Decision 182/2019: London Academy of Diplomacy and academic Professor Joseph Mifsud
Public authority: University of Stirling
Case Ref: 201900033
Summary
The University was asked about its partnership with the London Academy of Diplomacy and academic Professor Joseph Mifsud.
The University withheld some of the requested information and stated that it did not hold the remainder.
The Commissioner investigated and found that part of the information had been wrongly withheld. He ordered the University to disclose that information to the Applicant.
The Commissioner also found that the University was correct to state that it did not hold some of the information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held); 30(b)(ii) (Prejudice to effective conduct of public affairs); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "the GDPR", "personal data" and "processing") and (5A) (Personal information)
Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)
General Data Protection Regulation (the GDPR) Articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(a) and (f) (Lawfulness of processing)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 4 September 2018, the Applicant made a request for information to the University of Stirling (the University). The information requested was:
(i) Any evaluations undertaken by the University of the London Academy of Diplomacy's (LAD's) academic work or the quality of its teaching;
(ii) Any emails between the University's Secretary Eileen Schofield and Professor Mifsud sent or received between 1 October and 30 November 2017;
(iii) Any emails between the University's (now retired) Professor John Gardner and Professor Mifsud sent or received between 1 June and 30 September 2016;
(iv) Any emails between the University's Head of Communications Emma Darling and other University officials concerning Professor Mifsud, sent or received between 30 October and 31 December 2017.
2. The University responded on 1 October 2018. It stated that it held no information pertaining to parts (i) and (iii) of the request and that it was withholding the information pertaining to points (ii) and (iv) under section 38(1)(b) of FOISA on the grounds that it was considered to be the personal data of Professor Mifsud which was exempt from disclosure.
3. On 1 October 2018, the Applicant wrote to the University requesting a review of its decision. He expressed scepticism that no information was held in relation to point (i) of the request and stated that, if no information was held, he would like an explanation of why the University had failed to carry out due diligence in the matter. He was also dissatisfied with the University withholding information it considered to be personal data for points (ii) and (iv) of the request.
4. The University notified the Applicant of the outcome of its review on 24 October 2018. It upheld its original response without modification.
5. On 7 January 2019, the Applicant wrote to the Commissioner. The Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA. He stated he was dissatisfied with the outcome of the University's review because:
(i) he was not convinced there was no information held about evaluations of LAD's academic work and
(ii) challenging the University's application of section 38(1)(b), he submitted the University should have attempted to contact Professor Mifsud to ask for his views on the potential disclosure of his personal data.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 21 January 2019, the University was notified in writing that the Applicant had made a valid application. The University was asked to send the Commissioner the information withheld from the Applicant. The University provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The University was invited to comment on this application and to answer specific questions. These related to its reasoning for applying various provisions of FOISA in response to the Applicant's request.
9. The Applicant was also asked for any submissions he wished to make, including on why he believed it was in the public interest for the information to be disclosed.
10. Submissions were received from both the University and the Applicant during the course of the investigation.
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the University. He is satisfied that no matter of relevance has been overlooked.
Section 17(1) - Notice that information is not held
12. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received. This is subject to qualifications, but these are not applicable here. If no such information is held by the authority, section 17(1) of FOISA requires the authority to give the applicant notice in writing to that effect.
13. The University submitted it wished to rely on section 17(1) of FOISA in relation to parts (i) and (iii) of the Applicant's request as it did not hold any relevant information. The University was asked to explain how it had established this and how it had conducted its searches.
14. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining this, the Commissioner will consider the scope, quality, thoroughness and results of the searches carried out by the public authority. He will also consider, where appropriate, any reason offered by the public authority to explain why the information is not held.
15. With regard to that part of the request concerning any evaluation of LAD's academic work or the quality of its teaching, the University stated that it consulted with staff in the Faculty of Arts & Humanities, in the International & Partnerships team and with the Deputy Secretary. Staff in the Faculty of Arts & Humanities were responsible for delivering the University of Stirling LAD programme, the International & Partnerships team were responsible for the initial validation of INTO[1]/LAD and the Deputy Secretary had professional responsibility for academic quality and detailed knowledge of the relationship with INTO and LAD.
