Decision 180/2019: Remuneration and expenses of Justices of the Peace
Public authority: Scottish Courts and Tribunals Service
Case Ref: 201901255
Summary
The SCTS was asked for expenses and other allowances claimed by Justices of the Peace (JPs). The SCTS provided annual totals for each financial year, but withheld the amount claimed by each individual JP.
The Commissioner investigated and agreed that the amount claimed by each individual JP was exempt from disclosure.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "the GDPR", "personal data" and "processing") and (5A) (Personal information)
General Data Protection Regulation (the GDPR) Articles 4(1) and (11) (Definition of "personal data" and "consent") (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(a) and (f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 29 May 2019, the Applicant asked the Scottish Courts and Tribunals Service (the SCTS) for the expenses and other allowance, salary and funds claimed by Justices of the Peace (JPs) and their identities for the last two financial years.
2. The SCTS responded on 26 June 2019 and provided total expense figures (broken down by categories including appraisal, training and committee costs) per financial year alongside the names of current JPs in Scotland.
3. On the same day, the Applicant wrote to the SCTS requesting a review of its decision on the basis that he sought the expense claims for individual JPs and not the annual totals.
4. The SCTS notified the Applicant of the outcome of its review on 24 July 2019. The SCTS withheld individual JP expenses under section 38(1)(b) of FOISA (Personal information), on the basis that disclosure would be unfair to the people concerned.
5. On 26 July 2019, the Applicant wrote to the Commissioner. The Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA. The Applicant was dissatisfied with the outcome of SCTS's review because he believed that, as members of the judiciary, individual JP expenses should be disclosed by the SCTS.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The SCTS was invited to comment on this application and to answer specific questions. These related to its reasons for withholding individual expenses.
8. The Applicant was asked for, and provided comments as to, his legitimate interests in the withheld information.
Commissioner's analysis and findings
9. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to him by both the Applicant and the SCTS. He is satisfied that no matter of relevance has been overlooked.
10. The Applicant sought expenses for individual JPs. The SCTS withheld this information on the basis that section 38(1)(b) of FOISA applied. The Commissioner must decide whether the SCTS was correct to withhold the detailed expenses of each JP.
The Applicant's submissions
11. The Applicant submitted that the SCTS misapplied the exemption to the information. The Applicant referred to investigative reports in the media about expenses for travel by JPs that had led the then Lord President to issue guidance on travel claims and expenses for all members of the judiciary. The Applicant provided detail on such expense-based stories with a view to establishing the need for publication of expenses for JPs.
12. The Applicant argued that, as other members of the judiciary, and a wide range of public officials, including STCS staff and board members, have their expenses interests published or disclosed in response to requests, that the information sought on JP expenses should also be disclosed.
Section 38(1)(b) - Personal information
13. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR or (where relevant ) in the DPA 2018.
14. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
15. To rely on this exemption, the SCTS must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.
Is the information personal data?
16. The first question for the Commissioner is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 - see Appendix 1. (This definition reflects the definition of personal data in Article 4(1) of the GDPR, also set out in Appendix 1.)
17. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus. The SCTS said that the expenses show the total claimed by each individual JP and constitute personal data as living individuals are able to be identified from that information. Furthermore, SCTS explained that, by virtue of their voluntary role, JPs are able to claim for loss of earnings and the information is indicative of their personal circumstances, e.g. whether they are employed or the distance travelled from their home address.
18. The Commissioner is satisfied that the withheld information is personal data: it relates to identifiable living individuals and it is clear that the name of a person in connection with their expenses clearly relates to each individual as a living person. The Commissioner accepts that the information is personal data as defined in section 3(2) of the DPA 2018. (The Applicant did not suggest that the information was not personal data.)
Would disclosure contravene one of the data protection principles?
19. The SCTS submitted that it would be unfair to disclose the information as disclosure would breach the first data principle in Article 5(1) of the GDPR.
20. Article 5(1)(a) of the GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."
21. In terms of section 3(4)(d) of the DPA 2018, disclosure is a form of processing. In the case of FOISA, personal data is processed when it is disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the GDPR) and fair.
22. The Commissioner considers conditions (a) and (f) in Article 6(1) are the only conditions which could potentially apply in the circumstances of this case.
