Decision 172/2010 Paul Hutcheon of the Sunday Herald and the Scottish Ministers

Shareholdings of members of the Scottish Government's Strategic Board

Reference No: 201000770
Decision Date: 6 October 2010

Summary

Paul Hutcheon requested from the Scottish Ministers (the Ministers) all shareholdings declared and registered by each member of the Scottish Government's Management Group/Strategic Board.The Ministers responded by advising that the information was personal data, disclosure of which would breach the first data protection principle, and thus exempt from disclosure under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA).Following a review, Mr Hutcheon remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Ministers had dealt with Mr Hutcheon's request for information in accordance with Part 1 of FOISA, having applied the exemption in section 38(1)(b) of FOISA correctly. Accordingly, he did not require the Ministers to take any action.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), 2(a)(i) and (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal Information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data") and Schedules 1 (The data protection principles ? the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 16 January 2010, Mr Hutcheon, the Scottish Political Editor of the Sunday Herald newspaper, wrote to the Ministers requesting all shareholdings declared or registered by each member of the Management Group or Strategic Board since 2005, broken down by individual, the nature and value of the shareholding, and when each shareholding was declared or registered.

2.The Ministers responded on 10 February 2010. They stated that the information requested was not recorded prior to 1 April 2008, as no centralised system for the registration of interests was maintained before that date.In respect of information recorded after that date, the Ministers advised Mr Hutcheon that they considered the information to be personal data, exempt from disclosure in terms of section 38(1)(b) of FOISA.

3.On the same day, Mr Hutcheon wrote to the Ministers requesting a review of their decision. Mr Hutcheon believed that there was a public interest in releasing the information, and maintained that if the Scottish Government judged that such information should be registered internally, he could see no reason why it could not be published externally.He argued that transparency trumped the data protection arguments made by the Ministers.

4.The Ministers notified Mr Hutcheon of the outcome of their review on 7 April 2010.They upheld their previous decision to withhold the requested information, but provided further background information about the declaration and registering of shareholdings by senior civil servants, and the process of monitoring declarations and reporting any potential conflicts of interest.

5.On 13 April 2010, Mr Hutcheon wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr Hutcheon had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.The Ministers were notified in writing that an application had been received from Mr Hutcheonand their comments were invited on the application in terms of section 49(3)(a) of FOISA. The Ministers were asked to respond to specific questions and, in particular, to justify their reliance on any provisions of FOISA they considered applicable to the information requested.

8.The Ministers provided their submissions in response to this request on 15 June 2010.They subsequently provided further information and evidence in response to follow up questions from the investigating officer.

9.Mr Hutcheon was also asked for his submissions on the matters raised by this case, and he provided these on 30 June 2010.

10.Both parties' submissions are summarised below where relevant.

Commissioner's analysis and findings

11.In coming to a decision on this matter, the Commissioner has considered all of the submissions made to him by both Mr Hutcheon and the Ministers and is satisfied that no matter of relevance has been overlooked.

12.The Commissioner notes that the Scottish Government's Strategic Board replaced the Management Group after the Scottish Parliament elections held on May 3, 2007.Since information regarding shareholdings has only been gathered by the Ministers since April 2008, the withheld information discussed below relates only to the shareholdings of members of the Strategic Board after that date.

Section 38(1)(b) of FOISA ? personal information

13.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, section 38(2)(b)) exempts information from disclosure if it is "personal data", as defined by section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA. This particular exemption is an absolute exemption (see section 2(2)(e)(ii) of FOISA), and so is not subject to the public interest test laid down by section 2(1)(b) of FOISA.

14.In order for a public authority to rely on this exemption, it must show firstly that the information which has been requested is personal data for the purposes of the DPA and secondly that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.

15.The Ministers have submitted that the information withheld from Mr Hutcheon is personal data, disclosure of which would contravene the first data protection principle.

Is the information personal data?

16.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

17.The Commissioner accepts that the information requested by Mr Hutcheon (concerning the share dealings of members of the Scottish Government's Strategic Board) clearly relates to living individuals who can be identified from that information either alone or in conjunction with other information in possession of the Ministers.He is therefore satisfied that the information under consideration is personal data.

18.The Commissioner must go on to consider whether disclosure of this personal data would contravene the first data protection principle.

Would disclosure contravene the first data protection principle?

19.The Ministers argued that disclosure of the withheld information would breach the first data protection principle.

20.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.The processing under consideration in this case is disclosure of the personal data into the public domain in response to Mr Hutcheon's information request.