16. All staff confirmed that there was no information held that could be described as an evaluation of LAD's academic work or quality of teaching. The Commissioner would emphasise that it is not within his remit to determine whether any such evaluations were carried out or, if they were not, to ask the University to explain why no such evaluations were carried out.
17. With regard to that part of the request for email correspondence between Professor Mifsud and John Gardner, the University confirmed that its FOI unit obtained 298 emails from John Gardner in response to a request in November 2017, covering all email correspondence and communications between those two individuals up to that date. All these emails were checked and re-checked in the context of the Applicant's request and none of them fell within the time period specified. Emails from before and after this date were held. The University submitted that during the specified period there appears to have been no correspondence between the relevant individuals simply because there were no matters the parties needed to discuss over the quiet summer period.
18. The Commissioner accepts that the University has provided sufficient evidence to show that it does not hold any of this information. From the circumstances of this case, and the submissions and responses received from the University, the Commissioner is satisfied, on the balance of probabilities, that the University does not (and did not, on receipt of the request) hold any recorded information covered by parts (i) and (iii) of the request.
Section 30(b)(ii) - Prejudice to effective conduct of public affairs
19. The University applied this exemption to all of the withheld documents falling under part (iv) of the Applicant's request.
20. Section 30(b)(ii) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
21. In applying the exemption in section 30(b)(ii), the chief consideration is not whether the information constitutes opinion or views, but whether the disclosure of that information would, or would be likely to, inhibit substantially the free and frank exchange of views. The inhibition must be substantial and therefore of real and demonstrable significance.
22. Each request must be considered on a case by case basis, taking into account the effect (or likely effect) of disclosure of that particular information on the future exchange of views. The content of the withheld information will require to be considered, taking into account factors such as its nature, subject matter, manner of expression, and also whether the timing of disclosure would have any bearing.
23. As with other exemptions involving a similar test, the Commissioner expects authorities to demonstrate or explain why there is a real risk or likelihood that actual inhibition will occur at some time in the near future, not simply a remote or hypothetical possibility.
Submissions from the University
24. The University argued that much of the correspondence contained within the requested emails consisted of discussion between University officers to exchange views and deliberate on how to respond to queries from the press. Releasing this information into the public would, the University submitted, substantially inhibit the free and frank discussion between members of University staff on how to respond to such requests. The University needed the space to have these discussions without the expectation that the discussions themselves would be released into the public domain. In this case, the outcome of the internal deliberations was the release of various public statements.
25. The University stated that, on receiving press queries, it is normal practice to discuss internally how staff responds to those queries, going through several iterations before finalising a response. If these exchanges could not take place in private, it would inhibit the work both of staff working in public relations and of senior management, who would feel they could not commit to writing their draft responses or discuss freely how they intended to respond.
The Commissioner's conclusions on section 30(b)(ii)
26. The Commissioner has considered all of the submissions made by the University, along with the withheld information under consideration. He has considered the content and nature of the information, which, for the most part, relates to the University's discussions around dealing with various press enquiries received and the ways in which to respond to the enquiries.
27. In all the circumstances of the case, the Commissioner accepts that disclosure of the majority of the withheld information would be likely to result in substantial inhibition to the free and frank exchange of views for the purposes of deliberation, as argued by the University. As such, he is satisfied that this information is exempt from disclosure in terms of section 30(b)(ii) of FOISA.
28. However, in respect of documents E22 (and E16, which duplicates document E22), E38 and E40, the Commissioner is not convinced by the arguments put forward by the University.
29. Document E16/E22 contains emails informing University staff about the outline of an informal workshop that was to be given by Professor Mifsud, with a mini biography of the academic and examples of some of his engagements. Documents E38 and E40 are emails containing nothing other than a website link to news articles pertaining to Professor Mifsud.
30. The Commissioner cannot accept that disclosure of the content of any of these documents would cause the University staff the level of inhibition required for the application of section 30(b)(ii) of FOISA. Because the Commissioner does not accept that section 30(b)(ii) applies, he is not required to go on and consider the public interest test in section 30(b)(ii) of FOISA in respect of these documents.
31. The Commissioner does, however, note that the University has also applied other exemptions to these documents and he will consider these further later in this decision.
32. In the meantime he will now go on to consider the public interest test in respect of the documents being withheld under 30(b)(ii) of FOISA (other than E16/E22, E38 and E40).