Condition (a): consent
23. Condition (a) states that processing will be lawful if the data subject has given consent to the processing of the data for one or more specific purposes. "Consent" is defined in Article 4 of the GDPR as:
"… any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".
24. The SCTS confirmed that the individuals had not given consent for disclosure.
25. The Commissioner is satisfied that, in the absence of consent, condition (a) cannot be met. The Commissioner is satisfied that there was no requirement on the SCTS to seek consent to disclose. In the absence of consent, condition (a) could not be met.
Condition (f): legitimate interests
26. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data …."
27. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
28. The tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the JPs?
Does the Applicant have a legitimate interest in obtaining the personal data?
29. The Applicant submitted that the information related to public funds and there was an expectation that expense claims of any person holding a public office should be disclosed and open to public scrutiny. The Applicant's expressed legitimate interest is the scrutiny of public spending on JPs, in terms of their expenses.
30. The SCTS recognised that the Applicant did have a legitimate interest in the information.
31. The Commissioner accepts that the Applicant has (and, indeed, the wider public would have) a legitimate interest in disclosure of the personal data. The information requested would allow the Applicant, and the wider public, to see the expenses claimed by each individual JP. This would show the individual totals of allowances and expenses paid to JPs for two years and would increase transparency and accountability in relation to the expenditure of public funds.
Is disclosure of the personal data necessary?
32. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of the personal data is necessary for the Applicant's legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
33. The Commissioner has considered this carefully in the light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[1]. In this case, the Supreme Court stated (at paragraph 27):
"… A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less."
34. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
35. The SCTS disclosed annual total expenses of JPs to the Applicant. The Commissioner recognises that this goes some way towards satisfying the Applicant's legitimate interests.
36. The SCTS argued that the provision of individual expense claims would not provide a closer scrutiny of the processing of claims. The SCTS believed that the process for claiming and approving expenses would provide more meaningful information as to the checks and measures to ensure the appropriate allocation of funds.
37. The Commissioner acknowledges merit in the SCTS's arguments. The information supplied by the SCTS to him - explaining the processing of claims - does indicate a system whereby the authority scrutinises the use of public money for the expenses of JPs. However, the question remains whether the SCTS could meet the legitimate aim of transparency and accountability in the spending of public funds without disclosing the personal details of individual JPs.
38. In the circumstances, the Commissioner accepts that disclosure of the expenses claimed, by individual JP, is necessary to meet the Applicant's legitimate interests. The information would provide the Applicant and the wider public with an array of detail that the totals already supplied and information about the processes would not. Such disclosure would increase transparency and accountability.
Interests or fundamental rights and freedoms of the data subjects
39. It is necessary to balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subjects would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
40. The Commissioner's guidance on section 38 of FOISA[2] notes factors that should be taken into account in balancing the interests of parties. He makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
(i) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
(ii) the potential harm or distress that may be caused by the disclosure
(iii) whether the individual objected to the disclosure
41. In considering the balance between the legitimate interests and the rights and interests of the data subjects, it is important to take account of whether the proposed disclosure would be within the reasonable expectations of the individuals. In doing so, there are factors that assist determining the expectations of an individual in respect of their person data. These include the distinction between private and public life; the nature of the information; how the personal data were obtained; whether any specific assurances were given to the individuals; Privacy notices; and any policy or standard practice of the authority.
42. The Commissioner accepts that, to some degree, the personal data under consideration relates to the individuals' private lives, in that the individuals incurred the expenses by undertaking public service in a voluntary capacity.
43. Although there are no absolute rules in this regard, generally, information which relates to an individual's private life (i.e. their home, family, social life or finances) will deserve greater protection than information about the individual acting in an official or work capacity (i.e. their public life). The Commissioner also accepts that, although the JPs are volunteers, they carry with that role important public responsibilities. The personal data in question therefore cannot be regarded as relating solely to the individual's private life.
44. While there are valid grounds for collecting and using the personal data to process claims made by JPs in relation to their acting in that role, the SCTS considered it would be unfair to process their data by disclosing it, as they (the individual JPs) would not reasonably expect their data to be shared in this way.
