|
Decision 181/2011 Mr Paul Hutcheon and the Scottish Ministers
Departure of employee
Reference No: 201100555
Decision Date: 5 September 2011 |
Summary
Mr Hutcheon requested from the Scottish Ministers (the Ministers) information about a named ex-employee and his departure from employment with the Ministers.The Ministers responded by providing some information, but withholding the remainder under section 38(1)(b) of FOISA. Following a review, Mr Hutcheon remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Ministers had dealt with Mr Hutcheon's request for information in accordance with Part 1 of FOISA, finding that the information was personal data, the disclosure of which would breach the first data protection principle (and therefore section 38(1)(b) applied).The Commissioner did not require the Ministers to take any action.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions) and 38(1)(b), 2(a)(i), (2) (b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision.The Appendix forms part of this decision.
Background
1.On 19 January 2011, Mr Hutcheon wrote to the Ministers requesting the following information:
a.all files and correspondence on the departure of a named ex-employee from the Scottish Government;
b.all files and correspondence on the suspension of the named ex-employee when he was employed by the Scottish Government;
c.on what date did that a named ex-employee stop being an employee in the Scottish Government?
2.The Ministers responded on 14 February 2011.To questions i and ii, they responded that the files and correspondence related to the employment of a civil servant fell within the exemption of section 38(1)(b) of FOISA.The Ministers stated that disclosure of this information, which it considered to be personal data as defined by section 1(1) of the DPA, would contravene the first data protection principle as the processing would not be fair and lawful due to the sensitive and private nature of the information.The Ministers explained that they had taken account of Mr Hutcheon's legitimate interest in obtaining this information, but considered that it was outweighed by the ex-employee's legitimate interest in keeping private details of his employment.In relation to question iii, the Ministers advised that by the ex-employee's employment with the Scottish Government had ended on 12 October 2010.
3.On 14 February 2011, Mr Hutcheon wrote to the Ministers requesting a review of their decision.He drew the Ministers' attention to his view that the exemption had been wrongly applied, considering the by the ex-employee's suspension and subsequent departure to be a matter of wider public concern.Mr Hutcheon asked that each file and piece of correspondence be assessed.
4.The Ministers notified Mr Hutcheon of the outcome of their review on 14 March 2011.They upheld their original response that the information requested was exempt in terms of section 38(1)(b) of FOISA.The Ministers explained that the information was personal data as defined by section 1(1) of the DPA; that the data subject had not given consent to the release of the information; that the data subject could reasonably have expected the information requested to be kept private, and that release of the information might cause the data subject personal distress.Finally, the Ministers stated that in their view there was nothing in the information of legitimate public interest.
5.On 29 March 2011, Mr Hutcheon wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Hutcheon had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 29 March 2011, the Ministers were notified in writing that an application had been received from Mr Hutcheon and were asked to provide the Commissioner with any information withheld from him. The Ministers responded with the information requested and the case was allocated to an investigating officer.
8.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions.In particular, the Ministers were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested, with particular reference to the requirements of section 38(1)(b).
9.During the investigation, Mr Hutcheon confirmed that he was not concerned with certain items of information which fell within the scope of the requests and had been withheld, specifically Scottish Government policies and information from articles he had written.Accordingly, the Commissioner's decision will not address whether the Ministers responded correctly in terms of FOISA in respect of that information.
10.The relevant submissions received from both Mr Hutcheon and the Ministers will be considered further in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
11.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Hutcheon and the Ministers and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) ? personal data
12.The Ministers withheld the information in terms of section 38(1)(b) of FOISA, on the basis that disclosure would breach the first data protection principle.
13.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.
14.The Ministers also submitted that the information was exempt from disclosure under section 38(1)(b), as read with section 38(2)(a)(ii) of FOISA.This exemption applies to personal data where disclosure would contravene section 10 of the DPA (right to prevent processing likely to cause damage or distress).
15.In considering the application of this exemption, the Commissioner will firstly consider whether the information is personal data as defined in section 1(1) of the DPA and, if it is, whether disclosure would breach the first data protection principle, and then (if required) whether disclosure would contravene section 10 of the DPA.
Is the information under consideration personal data?
16."Personal data" are defined by in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller..." (the full definition is in the Appendix).
17.The withheld information directly relates to the employment situation of a clearly identified individual (namely the ex-employee).The Commissioner has considered the withheld information and is satisfied that all of it falls within the definition of personal data.All of the information clearly relates to the ex-employee, who can be identified from it.Some of it can also be described as the personal data of other Scottish Government employees.
18.In the circumstances, the Commissioner acknowledges that it is not possible to anonymise the data in any meaningful way.
19.The Commissioner will go on to consider whether disclosure of the information would breach the first data protection principle.
The first data protection principle
20.The first data protection principle states that personal data shall be processed fairly and lawfully.It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 of the DPA is also met.