Public interest test - section 30(b)(ii)
33. Section 30(b)(ii) is subject to the public interest test required by section 2(1)(b) of FOISA. The Commissioner is therefore required to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.
Public interest submissions from the University
34. The University stated that it recognised the public interest in operating in a transparent manner, and acknowledged that the public interest in making certain information available can increase accountability of public authorities.
35. However, the University did not believe there was any information contained within the internal correspondence that could be classed as being of concern or benefit to the public. Furthermore, the University argued, maintaining the integrity of the process of providing advice and exchanging views prior to issuing a press release would outweigh any benefit of disclosing this information.
36. The University stated that the Applicant's request, review and appeal provided very little information as to why he was seeking the requested information, except that he would like to know why the University decided to collaborate with Professor Mifsud. The University did not believe disclosure of the withheld information would help provide an answer to this question or that the information was of serious public interest. The University submitted that the release of this information could, however, have a negative impact on the way it conducted its internal discussions in the future, preventing the free exchange of views and having a serious impact on commercial relationships and income generating opportunities. Therefore, the balance of the public interest would, in the University's view, be better served by withholding the information.
Public interest arguments from the Applicant
37. The Applicant submitted that there was a strong public interest in Professor Mifsud's relationship with the University.
38. He submitted that the public interest was especially strong given that, in his view, the University had offered no explanation to international media, to the Scottish tax payer or to its students as to why Professor Mifsud had been hired. The Applicant did not believe that the University had carried out sufficient checks on Professor Mifsud's background (on which he provided further submissions).
39. The Applicant was of the view that the University was hiding the material to avoid public scrutiny and had refused to answer questions from journalists. He also questioned why the University had exposed its students to an academic with what he submitted was a questionable background.
40. He believed the University might be worried that exposing its relationship with Professor Mifsud would prejudice its reputation or its business interests. He argued that it was in the public interest, and in the interests of transparency, that the material in question should be released in full, so that public authorities could learn from the University's example.
The Commissioner's conclusions on the public interest for section 30(b)(ii)
41. The Commissioner has taken into account all the submissions made to him by both the University and the Applicant and has considered these within the context of the content of this information.
42. Having scrutinised the information being withheld here, he has reached the view that disclosure would not shed any light on the reasons why the University had chosen to hire Professor Mifsud, along the lines expected by the Applicant.
43. However, the information does contain detail of internal discussions between various members of University staff, in which candid questions and responses are shared between those staff members. The Commissioner must take into account the need, in appropriate circumstances, for public bodies to have the time and space to carry out internal deliberations in dealing with media enquiries. Should staff be discouraged from being open in making contributions to such discussions, this could be to the detriment of the effective handling of such enquiries. This would appear to be a genuine risk in the circumstances of the exchanges under consideration.
44. On balance, the Commissioner concludes that the public interest in maintaining the exemption in section 30(b)(ii) outweighs that in disclosure of this particular information. Accordingly, he finds that the University was entitled to withhold this information.
45. The University also applied the exemptions in section 33(1)(b) and 38(1)(b) to some of this information. As the Commissioner has found that this information has been correctly withheld under section 30(b)(ii), he is not required to consider any other exemption simultaneously applied to this same information.
46. The Commissioner will now go on to consider the application of section 33(1)(b) of FOISA to the information contained in documents E16/22 and E54.
Section 33(1)(b) of FOISA - Commercial interest and the economy
47. Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority). This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
48. There are a number of elements an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to establish:
(i) whose commercial interests would (or would be likely to) be harmed by disclosure,
(ii) the nature of those commercial interests and
(iii) how those interests would (or would be likely to) be prejudiced substantially by disclosure.
49. The prejudice must be substantial, in other words of real and demonstrable significance. Where the authority considers the commercial interests of a third party would (or would be likely to) be harmed, it must make this clear. Generally, while the final decision on disclosure will always be one for the authority, it will assist matters if the third party has been consulted on the elements referred to above.
50. The University submitted that its own commercial interests would be harmed if the information in documents E16/22 and E54 were disclosed. It argued that universities work in a very competitive environment, where there is fierce competition for setting up successful commercial and educational partnerships and the subsequent financial and reputational rewards that follow. Releasing information about negotiations into the public sector could prejudice the commercial interests of the University and its competitiveness in the sector. The University also submitted that release of the information could provide leads to other universities, allowing them to create their own relationships that could undercut the University's position.