45. The SCTS emphasised that, by virtue of their voluntary role, JPs who are employed are able to claim for loss of earnings, unlike those members of the judiciary in a salaried position. To disclose the individual totals without explanation as to variations could lead to the interpretation of the data such a way as to result in unfavourable comparisons - with the potential to cause distress or damage in terms of reputation and thus prejudice the rights and freedoms of the data subjects (the individual JPs). This potential damage or distress could not be addressed without revealing more personal data about a JP's personal life.
46. The SCTS submitted that disclosure of expenses may discourage persons from becoming JPs, or may cause harm or distress if comparisons in expenditure were made between JPs. This second aspect is relevant to section 38. An authority should consider what potential harm or distress disclosure may cause the data subject.
47. The SCTS explained that the specification of individual totals will show variations in amounts claimed. The SCTS submitted that this alone does not provide any confirmation as to the proper authorisation or use of public funds; rather it is indicative of the personal circumstances of the JPs.
48. The SCTS argued that disclosure of the individual totals without any explanations as to the variations could lead to the interpretation of the data in such a way as to result in unfavourable comparisons with the potential to cause distress or damage in terms of reputation and thus prejudice the rights and freedoms of the data subjects.
49. The Commissioner has considered the request for individual expenses carefully and is cognisant of the fact that authorities should be accountable for their expenditure, and demonstrate that checks and balances are in place to ensure such expenditure is valid and justifiable.
50. The SCTS supplied the Commissioner with an example expenses claim form used by JPs, which detailed the maximum amounts able to be claimed, the required information on dates, mileage/distance, etc. to be completed and signed by the claimant, and which also required confirmation of attendance and authorisation by SCTS staff. Guidance for completion of this form was also provided, as were guidance notes/job instructions in relation to the paying of JP expenses. The SCTS also provided a link to its website[3] where a person could view the SCTS's Annual Accounts.
51. The Commissioner notes that there appears to be sufficient procedures in place to ensure adequate scrutiny of the expenses of the volunteers. He does not find that disclosure of the personal data in question would be required in order to be satisfied on this point.
52. The Commissioner has also considered the fact that the JPs are volunteers, and that, accordingly, the individuals may have had no expectation that their personal data would be disclosed. In this regard, he is satisfied that a clear distinction can be made between volunteers and other salaried members of the judiciary.
53. The Commissioner concludes that, in these circumstances, disclosure would have a detrimental effect on the data subjects. He is also satisfied that unfavourable and unjustifiable comparisons could be drawn from the information which may cause a degree of distress to the JPs concerned.
54. The Commissioner has balanced this with the Applicant's legitimate interest in seeking accountability and transparency. The Commissioner notes that the SCTS has provided the annual total expenses of JPs, broken down by certain categories. The SCTS has also provided the Commissioner with details of its processes for verification of claims.
55. Having carefully balancing the legitimate interests of the individuals concerned against those of the Applicant, the Commissioner finds that the legitimate interests served by disclosure of the withheld personal data are outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subjects. Condition (f) in Article 6(1) of the GDPR cannot, therefore, be met in relation to the withheld personal data.
56. In the absence of a condition in Article 6 of the GDPR allowing the personal data to be disclosed, the Commissioner has concluded that disclosing the information would be unlawful.
Fairness
57. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider separately whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subjects.
Conclusion on the data protection principles
58. For the reasons set out above, the Commissioner is satisfied that disclosure of the personal data would breach the data protection principle in Article 5(1)(a) of the GDPR. Consequently, he is satisfied that the personal data are exempt from disclosure under section 38(1)(b) of FOISA.
Decision
The Commissioner finds that the Scottish Courts and Tribunals Service complied fully with Part 1 of the Freedom of Information (Scotland) Act 2002 in withholding the personal data requested.
Appeal
Should either the Applicant or the SCTS wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
17 December 2019
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);
…
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
General Data Protection Regulation
Article 4 Definitions
For the purposes of this Regulation:
1 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
…
11 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
…
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available.
…
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
…
(10) "The GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
…
[1] http://www.bailii.org/uk/cases/UKSC/2013/55.html
[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
[3] http://www.scotcourts.gov.uk/docs/default-source/aboutscs/reports-and-data/publications/scts-annual-report-accounts-2018-19.pdf?sfvrsn=2
