAS Code of Practice and the University's grievance procedure emphasis confidentiality in proceedings.The University believes that it would be in breach of confidence to its staff if the information were released.

33.At this point I will not consider whether or not disclosure of the information could result in an actionable breach of confidence (this will be fully considered in relation to the exemption in section 36(2)). However, it is clear that the subjects of the grievance procedure would expect information relating to that process to be kept confidential and would have been led to believe that this information would be made available only to those involved in the grievance procedure.

34.After balancing Mr A's legitimate interests (as described in paragraph 25) against the interests of the data subjects, I am satisfied that where the information withheld is the personal data of the subjects of the grievance procedure then disclosure of this information would be unfair and unwarranted by reason of prejudice to the individual's rights, freedoms or legitimate interests, for the reasons given in paragraph 32.Accordingly I find that condition 6 of Schedule 2 of the DPA does not support the disclosure of personal data in this case and disclosure would breach the first data protection principle. Having reached this conclusion I am not required to consider whether any of the conditions in Schedule 3 would permit disclosure of sensitive personal data. I uphold the decision that the personal data of the subjects of the grievance isinformation which is exempt from disclosure under section 38(1)(b) of FOISA.

35.Because I have reached this conclusion regarding the first data protection principle, I have not found it necessary to consider whether disclosure of the personal data of the subjects of the grievance would breach the second data protection principle.

Personal data contained in documents created for other purposes

36.The University has also applied the exemption in section 38(1)(b) to personal information included in documents which were created for purposes other than the grievance procedure.Again, I have considered whether disclosure of the personal information would contravene any of the data protection principles.In doing so I have taken into account the guidance ("Freedom of Information Awareness Guidance 1") published by the Information Commissioner responsible for data protection matters.

37.I found that no sensitive personal data was contained within these documents, so in considering disclosure I do not need to establish whether any of the conditions in Schedule 3 of the DPA are met.

38.I have generally found that it would not be unfair to disclose personal data of University staff where this relates to their name, job title, or normal work practices, in circumstances where disclosure carries no risk to the individual concerned, and where staff have been given no explicit assurance that such information would be treated confidentially.I am satisfied, therefore, that disclosure of such information would not breach the first data protection principle.

39.The second data protection principle states:

"Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes."

40.The University has not provided me with any arguments in relation to the second data protection principle, as applied to personal data of the type described in paragraph 38.I note that in its review response to Mr A (21 March 2006), the University applied the second data protection principle only in relation to the personal data of the person who was the subject of the grievance.Given the innocuous and general nature of the personal information in question, I believe that the second data protection principle cannot be taken as a bar to disclosure of information which would already be widely known.

41.My thinking on this issue mirrors that of the Information Commissioner, as expressed in his decision notice FS50087443 (dated 13 July 2006)[1]. I do not accept the premise that disclosure of personal data can only take place under FOISA where the public authority has specified that the information has been obtained for this purpose.To accept this interpretation would mean that no personal data could be released in response to FOI requests except where data subjects had been given prior notice. This would include cases where requests for information identified individuals acting in a public or official capacity in addition to information relating to their private lives.

42.I agree with the Information Commissioner's view that:

"the correct interpretation of Principle 2 in this context is that the disclosure of third party data in response to a request submitted in accordance with other statutory rights is not inherently incompatible with any other lawful purpose for which information may be obtained. Principle 2 may, however, restrict the purposes for which a third party to whom personal data are disclosed may subsequently process those data."

43.Again, I agree with the Information Commissioner that the central issue in considering whether or not the FOI Act requires the disclosure of personal data is not the second data protection principle, but rather the first principle. My findings in relation to the first data protection principle are outlined in previous paragraphs.

44.Having considered the personal data in question (that is, the personal data which does not relate to the subjects of the grievance procedure) I am satisfied that, provided that the requirements of condition 6 can be met, there will be no statutory or other prohibition on disclosure and therefore that disclosure under FOISA will, in all the circumstances, be lawful.