21.The Commissioner has considered the definition of sensitive personal data in section 2 of the DPA and is satisfied in this case that none of the personal data which has been withheld constitutes sensitive personal data.As a consequence, no Schedule 3 conditions require to be met in this case.

22.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 of the DPA be met?

23.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. If any of these conditions can be met, he will then go on to consider whether the disclosure of this personal data would otherwise be fair and lawful.

24.In their submissions, the Ministers asserted that, of the conditions set out in Schedule 2 to the DPA, only the sixth might potentially apply, but that they considered it was not met in this case.

25.The Ministers were asked by the investigating officer whether consent to disclosure of the information had been sought or received from the data subjects, since such consent would mean that condition 1 of Schedule 2 could be met.The Ministers' response indicated that the data subjects (i.e. the members of the Strategic Board) had been contacted to ascertain whether or not they would be willing to consent to the disclosure of the information.Consent was unanimously not given, the Ministers reported.

26.The investigating officer made further enquiries relating to the issue of consent, and sought copies of communications with the members of the Strategic Board regarding Mr Hutcheon's request.The information provided in response to these requests suggested that not every Strategic Board member had been asked for consent or (where asked) responded to this request.However, the Commissioner notes that those who were asked and responded declined to grant their consent to the disclosure of their personal data in response to Mr Hutcheon's request.The Commissioner notes also that some of the Strategic Board members raised concerns about the effect of disclosure on their families.

27.The Commissioner has therefore determined that condition 1 cannot be met in the circumstances of this case.He consequently agrees with the Ministers that condition 6 is the only condition which might potentially be applicable in this case.

28.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. the individuals to whom the data relate).

29.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

• Does Mr Hutcheon have a legitimate interest in obtaining the personal data?

• If yes, is the disclosure necessary to achieve these legitimate interests? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?

• Even if the processing is necessary for Mr Hutcheon's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the members of the Strategic Board?

• There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA. Accordingly, the legitimate interests of Mr Hutcheon must outweigh the rights and freedoms or legitimate interests of the members of the Strategic Board before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Mr Hutcheon.

Is there a legitimate interest?

30.Mr Hutcheon submitted that his legitimate interest in seeking the information under consideration was transparency.He argued that disclosure of the requested information in this case should be consistent with declaration of shareholdings by MSPs, quango board members, and chief executives of public bodies.Disclosure, he argued, would allow the public to judge the probity of the senior civil servants' decisions.

31.Mr Hutcheon emphasised the seniority of the civil servants in question in support of his argument, and he questioned whether having an in-house system for declaring shareholdings was fit for purpose.

32.The Ministers noted Mr Hutcheon's profession as a journalist and the comments he had made regarding the public interest in disclosure of the information under consideration in his request for review.They accepted that he has a legitimate interest in obtaining the information under consideration.

33.The Commissioner also accepts that Mr Hutcheon and the wider public have a legitimate interest in obtaining this information, which would allow public scrutiny of the interests and actions of individuals holding senior roles within the Scottish Government.

Is disclosure of the information necessary to achieve those legitimate interests?

34.The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so he must consider whether these interests might reasonably be met by any alternative means.

35.The Commissioner notes that the Ministers have explained to Mr Hutcheon the processes followed with respect to the registering of interests by senior civil servants, and for monitoring these and declaring any conflict of interests.However, this explanation would not enable Mr Hutcheon (or other members of the public) to consider the shareholdings of the individuals concerned or to satisfy themselves of the probity of any arrangements or decision-making in which they were involved.

36.In this case, the Commissioner can identify no viable means of meeting Mr Hutcheon's legitimate interests which would interfere less with the privacy of the relevant data subjects other than by obtaining the information requested.Therefore, he is satisfied that disclosure of the information is necessary for the purposes of the legitimate interest identified by Mr Hutcheon.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

37.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Mr Hutcheon and those of the senior civil servants in question. Only if the legitimate interests of Mr Hutcheon outweigh those of these civil servants can the information be disclosed without breaching the first data protection principle.

38.The Commissioner's guidance on the exemptions in section 38, identifies a number of factors which should be taken into account in carrying out this balancing exercise.These include:

whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

the potential harm or distress that may be caused by the disclosure;

whether the individual has objected to the disclosure;

the reasonable expectations of the individual as to whether the information would be disclosed.

39.The Ministers have argued that disclosure of the information under consideration is unwarranted.They noted that although the data subjects are members of the Senior Civil Service, they would have no expectation that the information relating to their personal and family finances, not related to Scottish Government functions, should be released into the public domain.

