|
Decision 184/2012 Peter Cherbi and the Scottish Ministers
Recruitment and appointment of the Chief Executive of the Scottish Legal Complaints Commission
Reference No: 201201414
Decision Date: 13 November 2012 |
Summary
Mr Cherbi asked the Scottish Ministers (the Ministers) for information relating to the recruitment and appointment of the Chief Executive of the Scottish Legal Complaints Commission (the SLCC). The Ministers withheld this information on the basis that it was personal data, the disclosure of which would breach the first data protection principle.
Following an investigation, the Commissioner found that the Ministers were entitled to withhold the information on this basis.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Note: Rosemary Agnew, the Commissioner, was formerly the Chief Executive of the SLCC and Mr Cherbi's application focuses on the appointment of her replacement.Ms Agnew has taken no part in the consideration of this application and has, under section 42(10) of FOISA, authorised Margaret Keyse, Head of Enforcement, to make a decision on her behalf.All references to "the Commissioner" in this decision should therefore be read as references to Margaret Keyse, Head of Enforcement.
Background
1.On 25 May 2012, Mr Cherbi emailed the Ministers requesting "information contained in documents and discussions relating to the latest recruitment round for the position of and subsequent appointment of the new Chief Executive of the Scottish Legal Complaints Commission".
2.The Ministers responded on 25 June 2012, providing some information to Mr Cherbi but withholding the remainder under the exemptions in sections 30(b)(i), 30(c) and 38(1)(b) of FOISA.
3.On 26 June 2012, Mr Cherbi emailed the Ministers requesting a review of their decision. Mr Cherbi considered that it was in the public interest and the interests of the legal profession for the information to be published.
4.The Ministers notified Mr Cherbi of the outcome of their review on 19 July 2012, upholding their original decision without modification.
5.On 20 July 2012, Mr Cherbi wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Cherbi had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7.On 7 August 2012, the Ministers were notified in writing that an application had been received from Mr Cherbi and were asked to provide the Commissioner with any information withheld from him. The Ministers responded with the information requested and the case was then allocated to an investigating officer.
8.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions. The Ministers were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested.
9.In response, the Ministers submitted that they considered the requested information to be exempt from disclosure in terms of sections 30(b)(i), 30(c) and 38(1)(b) of FOISA and provided submissions supporting their application of these exemptions, including their views on the public interest test (where appropriate).In relation to section 38(1)(b) of FOISA, the Ministers clarified that they considered that this exemption applied to all the withheld information.
10.The investigating officer also contacted Mr Cherbi during the investigation seeking his submissions on the matters to be considered in this case.
11.The relevant submissions received from both the Ministers and Mr Cherbi will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to her by both Mr Cherbi and the Ministers and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) of FOISA ? personal information
13.The Ministers have withheld all of the information requested by Mr Cherbi under the exemption in section 38(1)(b) of FOISA.
14.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, 38(2)(b), exempts information from disclosure if it is "personal data" as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
15.In order to rely on this exemption, therefore, the Ministers must show firstly that the information being withheld is personal data for the purposes of the DPA, and secondly that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
Is the information personal data?
16.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
17.The Ministers have applied the exemption in section 38(1)(b) to all of the withheld information on the basis that it comprises discussions about the prospective Chief Executive's contractual details and discussions concerning the individual candidates for the post, including their suitability for the post.
18.The Commissioner is satisfied that all of the information under consideration is the personal data of the individuals concerned as it relates to them and they can be identified from it. She will go on to consider whether this information is exempt from disclosure under section 38(1)(b) of FOISA.
Would disclosure of the personal data contravene the first data protection principle?
19.The Ministers argued that disclosure of the personal data would breach the first data protection principle.This requires that personal data be processed fairly and lawfully and, in particular, that it shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing under consideration in this case is disclosure of the personal data into the public domain in response to Mr Cherbi's information request.
20.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and she is satisfied that the personal data under consideration in this case do not fall into any of the categories set out in that definition. Therefore, it is not necessary to consider the conditions in Schedule 3 to the DPA in this case.
21.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
22.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether the disclosure of this personal data would otherwise be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
23.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.
24.There are a number of different tests which must therefore be satisfied before condition 6 can be met. These are:
Does Mr Cherbi have a legitimate interest in obtaining the personal data?
If yes, is disclosure necessary to achieve these legitimate interests? In other words, is the disclosure proportionate as a means and fairly balanced as to its ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?
Even if processing is necessary for Mr Cherbi's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
25.There is no presumption in favour of the release of personal data under the general obligation laid down in FOISA. Accordingly, the legitimate interests of Mr Cherbi must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Mr Cherbi.
Does Mr Cherbi have a legitimate interest?