45.I have balanced the legitimate interests of Mr A (as described in paragraph 25) against those of the persons described in paragraph 38, and have found that as disclosure of the information would not breach either the first or second data protection principles, Mr A's interests should prevail. I find that such information should not be withheld under section 38(1)(b) of FOISA.

Information withheld under section 36(1) ? Confidentiality

46.Section 36(1) exempts information from disclosure if it is information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings.One type of communication which falls into this category are communications which are subject to legal professional privilege.Legal professional privilege can itself be split into two categories ? legal advice privilege and litigation privilege (also known as communications post litem motam).Here, I am considering legal advice privilege.This covers communications between lawyers and their clients where legal advice is sought or given.

47.Having examined the information withheld by the University under section 36(1), I accept that (for the most part) it was advice provided by a legal adviser to a client, or information provided by the client in the course of seeking legal advice, and that such information falls within the exemption in section 36(1).

48.The exemption in section 36(1) is a qualified exemption, which means that the application of this exemption is subject to the public interest test set out in section 2(1)(b) of FOISA. Where a public authority finds that this exemption applies to the information that has been requested, it must go on to consider whether, in all circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. If the two are evenly balanced, the presumption should always be in favour of disclosure.

49.As I have noted in previous decision notices (such as 033/2006, Mr O'Donnell and East Dunbartonshire Council), the courts have long recognised the strong public interest in maintaining the right to confidentiality of communications between legal adviser and client on administration of justice grounds. Many of the arguments in favour of maintaining confidentiality of communications were discussed in a House of Lords case, Three Rivers District Council and others v Governor and Company of the Bank of England (2004) UKHL 48.I accept that there will always be a strong public interest in maintaining the right to confidentiality of communications between legal adviser and client.

50.I have considered the arguments relating to the public interest put forward by Mr A, but on balance I have found that the public interest in upholding the exemption in section 36(1) outweighs other public interest considerations in this case.I have therefore accepted that the exemption should be upheld in all cases where it has been applied by the University.

51.Where I have found that the University was justified in relying on (and maintaining) the exemption under section 36(1) to withhold information, I will not consider whether any other exemptions cited would also apply.

52.Document 21 is a communication from the University's solicitors to Mr A's solicitors. Given that it is not a communication between solicitor and client, I do not consider that it is subject to legal professional privilege.I therefore consider that the information in document 21 is not information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings, and that the exemption in section 36(1) could not apply to this information.

Information withheld under section 36(2) - Confidentiality

53.The University withheld a series of documents under this exemption on the grounds that the information within them had either been provided by witnesses during the grievance proceedings or related to interviews with witnesses.Interviewees had been assured that information provided would be treated as confidential.

54.In terms of section 36(2) of FOISA, information is exempt information if it was obtained by a Scottish public authority from a third party and its disclosure by that authority would constitute a breach of confidence actionable by that person or any other person.The exemption is absolute in that it is not subject to the public interest test required by section 2(1)(b) of FOISA.However, it is generally accepted in common law that a obligation of confidence will not be enforced to restrain the disclosure of information which is in the public interest.

55.I will first consider whether the information withheld under this exemption has been obtained by the University from another person.

56.In my guidance on the exemption in section 36(2) I made it clear that information generated by the authority itself cannot be withheld under this exemption.Because a public authority is a single legal entity (even though it may have a number of departments), then it is impossible for that body to impose a duty of confidentiality on itself.

57.However, I take the view that in a grievance procedurethe employees who are giving evidence should not be viewed as "the public authority" but rather as individuals in their own right. As a result, it is acceptable for the public authority to say to the employees that any information they give would be treated in confidence, and for that information to be regarded as "obtained by a Scottish public authority" in terms of section 36(2) of FOISA.

58.The second test required by this exemption is that disclosure of the information by the public authority would constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person. Although there was no discussion about the meaning of the word "actionable" when the Freedom of Information (Scotland) Bill was being considered in Parliament, I take the view that actionable means that the basic requirements for a successful action must appear to be fulfilled.