51. In relation to document E16/22, the University submitted that the information constituted sensitive commercial information, disclosure of which was likely to substantially prejudice its commercial interests in a number of ways. As is the case for every university in the UK, the University submitted, it is vitally important for it to be able to recruit and retain staff with particular, sought-after skillsets, who can further a university's links internationally. It submitted that the withheld information was of the upmost commercial sensitivity and was not compiled with a public audience in mind, as it constituted a commentary on the strategic activities of the University in numerous ways which were of commercial importance.
52. It was the University's view that, should this information become public, it was very likely that it would suffer substantial prejudice in terms of its abilities to engage with other educational institutions. Disclosure would also prejudice pending or potential partnership or other collaborative negotiations, current and future, which were key and fundamental to the University's income generation activities.
53. In relation to document E54, the University submitted that the discussions in this document consisted of an exchange between two individuals referencing potential strategic engagements at a national and international political level. The information constituted sensitive commercial information relating to how the University pursued international ventures. International activity of this type was, it argued, vitally important from the perspective of generating significant revenue to supplement the University's public and rest-of-UK student funding. This importance had grown, particularly over recent years, in the face of declining levels of public funding, to the point where international projects like this were heavily linked to the University's financial sustainability.
54. The University submitted that the information in document E54 specifically revealed the University's intentions to develop a strategic partnership elsewhere. Publication of this information could damage the University's future commercial interests, by allowing another party to pursue the opportunity. There is a real likelihood, it submitted, of the University being substantially prejudiced by disclosure. This would then negatively impact on the University's ability to commercially negotiate partnerships and other collaborations in future.
55. The University also stated that, as in all collaborative and commercial negotiations, there are implied obligations of confidentiality on both parties. It would not expect its correspondence with third party institutions to be disclosed to the public, especially in circumstances involving deliberations in contemplation of future partnership. Should this information require to be disclosed, the University argued that the parties to the negotiation would be likely to lose credibility, weakening both institutions' abilities to enter into discussions for further partnership in the future. However, no evidence of the other party's views was provided.
Commissioner's conclusions on section 33(1)(b)
56. The Commissioner has in the first instance considered whether the University has relevant commercial interests. Commercial interests will generally relate to any commercial trading activity an organisation undertakes, such as the ongoing provision, sale and/or purchase of goods and/or services, commonly for the purpose of revenue generation. Such activity will normally take place within a competitive environment. The Commissioner is satisfied that the University has commercial interests in the generation of revenue from partnerships with other institutions. As such, he is satisfied that the University and the partner institution have relevant commercial interests.
57. Having reached this conclusion, the Commissioner must now go on to consider whether the commercial interests he has identified would, or would likely to, be prejudiced substantially by the disclosure of the information.
58. The Commissioner has considered the arguments put forward by the University, but he is not persuaded that the likely effect of disclosure would be any of the consequences suggested. His reasoning for this is as follows.
59. Document E16/22 - The content of this is as described at paragraph 29 above. The content is biographical and factual in relation to Professor Mifsud and contains facts that will for the most part be publicly known. The emails date back to 2016 and 2017. The Commissioner fails to see how disclosure of this information could cause any commercial detriment to the University.
60. Document E54 - The content of this document consists of an email chain with discussions relating to a potential partnership between the University and another institution. However, these emails date back to October 2017. The Commissioner is of the view that, had these discussions been live, then there might have been scope to consider the effect of disclosure on commercial interests. However, in the circumstances, it is reasonable to assume that the business under consideration in these emails would surely have been concluded or abandoned by the time of the Applicant's information request on 4 September 2018. The Commissioner has not received any information from the University to show that the discussions contained in these emails were still ongoing and under consideration. The University did not, when asked, provide the Commissioner with any submissions from the other institution whose commercial interests it claimed would also be detrimentally affected.
61. The Commissioner is therefore not satisfied that disclosure of documents E16/22 and E54 would - or would be likely to - prejudice substantially the commercial interests of the University or the other institution. As he has not upheld the degree of harm necessary to support this exemption, the Commissioner is not required to go on to consider the public interest test in relation to the information.