40.The Ministers argued that the information is clearly concerned with the data subjects' personal lives and the livelihoods of their families.They argued that the particular nature and sensitivity of the withheld information would cause unwarranted distress to both the members of the Management Group/Strategic Board and their families.

41.Mr Hutcheon disputed that there would be an intrusion into the civil servants' private lives if the information requested were made public.He argued that the fact that there was an internal process for registering, monitoring and reviewing shareholdings constituted an acknowledgement that this was not in fact a private issue.

42.The Commissioner has considered all of these comments.He is unable to accept Mr Hutcheon's assertion that the registration process entails that the individual share holdings in this case have ceased to be a private issue.A person's share holdings are an aspect of their personal finances, which would normally be expected to be a private matter for that individual and their family.

43.However, for individuals holding senior public office, there is a public interest in ensuring that personal financial arrangements, business interests or shareholdings do not create a conflict of interest.Arrangements for such individuals declaring interests are designed to ensure probity in public life and their existence and operation is therefore a matter of public interest.Notwithstanding this, the registering of their interests does not change the fact that a person's personal share dealings are an aspect of their private life rather than public life.

44.Although the information requested by Mr Hutcheon is clearly personal in nature, the fact that the individuals concerned hold senior positions is a relevant consideration when balancing the competing interests in this case.As the Commissioner has made clear in a number of decisions, individuals holding senior roles in public authorities should expect their remuneration to be subject to greater scrutiny than those employed in junior positions.A similar rationale might be applied with respect to the declaration of private interests.The more senior an employee is within a public authority, the more they should expect to demonstrate probity by disclosing private interests that could present a conflict of interest.

45.Mr Hutcheon has argued that the members of the Strategic Board/Management Group should be required to declare the same amount of information as MSPs or "quango" board members.In considering this point, the Commissioner reviewed the information published about declarations of interests by MSPs and board members of several non departmental public bodies (NDPBs), where the publication of declarations of interests is the norm.

46.The Commissioner noted that the level of detail provided about share-holdings in the published declarations of interests that he viewed varied considerably.He did not view any published declaration by a board member of an NDPB which indicated in detail the nature and the value of share holdings but he identified a number of declarations by MSPs which did.This suggests that the level of detail that a person expects to be made public about their interests will depend upon the arrangements of the organisation involved and the post they hold.

47.The Commissioner also recognises that the declaration and registration of interests will not always lead to publication of the interests declared.The particular arrangements made by the organisation, and the expectations this creates for those required to declare their interests, is therefore a relevant consideration.

48.In the case of the Strategic Board members, the Commissioner has noted that the process of registration of interests is a new one (established in 2008), which has to date proceeded on an internal basis, as a process through the Scottish Government's human resources system.

49.The Commissioner considers that these arrangements distinguish the circumstances of the data subjects in this case from those of MSPs or NDPB Board members.Whereas a person seeking election as a Councillor or MSP or appointment to the board of an NDPB will do so knowing that a public declaration of interests is the norm for holders of these roles, the individuals in this case would not have provided their declarations in the expectation that the details would be publicly disclosed.

50.The Commissioner accepts that the data subjects in this case would have no expectation that the information supplied regarding their share holdings would be made known in response to a request for information under FOISA.The responses from the Strategic Board members when consulted about Mr Hutcheon's request reinforce this point.

51.The Commissioner accepts that the disclosure of the information requested by Mr Hutcheon would be a significant intrusion into the private lives of the individuals concerned, and their families.The Commissioner considers that this is particularly so given the level of detail regarding share holdings that has been requested by Mr Hutcheon.

52.Overall, the Commissioner accepts that there is weight to Mr Hutcheon's arguments regarding the transparency, since disclosure would allow fuller scrutiny of the probity of individuals holding senior roles within the Scottish Government than is possible within the current system of internal registration and monitoring of interests.However, having conducted the required balancing exercise, he has concluded that the legitimate interests identified by Mr Hutcheon are outweighed legitimate interests of the data subjects in this case. He must therefore conclude that condition 6 is not met.

53.Since no condition within schedule 2 of the DPA has been met in this case, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure and so the information under consideration was properly withheld by the Ministers under section 38(1)(b) of FOISA.

DECISION

The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Paul Hutcheon.

Appeal

Should either Mr Hutcheon or the Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
6 October 2010

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

...

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

 

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

1.The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?