59.There are three main requirements which must be met before a claim for breach of confidentiality can be established. These are:

the information must have the necessary quality of confidence;

the public authority must have received the information in circumstances from which an obligation on the authority to maintain confidentiality could be inferred; and

there must be a disclosure which has not been authorised by the person who communicated the information but which would cause damage to that person.

60.The University's Grievance Policy and Procedure states:

"Grievances will be treated by Manager, Trade Unions and all employees involved at any stage of the process, with the highest degree of confidentiality.All individuals participatingin any investigatory meetings will be assured that what they say and the records of the meeting(s) will be kept confidential to the process and will be used only for the purpose of investigation the grievance and taking any action as a result of the investigation."

61.Members of staff participating in the grievance interviews were provided with a note of the main points of the interview and asked to sign it.I note that the letter accompanying each set of notes advises the recipient"It is essential that you continue to observe the confidentiality requirements relevant to the Grievance Procedure."

62.It is clear to me that the information provided by participants was received in circumstances from which an obligation on the authority to maintain confidentiality could be inferred.However, I must also consider whether the other two tests are met before accepting that the exemption has been correctly applied.

63.I found that the information in the documents withheld under this exemption varied widely.Some of it was clearly confidential in nature, and if disclosed would be likely to harm the individual's professional relationships and possibly their career prospects.However, some of the documents supplied by the participants were copies of documents which had no inherent quality of confidence (for instance, a departmental meeting agenda).

64.Even if it was accepted that the context in which these documents are now to be set would endow them with the necessary quality of confidence, it is difficult to see how disclosure of such information would result in damage to the person who provided the information. As discussed previously, I have accepted that the identities of the members of staff participating in the grievance procedure should be withheld under section 38(1)(b) of FOISA, so were disclosure to be ordered, the identity of the person submitting the document would not be known.

65.I have therefore found that although the exemption in section 36(2) was applied correctly by the University in relation to some information, there are several instances where I cannot uphold the use of this exemption as the information does not have necessary quality of confidence.The documents in question are indicated in Appendix 2, and in most cases these are covering letters enclosing signed statements from interviewees. Although I find that the statements should be withheld under section 36(2), I do not consider that the covering letters contain any information which would bring them under the scope of the exemption.

66.I must consider the other exemptions applied by the University to this information, and in particular the exemption in section 30(c), before reaching a final decision on whether or not the information should be disclosed.

67.Where I have found that the University was justified in withholding information under section 36(2), I will not consider whether any other exemptions cited would also apply.

68.The exemption under section 36(2) is an absolute exemption and is not subject to the public interest test under section 2 of FOISA. However, public interest considerations must also be taken into account when applying this exemption. Although the law of confidence recognises that there is a strong public interest in ensuring that people respect confidences, and the burden of showing that a failure to maintain confidentiality would be in the public interest is therefore a heavy one, in certain circumstances, the public interest in maintaining confidences may be outweighed by the public interest in disclosure of information. The courts have considered that there may be a public interest defence to actions of breach of confidentiality where to enforce an obligation of confidence would cover up wrongdoing, allow the public to be misled or unjustifiably inhibit public scrutiny of matters of genuine public concern.

69.However, in the circumstances of this particular case, I cannot see a reasonable basis to conclude that the University would have a defence to an action of breach of confidence on public interest grounds in the event that it disclosed the information.

Information withheld under section 35(1)(g)

70.In refusing to disclose the information requested by Mr A, the University cited section 35(1)(g) of FOISA as being the relevant exemption to be applied to a large proportion of the information in this case. Section 35(1)(g) states that information is exempt information if its disclosure would, or would be likely to, prejudice substantially the exercise by any Scottish public authority of its functions for any of the purposes mentioned in section 35(2).

71.The University cited the following purposes under section 35(2) of FOISA as being relevant in this instance ?

(b)to ascertain whether a person is responsible for conduct which is improper and

(d)(ii)to ascertain a person's fitness or competence in relation to any profession or other activity which the person is, or seeks to become, authorised to carry on.