62. The Commissioner will now go on to consider the application of section 38(1)(b) of FOISA to the information contained in documents E16/22, E38, E40 and E54.
Section 38(1)(b) - Personal information
63. Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" and its disclosure would contravene any of the data protection principles in the GDPR or in the DPA 2018.
64. The University submitted that disclosure would breach the first data protection principle, which requires the processing of personal data to be lawful and fair (Article 5(1)(a) of the GDPR).
Is the information personal data?
65. "Personal data" are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable living individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."
66. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
67. The information withheld under section 38(1)(b), as it relates to documents E16/22, E38 and E40, is as described in paragraph 29 above. The information, as it relates to document E54, is as described in paragraph 60 above.
68. In respect of document E16/22, the University submitted that, after reconsideration, it would be willing to disclose one paragraph of this document, the details of which contained a min-biography of Professor Mifsud. The University stated that this information might already be in the public domain. However, the University has not provided the Commissioner with any evidence that it has since disclosed this information to the Applicant, and therefore he will still consider the whole of the information contained in this document as part of this investigation.
69. The University submitted that the personal data within the documents primarily related to Professor Mifsud, although there were references to other individuals, both internal and external to the University, throughout the correspondence. The University argued that disclosure of the withheld information would identify living individuals.
70. Documents E38 and E40 contain the names of the sender and recipient of the emails (both University staff). In the Commissioner's view, this is the sum total of the personal data contained within these two documents. As he does not accept that the other information contained in these two documents is personal data (the information consists of two website links), he requires the University to disclose this information to the Applicant.
71. In respect of documents E16/22 and E54, the Commissioner accepts that these contain both the personal data of Professor Mifsud and that of other individuals (both from within and outwith the University). Given the subject matter of the request, which names individuals and makes clear their connection to the University, the withheld information clearly relates to identifiable individuals. The Commissioner therefore accepts that the information is personal data as defined in section 3(2) of the DPA 2018.
Processing of personal data and lawfulness of processing: Articles 5(1)(a) and 6(1)(a) and (f) of the GDPR
72. Article 5(1)(a) of the GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject." The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". In the case of FOISA, personal data are processed when disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the GDPR) and fair.
73. The University took the view that no conditions in Article 6(1) applied in the circumstances of this case. However, the Commissioner must still consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the GDPR would allow the personal data to be disclosed. It is the view of the Commissioner that the conditions in Article 6(1)(a) and (f) would appear to be the only ones of relevance in the circumstances of this particular case.
Article 6(1)(a)
74. This condition allows personal data to be processed if the data subject(s) have given their consent to the processing for specified purposes.
75. The University advised the Commissioner that it did not have the consent of Professor Mifsud, or of the other members of staff whose details are contained in the correspondence, to disclose their personal data.
76. In the absence of consent, the Commissioner must find that the condition 6(1)(a) does not apply.
77. As noted above, the Applicant believes that the University should have attempted to contact Professor Mifsud to ask for his views on the potential disclosure of his personal data. The Commissioner notes that the University does not have the means to contact Professor Mifsud: it understands that Professor Mifsud has removed himself from public life and, despite being pursued by journalists, has not been traced.
78. In the circumstances, the Commissioner is satisfied that there was no requirement on the University to contact, or attempt to contact, Professor Mifsud to seek his views on disclosure.
79. The Commissioner will now go on to consider Article 6(1)(f).
Article 6(1)(f)
80. This condition allows personal data to be processed if the processing is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
81. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
82. The University argued that the legitimate interests of the data subjects (Professor Mifsud and the other individuals whose personal data appears in the documents) in favour of non-disclosure, outweighed those of the Applicant in favour of disclosure.
83. The tests which must be met before Article 6(1)(f) can apply are as follows:
(i) Does the Applicant (or does another member of the public) have a legitimate interest in obtaining the personal data?
(ii) If so, is the disclosure of the personal data necessary to achieve that legitimate interest?
(iii) Even if the processing is necessary to achieve that legitimate interest, is that overridden by the interests or fundamental right and freedoms of the data subjects?
