Decision 166/2010 Mr Ian Bennie and Glasgow City Council
Parking Attendant badge numbers
Reference No: 201000850
Decision Date: 20 September 2010
Summary
Mr Bennie asked Glasgow City Council (the Council) to supply the badge number of the Parking Attendant responsible for issuing the Penalty Charge Notice in each of 12 listed cases.
The Council refused Mr Bennie's request, advising that the information was personal data and exempt from disclosure under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA).The Council upheld this decision after review and Mr Bennie subsequently applied to the Commissioner for a decision.
During the investigation the Council provided Mr Bennie with some information about the badge numbers in question.The Commissioner found that this information was sufficient for the purposes Mr Bennie had described, without requiring further disclosure of personal data.Accordingly, the Commissioner found that the Council was entitled to withhold the full information requested under section 38(1)(b) of FOISA, as its disclosure would, in the circumstances, breach the first data protection principle.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) section 1(1) and (6) (General entitlement); 2(1) (Effect of exemptions); 38(1)(b), and (2)(a)(i) and (b), (5) (Personal information).
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6).
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1.On 2 March 2010, Mr Bennie wrote to the Council to request the badge number of the Parking Attendant responsible for issuing the Penalty Charge Notice (PCN) in each of 12 cases which had been appealed for adjudication by the Scottish Parking Appeals Service (SPAS).In each case, the Council had lost the appeal.A list of the cases in question was attached.
2.On 10 March 2010, the Council wrote to advise Mr Bennie that the information he had asked for was personal data as defined in the DPA, and that disclosure would breach the data protection principles in Schedule 1 of the DPA.The information was therefore considered to be exempt from disclosure under section 38(1)(b) of FOISA.
3.On 17 March 2010, Mr Bennie wrote to the Council to seek a review of its decision not to comply with his request.
4.On 19 April 2010 [letter wrongly dated 19 February 2010], the Council informed Mr Bennie that, after review, it had upheld the decision to withhold the information he had asked for under section 38(1)(b) of FOISA.The Council provided details of its reasoning.
5.Mr Bennie remained dissatisfied with the Council's response and on 21 April 2010 wrote to the Commissioner applying for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Bennie had made a request for information to a Scottish public authority and had applied for a decision from the Commissioner only after asking the authority to review its response to that request.
Investigation
7.On 5 May 2010, the Council was notified in writing that an application had been received from Mr Bennie.The Council was asked to provide the Commissioner with the information withheld from Mr Bennie. This information was provided on 24 May 2010 and the case was then allocated to an investigating officer.
8.The investigating officer wrote to the Council on 31 May 2010 to invite its comments on Mr Bennie's application, as required by section 49(3)(a) of FOISA.The Council was asked to explain how disclosure of the Parking Attendant badge numbers would permit identification of the individuals involved, and also whether Parking Attendants would normally expect their names to be available to the public (for instance, whether they were required to give their names on request, or to display their badge numbers while at work).
9.The Council responded on 1 July 2010.Further comments were obtained from both the Council and Mr Bennie in the course of the investigation.
10.During the investigation the Council agreed that Mr Bennie should be informed that 10 individual attendants were involved in the 12 cases he had listed (rather than just one or two, as he had considered possible).Having received this information, he advised that he still required a decision from the Commissioner on his original information request.
11.The submissions received from both the Council and Mr Bennie, insofar as relevant, will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the information withheld and the submissions which have been presented to him and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) of FOISA
13.Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), exempts information if it is personal data and if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles laid down in Schedule 1 to the DPA.
14.This particular exemption is an absolute exemption, and so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
15.The Council withheld the 12 badge numbers requested by Mr Bennie on the grounds that this was personal data which, if disclosed, would breach the first data protection principle in Schedule 1 to the DPA; the Council therefore considered the information to be exempt from disclosure under section 38(1)(b) of FOISA.
Is the information personal data?
16.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (see the Appendix for the full definition).
17.The Council argued that because there were fewer than 100 Parking Attendants on the streets of Glasgow at any one time, it would be relatively easy to identify the attendant to whom a particular badge number related, given that badge numbers were displayed clearly on uniforms and remained with the relevant attendant as long as they were employed in that role.Mr Bennie queried whether the information he had asked for would permit identification of individual Parking Attendants, referring to the fact that that Parking Attendants displayed their badge numbers while on duty.
18.The Commissioner notes that Mr Bennie has not sought the names of the Parking Attendants, only their badge numbers.However, he accepts that disclosure of the badge numbers of the Parking Attendants responsible for the 12 PCNs would make it possible for Mr Bennie, or any other person receiving this information, to identify the individual attendants involved in the 12 appeal cases as they went about their duties in the streets of Glasgow.