72.The University initially stated that these exemptions apply to certain information in this case as the University must be able to pursue all relevant inquiries in investigating a grievance raised by an employee against a colleague.

73.The exemption in section 35(1)(g) can only apply where disclosure of information would or would be likely to prejudice substantially its ability to carry out one or more of its functions.A public authority's functions are the full range of its duties and powers, statutory and non-statutory.

74.I accept that employment relations are a recognised function of a public authority. The statutory grievance procedures introduced by the Employment Act 2002 (Dispute Resolution) Regulations 2004 must be followed by all employers and employees if a complaint is formalised.I therefore accept that the University was carrying out one of its functions in dealing with Mr A's grievance.

75.I must now go on to consider whether the purposes for which the University was exercising this function were the purposes described in section 35(2)(b) and 35(2)(d)(ii).

76.Section 35(2)(b) and 35(2)(d)(ii) use the word "ascertain" in relation to the purpose of the activity undertaken by the authority.Although the conduct of some of Mr A's colleagues was examined during the inquiry into his grievances, the University has confirmed that decisions on individuals' conduct or competence would be taken during separate disciplinary procedures.

77.The University has argued that Mr A's stated complaint relates to his claim that the University failed to protect his employment rights and failed to implement an agreed process regarding the rehabilitation of another member of staff.The University therefore took the view that information relating to the investigation of that member of staff's fitness formed part of the grievance paperwork.

78.I accept that the grievance procedure has generated information relating to the assessment of the conduct of staff; however, as stated by the University, Mr A's grievance relates specifically to perceived failings on the part of the University.I cannot accept that the purpose of the grievance procedure was to ascertain whether a person is responsible for conduct which is improper (section 35(2)(b)) or to ascertain their fitness or competence in relation to any profession or other activity which the person is, or seeks to become, authorised to carry on (section 35(2)(d)(ii)).

79.In my briefing on section 35 I refer to the purpose laid down in section 35(2)(b) and note that establishing whether "a person is responsible for conduct which is improper" may involve considering a person's actions in relation to some expected standard. For example, the Code of Conduct for Councillors sets out the standards of conduct with which all Scottish councillors must comply.I think it more likely that this exemption will apply in situations where conduct is assessed against a formal standard.

80.I have therefore found that the University was wrong to cite the exemption in section 35(1)(g) in conjunction with section 35(2)(b) and (d)(ii) in relation to any of the information withheld from Mr A.

81.Because I have found that the exemption was wrongly applied, there is no requirement to consider whether or not the public interest would require disclosure of the information withheld.However, the University has applied other exemptions to the information withheld under section 35(1)(g) and I must consider those before determining whether or not the information should be released to Mr A.

Section 30(c) ? Prejudice to effective conduct of public affairs

82.Section 30(c) of FOISA states that information is exempt information if its disclosure under FOISA would or would be likely to prejudice substantially the effective conduct of public affairs.

83.The University applied this exemption to submissions obtained from staff and other information gathered in investigating Mr A's grievance.It argued that if this information were to be disclosed, parties and witnesses in the future may not be as willing to be involved or to supply information. This would substantially prejudice the ability of the University to secure information relevant to the grievance decision, and would hinder staff in its Human Resources department from providing the guidance and support required by University managers.

84.As noted above, I have examined the University's Grievance Policy and Procedure and found that participants in any investigatory meetings are assured that what they say and the records of the meeting(s) will be kept confidential.Given this assurance, I accept that if the University were to disclose any evidence relating to a grievance, this would be likely to significantly undermine confidence in the confidentiality of the process, and to deter parties and witnesses in future grievance hearings from participating or from providing full and frank statements.I therefore accept that some of the information was correctly withheld from Mr A on the basis of the exemption in section 30(c).

85.However, after examining the information withheld under this exemption in section 30(c), I found that some of the information could be described as routine internal correspondence or administrative information.