Legitimate interest
84. The Commissioner is satisfied that the Applicant, as a journalist, and the wider public have a legitimate interest in the information considered to be the personal data of Professor Mifsud being disclosed into the public domain. Professor Mifsud is a person of public interest due to some of the testimony given during the Mueller Inquiry in which he was a subject of discussion.
85. However, the Commissioner is not satisfied that the Applicant has a legitimate interest in obtaining information relating to other individuals named in the various documents (such as the names, direct email addresses and telephone contact details of University staff members and other individuals outwith the University). The individuals in question are not individuals widely known in the public domain. The Commissioner fails to recognise what possible legitimate interest there would be in the publication of their personal data or how publication would assist in any way with the Applicant's interests in Professor Mifsud.
86. In the circumstances, the Commissioner finds that the Applicant does not have a legitimate interest in obtaining this information and he finds that the names, partial email addresses (i.e. those parts identifying individuals) and contact details should be withheld. This information consists of the names of the email senders and recipients in documents E38 and E40, the names and direct email addresses of the individuals in document E16/22, and the direct email address of Professor Mifsud and the names of the individuals in document E54.
Is disclosure of the personal data necessary?
87. Having accepted that the Applicant does have a legitimate interest in obtaining the remaining personal data in document E54 (that of Professor Mifsud and that of the University Secretary) and in document E16/22 (the mini-biography of Professor Mifsud and eight bullet points following on from this) the Commissioner must consider whether disclosure of the personal data is necessary for that interest. In doing so, he must consider whether the interest might reasonably be met by any alternative means.
88. The Commissioner has considered the information. He accepts that disclosure of the remaining personal data in document E54 is necessary in order for the Applicant to be able to understand the content of the correspondence. The Commissioner can identify no viable means of meeting the Applicant's legitimate interest which would interfere less with the privacy of the data subject than disclosing this withheld information.
89. The Commissioner has considered the remaining personal data in document E16/22 carefully. While some of the information may in fact be in the public domain, it is not something that the Applicant could be expected to easily obtain without recourse to other sources. As is the case with document E54 above, the Commissioner can identify no viable means of meeting the Applicant's legitimate interest which would interfere less with the privacy of the data subject than disclosing the remaining personal data in document E16/22.
90. The Commissioner will now consider whether the Applicant's legitimate interest in obtaining the remaining information in documents E54 and E16/22 outweighs the rights of the data subject to privacy.
The data subject's interests or fundamental rights and freedoms
91. It is necessary to balance the legitimate interests in disclosure against the data subject's interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subject would not reasonably expect that the information would be disclosed to the public under FOISA in response to the request, or if such disclosure would cause unjustified harm, his interests or rights are likely to override legitimate interests in disclosure. Only if the legitimate interest in disclosure of the information outweighs the interests of the data subject can the information be disclosed without breaching the first data protection principle.
92. The Commissioner's guidance on section 38 of FOISA sets out some factors that should be taken into account in balancing the interests of parties. The guidance makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
(i) Does the information relates to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?
(ii) Would the disclosure cause harm or distress?
(iii) Whether the individual has objected to the disclosure.
Does the information relate to public or private life?
93. Document E54 - The Commissioner considers most of this could be construed as relating to Professor Mifsud's public life as a recognised academic. However, a small amount of the information contained in the emails veers into personal conversation, which the Commissioner considers pertains to Professor Mifsud as a private individual. Some of this information could also be considered the personal data of the University Secretary as a private individual. It is the Commissioner's view that this information does not add anything of substance to the understanding of the main focus of the conversation between Professor Mifsud and the University Secretary, in terms of the business under discussion. He struggles to see any merit in this information being disclosed into the public domain.
94. Document E16/22 - It is the Commissioner's view that all of this information relates to Professor Mifsud's public life as it relates to his work as an Academic Director and as a Professional Fellow.
Would disclosure cause harm or distress to the data subjects?
95. The University submitted that Professor Mifsud would not expect any information relating to him to be released into the public domain. The University also submitted that it was highly likely that releasing additional information about Professor Mifsud into the public domain would cause him significant distress. As noted above, the University's understanding was that Professor Mifsud had removed himself from public life and that, despite his being pursued by various journalists, he had not been traced. This, the University argued, was a clear demonstration that he did not want personal information about himself released into the public domain.