21.In the circumstances of this particular case, the Commissioner finds it appropriate to consider first whether there are any Schedule 2 conditions which would permit disclosure of the withheld personal data.Only if he is satisfied that there are will he go on to consider whether any of the withheld information is sensitive personal data, and if so whether there are any applicable Schedule 3 conditions.
22.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
23.The Commissioner considers that only condition 6 in Schedule 2 might be considered to apply in this case.Condition 6 allows personal data to be processed (in this case, disclosed in response to Mr Hutcheon's information request) if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
24.There are a number of tests which must be met before condition 6(1) can apply. These are:
Does Mr Hutcheon have a legitimate interest in obtaining this personal data?
If so, is the disclosure necessary to achieve those legitimate aims?In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects (i.e. the individuals to whom the data relate)?
Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?As noted by Lord Hope (above), there is no presumption in favour of the release of personal data under the general obligation laid down in FOISA.Accordingly, the legitimate interests of Mr Hutcheon must outweigh the rights, freedoms or legitimate interests of the data subject before condition 6(1) will permit the personal data to be disclosed.If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Mr Hutcheon.
Does Mr Hutcheon have a legitimate interest?
25.Mr Hutcheon was asked to comment on his legitimate interest in obtaining the personal data. He submitted that the former employee had been involved in a controversy while in post that involved public money, and had later been suspended prior to leaving the Scottish Government, matters in which the public had a legitimate interest.
26.Having considered these submissions, together with the withheld personal data, the Commissioner is satisfied that Mr Hutcheon does have has a legitimate interest in those data, at least to the extent that disclosure would contribute to public scrutiny of the matters he refers to.He is prepared to accept that the data, or at least elements of them, would be capable of doing this.
Is disclosure of the information necessary to achieve these legitimate interests?
27.The Commissioner must now consider whether disclosure of the withheld personal data is necessary for the legitimate interests identified above and in doing so he must consider whether these interests might reasonably be met by any alternative means.
28.In this case, the Commissioner can identify no viable means of meeting Mr Hutcheon's legitimate interests which would interfere less with the privacy of the relevant data subjects than the provision of the relevant elements of the withheld personal data.The legitimate interest is in scrutiny of the actions of the Ministers, as evidenced by elements of the withheld personal data.In the circumstances, the Commissioner is satisfied that disclosure of those personal data is necessary to meet the legitimate interests in question.
Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
29.The Ministers believed release of this information would cause significant distress to the ex-employee, given its nature and sensitivity.In the circumstances, they did not consider that he would be in a position to challenge any assertions that might arise from its publication.Taking account of the ex-employee's legitimate expectations as data subject, the Ministers argued that their obligations as data controllers, alongside article 8 of the European Convention on Human Rights and the general law of confidentiality, should take precedence over any possible interest in disclosure held by Mr Hutcheon.
30.The Commissioner has considered these arguments carefully.He has also taken into account the guidance[2] on this point in his own briefing on the section 38 exemption, which identifies relevant factors as including:
whether the information relates to the individual's public or private life
the potential harm or distress that may be caused by disclosure
whether the individual has objected to disclosure
the reasonable expectations of the individual as to whether their information would be disclosed.
31.That the information does relate to public life (in the sense that it relates to the individuals' performance of their duties as public officials) is relevant and adds weight to the arguments for disclosing the information.It is also the case that the more senior the employee, the greater the likelihood that they will be responsible for making influential policy decisions or decisions involving the expenditure of significant amounts of public funds. Therefore, in broad terms, it becomes less likely that exposure of a senior employee's actions to a higher level of public scrutiny would be unwarranted or unfair (or, therefore, contrary to their reasonable expectations).
32.The Commissioner must, however, consider each case on its own facts and circumstances.Here, having considered the withheld information, the Commissioner accepts that the ex-employee (and certain of the other data subjects) would have had no reasonable expectation that their personal data would be disclosed. The Commissioner also notes that the ex-employee objected to disclosure.
33.Finally, having considered the withheld information, the Commissioner accepts the Ministers' submission that its disclosure would be likely to cause distress to the ex-employee.
34.In this particular case, therefore, having balanced the legitimate interests of the data subjects against those identified by Mr Hutcheon, the Commissioner finds that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused in this case to the rights and freedoms or legitimate interests of the data subjects.The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in this case.
35.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interest of the data subjects as described above, the Commissioner must also conclude that its disclosure would be unfair.As no condition in Schedule 2 to the DPA can be met, he would also regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information in the withheld personal data and that this information was properly withheld under section 38(1)(b) of FOISA.
36.The Commissioner therefore finds that the Ministers correctly applied the exemption in section 38(1)(b) to the withheld information, and so complied with Part 1 of FOISA when refusing to supply this information in response to Mr Hutcheon's information request.Having reached this conclusion, he does not find it necessary to consider the application of section 38(1)(b) as read with section 38(2)(ii) of FOISA, or whether any of the withheld information could be considered to fall within any of the categories of sensitive personal data set out in section 2 to the DPA.
DECISION
The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Hutcheon.
Appeal
Should either Mr Hutcheon or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
5 September 2011
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
?.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
...
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
?.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
