Decision 176/2017: Mr S and South Lanarkshire Council Allocation of Council housing Reference No: 201701150 Decision Date: 18 October 2017 Summary The Council was asked for information about the allocation of council houses in a specific village. The Council disclosed some information, but withheld information which it considered to be personal data and exempt from disclosure. The Commissioner accepted that that the withheld information was personal data and was correctly withheld.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 19 April 2017, Mr S made a request for information to South Lanarkshire Council (the Council). Amongst other requests not the subject of this decision, he asked for:

(i) the date at which people who had been accommodated in a specified village since 12 October 2012 had been added to the housing waiting list; and

(ii) the total value of points which those who had been accommodated had at the time when they were offered suitable accommodation.

2. The Council responded on 18 May 2017. It provided information relating to other parts of Mr S' request, but withheld information relating to the requests described above. The Council considered it was personal information and disclosure would breach the data protection principles in the DPA. The information was therefore exempt from disclosure under section 38(1)(b) of FOISA.

3. On 23 May 2017, Mr S emailed the Council requesting a review of its decision. He explained that he required the information to decide whether to make a formal complaint to the local government ombudsman (the Scottish Public Services Ombudsman) about the allocation of council housing. He considered that disclosure of the two sets of numbers would not breach the individuals' privacy.

4. The Council notified Mr S of the outcome of its review on 21 June 2017. It provided further explanation why it considered the withheld information to be personal data exempt from disclosure under section 38(1)(b) of FOISA.

5. On 30 June 2017, Mr S applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr S was dissatisfied with the outcome of the Council's review. He reiterated the points he had made in his request for review, and stated that the withheld information would be crucial to advancing his position with the Council.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr S made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 19 July 2017, the Council was notified in writing that Mr S had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr S. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions, with reference to the risk of individuals being identified from the withheld information and other aspects of the application of section 38(1)(b) of FOISA. It responded on 11 August 2017.

9. Mr S was asked for, and provided, further comments on his legitimate interest in the personal data.

10. The Council later provided further comments as to how an individual could be identified by the wider population, if the withheld information was disclosed.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr S and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - Personal information

12. The Council relied on section 38(1)(b) to withhold the information about the housing allocations.

13. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

14. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

15. In order to rely on this exemption, the Council must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA. The Council considered disclosure of the information would breach the first data protection principle.

Is the withheld information personal data?

16. For this exemption to apply, the withheld information must fall within the definition of "personal data" contained in section 1(1) of the DPA. The full definition is set out in Appendix 1, but it applies to data relating to a living individual who can be identified from either (a) the data themselves or (b) those data and other information which is in the possession of, or is likely to come into the possession of, the data controller.

17. In his correspondence with the Council, and application to the Commissioner, Mr S emphasised that he was not seeking any personal identifying information and he just wanted to know the number of points that had been allocated to the individuals who had recently been accommodated in the specified Council housing and how it compared to his case.

18. In its submissions to the Commissioner, the Council referred to the case of Common Services Agency v Scottish Information Commissioner [2008] ([2008] UKHL 47[1] (the CSA case). Specifically, the Council drew attention to paragraphs 22 and 26 of that judgment, which relate to the data controller's duty to comply with the data protection principles in relation to the processing of personal data.

19. The Council submitted that in line with the above judgement, the issue was whether the data subjects (i.e. the people who had been allocated the Council houses) could be identified by the Council, from information in the hands of the Council, as data controller. It submitted that as it could clearly identify the individuals from their records and suggested that the requirement in relation to identification by the data controller was met.

20. The Council stated that there was one exception to the issue of identification by the recipient and this relates to statistical information. It referred to the Housing Associations decision (Decision 014/2009[2]) where the Commissioner concluded that the number of individuals within certain postcode areas was not personal data. The Council argued that the information under consideration was not statistical data, noting that it had disclosed statistical data covered by other parts of Mr S' request. (The Commissioner accepts that the information is not statistical data.)

21. The Council considered that the withheld information identified individuals, and also related to them. It was therefore the personal data of those individuals.

22. The Council was asked to explain how disclosure of the withheld information would permit identification of an individual by the wider public, rather than by the Council in its role as data controller.

23. The Council submitted that the following factors would enable a recipient, such as an investigative reporter, to identify the individuals to whom the withheld information related:

· The village concerned has a relatively small population. (The Council provided the figure, which included people living in the surrounding area.)

· In the village, the Council has a low number of Council houses.

· During the period specified by Mr S, the Council let a small number of houses in total to new tenants (the Council told the Commissioner the actual number) and of those lets, the requested information relates to two of them.

24. The Council stated that the combination of these factors makes it highly likely that the individuals concerned could be identified by a determined individual, so the information, if released to the public, would amount to their personal data.

The Commissioner's view

25. The Commissioner has considered whether there would be a realistic prospect of individuals being identified if the Council was to disclose the information requested by Mr S.

26. In reaching a decision on this point, the Commissioner has taken account of the guidance from the (UK) Information Commissioner (the ICO), who regulates the DPA throughout the UK. The ICO has issued the following guidance on determining what is personal data[3]:

"When considering identifiability it should be assumed that you are not looking just at the means reasonably likely to be used by the ordinary man in the street, but also the means that are likely to be used by a determined person with a particular reason to want to identify individuals."

27. In relation to the question of identifiability of the data subject(s), it is recognised that a public authority (and the Commissioner) must consider the effects of disclosure in terms of the wider population: the data controller referred to in part (b) of the definition of personal data in section 1 of the DPA is not just the public authority, but the public to whom the data are disclosed.