96. The Applicant argued that disclosure would be within the reasonable expectations of Professor Mifsud, stating that he was a seasoned academic who would be well aware of European public records legislation.
Document E16/22
97. It is the Commissioner's view that the disclosure of the information under consideration in document E16/22 would not be likely to cause any harm or distress to the data subject. On the contrary, it expounds upon Professor Mifsud's achievements and his professional standing at the time.
Document E54
98. The Commissioner is of the view that disclosure of the information contained in the private conversational parts of document E54 is not something that either of the data subjects (Professor Mifsud and the University Secretary) would expect to be disclosed into the public domain and, as such, could cause a degree of distress to the data subjects.
99. In respect of the remainder of the information contained in document E54 (that information which would not be classed as personal conversational information), the Commissioner does not accept that the content of this information would cause undue distress to the data subjects. The content of the information consists of discussions about a proposed business arrangement between the University and another educational establishment. As these discussions date back to 2017, the Commissioner does not accept that disclosure could cause distress to the University Secretary and Professor Mifsud).
Balance of legitimate interests
100. After carefully balancing the legitimate interests of the data subjects against those of the Applicant, the Commissioner finds that the legitimate interests served by disclosure of the information as discussed in paragraph 98 above are outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the individuals in question. In the circumstances of this case, the Commissioner concludes that condition (f) in Article 6(1) of the GDPR cannot be met in relation to this withheld personal data.
101. The Commissioner has concluded, on balance, that the legitimate interest in obtaining this information is outweighed by reason of prejudice to the data subjects' rights and freedoms or legitimate interests. The condition in Article 6(1)(f) could not, therefore, be met and the processing would be unlawful.
102. With regards to the information as discussed in paragraphs 97 and 99 above, the Commissioner finds that the balance of legitimate interests falls in favour of the Applicant, a journalist with a specific legitimate interest in accessing this information. The Commissioner does not accept that there would be a degree of distress caused to the data subjects by the disclosure of this information that would be sufficient to override the legitimate interests of the Applicant.
Fairness
103. Where the Commissioner has concluded that the processing of personal data would be unlawful, he is not required to go on to consider separately whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subjects. Where he has concluded that the processing would be lawful, bearing in mind his reasons for reaching that conclusion, he can identify no reason for finding that disclosure would be other than fair.
Conclusions on the data protection principles
104. The Commissioner is satisfied that disclosure of the personal data contained in document E54 as discussed in paragraph 98 above would breach the data protection principle in Article 5(1)(a) of the GDPR. Consequently, he is satisfied that these personal data are exempt from disclosure under section 38(1)(b) of FOISA. On the other hand, he finds that the remaining personal data contained in document E54 (paragraph 99), and that contained in document E16/22 (paragraph 97) can be disclosed without breaching that principle.
Summing up of findings on 38(1)(b)
105. The Commissioner requires the University to disclose the information contained in documents E16/22, E38, E40, and E54 as marked up for ease of reference in the copy enclosed with this decision.
Decision
The Commissioner finds that University of Stirling (the University) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that, by withholding some of the information under the exemptions at sections 30(b)(ii) and 38(1)(b) of FOISA, and by correctly applying section 17(1) of FOISA in respect of the information not held, the University complied with Part 1.
However, by withholding other information under sections 30(b)(ii), 33(1)(b) and 38(1)(b) of FOISA the University failed to comply with Part 1 and, in particular, with section 1(1), of FOISA.
The Commissioner therefore requires the University to disclose the information from documents E16/22, E38, E40 and E54, as marked up in the enclosed copy, by 4 February 2020.
Appeal
Should either the Applicant or the University wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the University fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the University has failed to comply. The Court has the right to inquire into the matter and may deal with the University as if it had committed a contempt of court.
Margaret Keyse
Head of Enforcement
20 December 2019
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
…
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
...
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
…
(b) would, or would be likely to, inhibit substantially-
…
(ii) the free and frank exchange of views for the purposes of deliberation; or
…
33 Commercial interests and the economy
(1) Information is exempt information if-
…
(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).
…
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
"the GDPR", "personal data", "processing" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4), (10), (11) and (14) of that Act);
…
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available.
…
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
…
(10) "The GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
…
General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
[1] https://www.intostudy.com/en-gb/about-into