19.In such circumstances, the name of the attendant would remain unknown unless the person observing them had access to other information, such as a list of Parking Attendants' names and badge numbers.The Council has not suggested that any such information is available to the public, and indeed has emphasised that Parking Attendants' names are not disclosed, for reasons relating to their health and safety.However, although the individual attendant's name would still be unknown, it would be possible for an observer to identify them as one of the attendants responsible for one or more of the 12 PCNs identified in Mr Bennie's list and overturned on appeal. In the circumstances, the Commissioner accepts that the information relates to those attendants.
20.The Commissioner therefore accepts that the badge numbers requested by Mr Bennie are the personal data of the Parking Attendants concerned.
Would disclosure of the information breach the first data protection principle?
21.The Council argued that disclosure of the information would breach the first data protection principle. The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met, and, in the case of sensitive personal data at least one of the conditions in Schedule 3 to the DPA is also met. In this case, processing would be by disclosure in response to Mr Bennie's information request.
22.The Commissioner is satisfied that the withheld information does not fall into any of the categories of sensitive personal data listed in section 2 of the DPA.
23.The Commissioner has first considered the application of the conditions in Schedule 2, and takes the view that only condition 6 could potentially be applicable in this instance.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.It is clear from the wording of this condition that each case will turn on its own facts and circumstances.
24.There are, therefore, a number of different tests which must be satisfied before condition 6(1) can be met. These are:
i)Does Mr Bennie have a legitimate interest in obtaining these personal data?
ii)If yes, is the disclosure necessary to achieve these legitimate aims?In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects (in this case, the Parking Attendants responsible for issuing the 12 PCNs listed in Mr Bennie's request)?
iii)Even if the processing is necessary for the legitimate purposes of Mr Bennie, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects? This will involve a balancing exercise between the legitimate interests of Mr Bennie and those of the data subjects. Only if (or to the extent that) the legitimate interests of the Mr Bennie outweigh those of the data subjects can the personal data be disclosed: there is no presumption in favour of disclosure.
25.The Council stated that it did not believe Mr Bennie had a legitimate interest in obtaining the personal data of the Parking Attendants.
26.Mr Bennie initially advised the Commissioner that he required the requested information for inclusion in an appeal case currently being processed by the SPAS.He believed there was a public interest in establishing whether one or two Parking Attendants were responsible for issuing PCNs which were found on appeal not to have been affixed to the vehicle.Having considered the reasons put forward by Mr Bennie, the Commissioner accepts that he had a legitimate interest in obtaining the information requested, in that it is conceivable that a pattern of the kind he alluded to might have been relevant to the outcome of the appeal.
27.As noted previously, during the investigation the Council agreed to disclose the fact that 10 Parking Attendants had been responsible for issuing the 12 PCNs identified by Mr Bennie.In the circumstances, the Commissioner is satisfied that this disclosure met the legitimate interest described in paragraph 26.Accordingly, the Commissioner is satisfied that the legitimate interest in question was capable of being met by the provision of information which interfered less with the privacy of the data subjects than the information requested.Therefore, he is not persuaded that disclosure of the badge numbers requested by Mr Bennie was necessary for the purposes of the legitimate interest identified in paragraph 26.
28.Following the disclosure referred to in paragraph 27 above, Mr Bennie was asked whether he still required disclosure of the badge numbers of the 12 Parking Attendants.In response, he explained that he was trying to establish whether any of the 10 Parking Attendants was responsible for issuing a particular PCN which was now the subject of an appeal to the SPAS.The Commissioner does not, however, accept this as giving rise to a legitimate interest: it may engage Mr Bennie's curiosity, but he has not demonstrated how, even if the Parking Attendant responsible for the PCN currently under appeal was shown to have been responsible for one (or at the most, two) of the 12 PCNs overturned previously on the same grounds, this information would have any material effect on the outcome of the appeal.
29.Mr Bennie also explained that he had become quite involved in appealing PCNs and believed that the badge numbers of the 10 Parking Attendants might be useful to reference should someone else request his assistance in future in a case where the PCN was thought not to have been actually affixed to the vehicle. This appears to the Commissioner to be a speculative interest in the information, which he could not accept as legitimate in the circumstances.
30.The Commissioner therefore finds that while Mr Bennie (to a certain extent, at least) had a legitimate interest in obtaining the information he had requested, disclosure of that information was not necessary to meet that interest.Having reached this conclusion, he must find that condition 6 in Schedule 2 to the DPA cannot be met: in the circumstances, he is not required to go on to consider the third test set out in paragraph 24 above.As condition 6 cannot be met, the Commissioner must conclude that disclosure of the requested information would breach the first data protection principle and therefore that the Council was correct to withhold that information under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that Glasgow City Council has complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Bennie.
Appeal
Should either Mr Bennie or Glasgow City Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
20 September 2010
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1General entitlement
(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6)This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
?
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
38Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1.Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a)at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1)The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