28. This issue was considered in more detail in the judgement of the Court of Justice of the European Union in Breyer v Bundesrepublik Deutschland[4]. In this case the Court said that the correct test to consider is whether there is a realistic prospect of someone being identified. In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is "insignificant", the information will not be personal data.

29. In this case, the Commissioner is satisfied that because of the small numbers involved (i.e. the number of individuals who fall within scope of Mr S' request; the population of the village concerned; the number of Council houses available and allocated recently), it is likely that an individual could be identified, if the withheld information was disclosed. He does not consider there to be any reasonably practicable means of anonymising any of the information.

30. In all the circumstances, therefore, the Commissioner is satisfied that all the withheld information relates to living individuals, who can be identified from that information taken with other information readily accessible to a reasonable number of people, at least. Taking account of all of the above, he is satisfied that this means the information falls within the second part of the definition of "personal data" contained in section 1(1) of the DPA. Clearly, information impacting so directly on the private lives of the individuals concerned must be deemed to relate to those individuals.

31. The Commissioner is also satisfied that, in the circumstances, the information cannot practicably be anonymised to allow disclosure.

Would disclosure contravene the first data protection principle?

32. The Council submitted that disclosure of the withheld personal data would breach the first data protection principle: therefore, the information was exempt under section 38(1)(b) of FOISA.

33. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. The processing in this case would be making the information publicly available in response to Mr S' request.

34. In the case of sensitive personal data (as defined by section 2 of the DPA), at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for him to consider the conditions in Schedule 3.

Can any of the conditions in Schedule 2 be met?

35. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the CSA case that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).

36. It appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the personal data to Mr S. In any event, neither Mr S nor the Council have suggested that any other condition would be relevant.

37. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

38. There are a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Does Mr S have a legitimate interest or interests in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr S' legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?

39. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Mr S must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr S.

Does Mr S have a legitimate interest in obtaining the personal data?

40. There is no definition in the DPA of what constitutes a "legitimate interest." The Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance on section 38 of FOISA[5] states:

In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

41. Mr S explained that the withheld information would allow him to carry out a comparison with his own situation. He considered that the Council had erred in its allocation of the houses. He believed that until he knew the number of points held by the individuals and when a housing offer was made, he would be unable to challenge the Council's decision.

42. The Council accepted that the reasons provided by Mr S amounted to a legitimate interest in the withheld personal data.

43. The Commissioner agrees that Mr S has a legitimate interest in information which would enable him to understand the housing allocation decisions by the Council. Mr S has clearly explained his legitimate interest in the withheld personal data, and made it clear that he wants to challenge the housing allocation decision.

Is the processing necessary for the purposes of these interests?

44. In reaching a decision on this, the Commissioner must consider whether these interests might reasonably be met by any alternative means.

45. The Council stated that information about what happened in other cases would not advance the purpose identified by Mr S or change the outcome of the decision. The Council did not consider disclosure would be necessary to fulfil his legitimate interests.

46. Having considered all relevant arguments carefully, the Commissioner accepts that, to some extent, disclosure of the information is necessary in order to fulfil Mr S' legitimate interests. It may not be necessary in order for him to receive the information in order to challenge the decision in relation to his own situation. However, the Commissioner is satisfied that the withheld personal data would provide Mr S with factual information which was relevant to the Council's decisions on the housing allocations, which would be likely to add to his understanding of the process even if it is insufficient to allow him to draw firm conclusions about the fairness of the housing allocation decisions in relation to his own case.

47. The Commissioner finds that, in the circumstances of this case, Mr S' legitimate interests could not reasonably be met by alternative means. He is satisfied that disclosure of the personal data is necessary to meet Mr S' legitimate interests.

Would disclosure cause unwarranted prejudice to the legitimate interest of the data subjects?

48. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr S' legitimate interests, he is now required to consider whether that disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Mr S and those of the data subjects. Only if the legitimate interests of Mr S outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

49. The Commissioner must approach this balancing exercise on the basis that disclosure under FOISA is disclosure to the world at large and not simply to Mr S. He has accepted that the information is the personal data of the individuals concerned and that it cannot practicably be anonymised.

50. The Council did not provide any specific arguments as to the rights, freedoms and legitimate interests of the data subjects. In reaching a decision on this matter, the Commissioner has concluded that the information is private to the data subjects, and disclosure would impinge on their right to private and family life. The number of housing points accumulated by an individual may relate to their private circumstances, including mental and physical conditions. Although not sensitive personal data (as defined by the DPA), such information requires extra care in its handling. Information about the date on which the housing offer was made is perhaps less sensitive, but it still relates to the private life of the tenant.

51. The Commissioner concludes that, in all the circumstances, the data subjects had a reasonable expectation that the information which was their personal data would remain private.

52. Having balanced the legitimate interests of the data subjects against those of Mr S, the Commissioner finds that any legitimate interests served by disclosure of the withheld personal data would not outweigh the unwarranted prejudice that would result in this case to the rights and freedoms or legitimate interests of the individuals in question. In the circumstances of this particular case, the Commissioner concludes that condition 6 in Schedule 2 to the DPA cannot be met in relation to the withheld personal data.

53. Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interest of the data subjects, as described above, the Commissioner must also conclude that its disclosure would be unfair. As no condition in Schedule 2 to the DPA can be met, he must regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information and that this information was properly withheld under section 38(1)(b) of FOISA.

Decision The Commissioner finds that the Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr S.

Appeal

Should either Mr S or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

18 October 2017

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---