86.Some of this information was generated in the course of the grievance procedure (for example, emails arranging meetings). I do not consider that such information is covered by the assurance of confidentiality in the Grievance Policy and Procedure, and I have not found any other reason why its disclosure would, or would be likely to, prejudice substantially the effective conduct of the University's affairs.In such cases I have not upheld the use of the exemption in section 30(c) of FOISA.

87.Some of the routine or administrative information was submitted to the grievance hearing as evidence to support a statement.Even though the information has no inherent sensitivity, the fact that it has been submitted as evidence within a grievance procedure brings it within the scope of the assurance of confidentiality in the Grievance Police and Procedure.In such cases, I have found that disclosure would or would be likely to undermine confidence in the confidentiality of the grievance procedure and so would or would be likely to prejudice substantially the effective conduct of the University's affairs.

88.I found that some documents contained professional advice from staff in the Human Resources department to academic colleagues, on matters relating to the grievance procedure.In some cases this advice clearly concerned sensitive and confidential matters.The University considers that if such guidance could not be made available to managers, this would have a paralysing effect on its day-to-day affairs.I accept that it is essential for such full and frank professional advice to be available within the University and that if staff were inhibited in providing such guidance for fear that it might later be disclosed, this would or would be likely to prejudice substantially the effective conduct of public affairs within the University.

Public interest

89.Section 30(c) is subject to the public interest test required by section 2(1)(b) of FOISA and I must therefore consider whether, in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the requested information.

90.Whilst it is recognised that there is a general public interest in making information available to the public and a general need for transparency and accountability in decision making, this must be balanced against any potential harm that could be caused by the release of such information, which in this case may include affecting the University's ability to investigate fully grievances brought by its staff.

91.The University has stated that it considered whether disclosure would enhance the scrutiny of its decision-making process and improve accountability.It took into consideration the fact that there appeared to be some concern about the handling of this case.

92.The University found that there was a very strong public interest in ensuring that all the parties involved in the grievance procedure can communicate freely so that the necessary information is available to ensure that the correct decision is taken and all angles are covered.The University acknowledged that the information withheld is of interest to Mr A himself but submitted that, on balance, the public interest would be better served by withholding the information.

93.I accept that it is in the public interest for the University to act in accordance with its published policies and procedures.I also accept that disclosure might permit enhanced scrutiny of the University's processes and procedures in relation to the investigation of Mr A's grievance.However, I have concluded that, on balance, the public interest lies in upholding the exemption in order to avoid substantial prejudice to the University's ability to conduct its affairs effectively.It seems to me that the public interest in protecting confidence in the confidentiality of the grievance procedure outweighs the public interest in disclosing information relating to a particular grievance.

Decision

I find that the University of Paisley (the University) partially complied with Part 1 of FOISA in withholding certain information under the exemptions in section 30(c), section 36(1), section 36(2), and section 38(1)(a) and (b).

I find that the University failed to comply with Part 1 of FOISA by wrongly applying the exemption in section 35(1)(g) in conjunction with 35(2)(b) and (d)(ii), and in withholding certain information under section 30(c), 36(1), 36(2), and 38(1)(b) of FOISA.

In order to comply with Part 1 of FOISA, I require the University to provide Mr A with the information indicated in Appendix 2 of this Decision Notice.

I am obliged to give the University at least 42 days in which to supply Mr A with the information as set out above. In this case, I require the University to take these steps within 45 days after the date of intimation of this decision notice.

Appeal

Should either Mr A or the University of Paisley wish to appeal this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
17 September 2007

APPENDIX 1

Relevant Statutory Provisions

Freedom of Information (Scotland) Act 2002:

1General entitlement

(1)A person who requests information from a Scottish public authority which holds is it entitled to be given it by the authority.

2Effect of exemptions

(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a)the provision does not confer absolute exemption; and

(b)in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2)For the purposes of paragraph (a) of subsection (1), the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

[?]

(c)section 36(2);

[?]

(e)in subsection (1) of section 38 ?

(i)paragraphs (a), (c) and (d); and

(ii)paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

30Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act ?