26.There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on section 38 of FOISA[2] states:
In some cases, the legitimate interest might be personal to the applicant ? e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
27.In this case, Mr Cherbi argued that there was a public interest in information which would show the Scottish Government's input and influence in the appointment of senior staff at the SLCC.He pointed out that there appeared to be no such input into recruitment and appointment of senior staff in the Law Society of Scotland and the legal profession, and advised that he wished to investigate and report on this apparent imbalance.(The Commissioner notes that, under the Legal Profession and Legal Aid (Scotland) Act 2007, the SLCC requires the approval of the Ministers before appointing a Chief Executive.)He argued that disclosure of the information he had requested was necessary if the public and the legal profession were to have any confidence in the recruitment process, and to ascertain whether the process was transparent.
28.Mr Cherbi submitted that the public were entitled to know why a reserve candidate had been nominated (the fact that reserve candidates had been agreed was disclosed by the Ministers to Mr Cherbi), and to know what discussions had taken place about that. He considered this would have been disclosed in any case had the successful candidate been unable to take up the appointment or left office sooner than expected.
29.In Mr Cherbi's view, there were strong grounds for the disclosure of any information given that the position of Chief Executive of the SLCC has, in his opinion, proved a controversial one and has now been held by a number of people since the SLCC's inception.Mr Cherbi raised the concern that this may have had an impact on the performance of the SLCC as a regulator.He therefore considered that information relating to any Scottish Government involvement in the appointment processes linked to the SLCC should be disclosed, to ensure transparency and public accountability.
30.In their submissions, the Ministers noted that Mr Cherbi is known to have an interest in both the legal profession and the SLCC and to report on issues relating to them.As such, he would have an interest in the recruitment of the Chief Executive of the SLCC. However, in the Ministers' view, there was no legitimate interest in Mr Cherbi obtaining information concerning reserve candidates.
31.Having considered the submissions from both Mr Cherbi and the Ministers, the Commissioner accepts that Mr Cherbi has a legitimate interest in seeking to understand the process by which the appointment of a senior official in a high profile public body had been concluded. The Commissioner also recognises that there is a general legitimate interest in scrutinising the governance and procedures of such bodies.
32.For these reasons, the Commissioner has concluded that Mr Cherbi has a legitimate interest in obtaining the personal data under consideration.
Is disclosure necessary to achieve those legitimate interests?
33.The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so she must consider whether these interests might reasonably be met by any alternative means.
34.In all the circumstances of this case, the Commissioner can identify no viable means of meeting Mr Cherbi's legitimate interests which would interfere less with the privacy of the relevant data subjects than the provision of the withheld personal data. In the circumstances, she is satisfied that disclosure of those personal data is necessary to meet the legitimate interests in question.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
35.The Commissioner must next go on to consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the individuals, in relation to the personal data for which disclosure was found to be necessary to meet Mr Cherbi's legitimate interests.
36.As noted above, this test involves a balancing exercise between the legitimate interests of Mr Cherbi and those of the individuals in question. Only if the legitimate interests of Mr Cherbi outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
37.In the Commissioner's briefing on section 38 of FOISA, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
the potential harm or distress that may be caused by the disclosure
whether the individual objected to the disclosure
the reasonable expectations of the individuals as to whether the information should be disclosed.
38.The Ministers argued that release of the withheld information would cause unwarranted distress to the data subjects and their legitimate expectations as data subjects. The Ministers also submitted that the obligations of the Scottish Government as a data controller, alongside Article 8 of the European Convention on Human Rights and the general law of confidentiality, should all take precedence over any possible interest in disclosure.
39.The Ministers also considered that the data subjects would have no expectation that their personal data would be placed in the public domain. The Ministers explained that no consent for release of the data had been sought or given and the individuals would have no expectation that such information would be released, as to do so would undermine the necessary confidentiality of such a process.It was also possible that disclosure could cause professional harm to some candidates by highlighting where they had failed to secure posts for which they had applied.
40.Having considered the information in question, the Commissioner is of the view that the individuals in question would not have any reasonable expectation that these particular details would be publicly disclosed, which would be the effect of the disclosure of the information under FOISA. She recognises that the information under consideration in this case is of a type that would normally be treated as confidential, and which data subjects would reasonably expect to remain private.
41.In this particular case, having balanced the legitimate interests of the data subjects against those identified by Mr Cherbi, the Commissioner finds that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused in this case to the rights and freedoms or legitimate interests of the data subjects. The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in this case.
42.Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would be unfair. As condition 6 cannot be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was therefore properly withheld under section 38(1)(b) of FOISA.
43.As the Commissioner has concluded that the information was properly withheld under section 38(1)(b) of FOISA in its entirety, she is not required to consider whether the information was properly withheld under the exemptions in sections 30(b)(i) and 30(c).
DECISION
The Commissioner finds that the Scottish Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Cherbi.
Appeal
Should either Mr Cherbi or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
13 November 2012
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=661&sID=133