[?]

(c)would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

35Law enforcement

(1)Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially-

[?]

(g)the exercise by any public authority (within the meaning of the Freedom of Information Act 2000 (c.36)) or Scottish public authority of its functions for any of the purposes mentioned in subsection (2);

[?]

(2)The purposes are-

[?]

(b)to ascertain whether a person is responsible for conduct which is improper;

[?]

(d)to ascertain a person's fitness or competence in relation to-

[?]

(ii)any profession or other activity which the person is, or seeks to become, authorised to carry on

36Confidentiality

(1)Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information.

(2)Information is exempt information if-

(a) it was obtained by a Scottish public authority from another person (including another such authority); and

(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.

38Personal information

(1)Information is exempt information if it constitutes-

(a)personal data of which the applicant is the data subject;

(b)personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

[?]

(2)The first condition is ?

(a)in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene ?

(i)any of the data protection principles ?

(b)in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded

Data Protection Act 1998

1. Basic interpretative provisions

(1)In this Act, unless the context otherwise requires

[?]

"personal data" means data which relate to a living individual who can be identified-

(a)from those data, or

(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

[?]

(2) In this Act, unless the context otherwise requires-

(a)"obtaining" or "recording", in relation to personal data, includes obtaining or recording the information to be contained in the data, and

(b)"using" or "disclosing", in relation to personal data, includes using or disclosing the information contained in the data.

[?]

2.Sensitive personal data

In this Act "sensitive personal data" means personal data consisting of information as to-

(a)the racial or ethnic origin of the data subject,

(b)his political opinions,

(c)his religious beliefs or other beliefs of a similar nature,

(d)whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),

(e)his physical or mental health or condition,

(f)his sexual life,

(g)the commission or alleged commission by him of any offence, or

(h)any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

SCHEDULE 1

THE DATA PROTECTION PRINCIPLES

PART I

THE PRINCIPLES

1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-

(a)at least one of the conditions in Schedule 2 is met, and

(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2.Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

[?]

SCHEDULE 2

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF ANY PERSONAL DATA

[?]

6. -(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

SCHEDULE 3

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF SENSITIVE PERSONAL DATA

1.The data subject has given his explicit consent to the processing of the personal data.

2. - (1)The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

(2)The Secretary of State may by order-

(a)exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b)provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

3.The processing is necessary-

(a)in order to protect the vital interests of the data subject or another person, in a case where-

(i)consent cannot be given by or on behalf of the data subject, or

(ii)the data controller cannot reasonably be expected to obtain the consent of the data subject, or

(b)in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

4.The processing-

(a)is carried out in the course of its legitimate activities by any body or association which-

(i)is not established or conducted for profit, and

(ii)exists for political, philosophical, religious or trade-union purposes,

(b)is carried out with appropriate safeguards for the rights and freedoms of data subjects,

(c)relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and

(d)does not involve disclosure of the personal data to a third party without the consent of the data subject.

5.The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

6.The processing-

(a)is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b)is necessary for the purpose of obtaining legal advice, or

(c)is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

7. - (1)The processing is necessary-

(a)for the administration of justice,

(aa)for the exercise of any functions of either House of Parliament,

(b)for the exercise of any functions conferred on any person by or under an enactment, or

(c)for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

(2)The Secretary of State may by order-

(a)exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b)provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

8. - (1)The processing is necessary for medical purposes and is undertaken by-

(a)a health professional, or

(b)a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(2)In this paragraph "medical purposes" includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

9. - (1)The processing-

(a)is of sensitive personal data consisting of information as to racial or ethnic origin,

(b)is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

(c)is carried out with appropriate safeguards for the rights and freedoms of data subjects.

(2)The Secretary of State may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)(c) to be carried out with appropriate safeguards for the rights and freedoms of data subjects.

10.The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph.

Appendix 2 ? Schedule of documents

Appendix 2 is too long to attach to this web page - please see the pdf version of the Decision Notice for details of the decision regarding specific documents in this case.

---