Decision 191/2015: Mr George Watson and Dumfries and Galloway Council Community Council accounts Reference No: 201501082 Decision Date: 17 December 2015 Summary On 12 April 2015, Mr Watson asked Dumfries and Galloway Council (the Council) for full audited accounts of three named Community Councils. The Council did not respond to the initial request; it responded at review by disclosing some information to Mr Watson. Mr Watson was dissatisfied with the Council's response and applied to the Commissioner for a decision. The Commissioner investigated. She found that the Council had failed to respond to the request in time and was wrong to withhold some personal data from Mr Watson. She accepted that some personal data was correctly withheld.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 10(1)(a) (Time for compliance); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first and sixth data protection principles) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1))

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 12 April 2015, Mr Watson made three separate requests for information to the Council. He requested the "full audited accounts" for Cree Valley Community Council and Whithorn Community Council for the fiscal periods 2010-2011, 2011-2012, 2012-2013 and 2013-2014. He requested the same information for New Luce Community Council, with the addition of the accounts for 2014-15. In his request relating to Whithorn Community Council, Mr Watson asked for "true copies" of the accounts.

2. On the same day, the Council acknowledged receipt of all three requests.

3. On 12 May 2015, the Council wrote to Mr Watson and apologised that it would not be able to respond to his requests within the statutory timescale of 20 working days.

4. Following receipt of this email, on 12 May 2015, Mr Watson wrote to the Council requesting a review on the basis that it had not responded to his requests. Mr Watson cited the reference number the Council had given to his requests for information about New Luce Community Council and Whithorn Community Council.

5. On 13 May 2015, the Council acknowledged Mr Watson's requirement for review in respect of his requests relating to New Luce Community Council and Whithorn Community Council.

6. On 19 May 2015, the Council responded to all three of Mr Watson's requests and disclosed some information to him.

7. Mr Watson wrote to the Council on 22 May 2015, expressing his dissatisfaction with its response. He complained that:

? expenditure for any Community Benefit Fund had not been included in the information provided by the Council.

? the Council had failed to provide receipts for the claimed expenditure of the Community Council(s) involved, and Mr Watson was "unable to verify whether the financial statements are indeed correct and legally 'signed off'".

? the Council had not disclosed who actually "signed off" the financial statements of each Community Council. He believed this information should have been provided to him.

8. The Council conducted a further review of its response to all three requests, and notified Mr Watson of the outcome on 9 June 2015. The Council apologised for the delay in responding to his initial requests, and explained why this had happened. It also apologised that, in its review, it had not indicated that some information was being withheld under section 38(1)(b) of FOISA. The Council said that it did not hold information relating to the Community Benefit Fund. In relation to the Community Councils' receipts for claimed expenditure, the Council said this information was not covered by Mr Watson's initial request, and explained that it received audited Community Council accounts as part of their annual discretionary grant application and for this purpose only.

9. On 10 June 2015, Mr Watson applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Watson stated he was dissatisfied with the outcome of the Council's review because the Council had failed to comply with his request for information within 20 working days. He also complained that he had not received receipts, and that the Council had failed to inform him that it had redacted some information from the accounts.

Investigation

10. The application was accepted as valid. The Commissioner confirmed that Mr Watson made requests for information to a Scottish public authority and asked the authority to review its response to those requests before applying to her for a decision.

11. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

Commissioner's analysis and findings

12. In coming to a decision on this matter, the Commissioner considered all relevant submissions, or parts of submissions, made to her by both Mr Watson and the Council. She is satisfied that no matter of relevance has been overlooked.

Interpretation of the request and information held

13. Mr Watson did not accept that the Council had provided all the information that fell within his requests. In particular, he suggested that the Council holds financial records and receipts for expenditure by the Community Councils named in his information request, and he referred to the lack of information about expenditure relating to the Community Benefit Fund.

14. The Council said that it had provided the "true copies" of the accounts with only personal information redacted. The Council's letter to Mr Watson of 9 June 2015 explains that it did not accept that expenditure receipts and information about community benefit fund expenditure fell within the scope of his request, but, in any case, this is not information which the Council obtains from the Community Councils.

15. Mr Watson considered that his request for "full audited accounts" included information from receipts, and information on Community Benefit Fund expenditure.

16. In interpreting information requests, the Commissioner believes that the words used in the request should generally be given their plain, ordinary meaning. In this case, the Commissioner takes the view that Mr Watson's request covered all information in the audited accounts, but did not cover additional information (such as receipts) if it was not included in the audited accounts.

17. The question for the Commissioner is therefore whether Mr Watson received all information covered by the terms of his request, taken at its plain, ordinary meaning.

18. Section 1(1) of FOISA creates a general entitlement to be given information held by a Scottish public authority, subject to the application of any exemptions in Part 2 of FOISA and any other relevant provision in Part 1.

19. The Council explained that it receives copies of the audited accounts alongside the Community Council's application for discretionary grants. The Council does not audit the accounts, and is not required to do so: it is expected that the Community Councils have an independent person to audit the accounts and sign to confirm them to be accurate. As the auditing process is done outwith the Council's purpose, with regards to the receipts and expenditure, the Council does not request these receipts.

20. The Council acknowledged that responding to Mr Watson's three requests in one response and one review response has "caused some summary and overarching responses to be inaccurate in relation to some of the individual requests". For example, the Council confirmed that, with regards to the receipts, the Council does not require these from the Community Council and does not hold this information. With regards to information about expenditure, the Council does not require this to be provided either, but noted that this information is, in fact, included in all of the accounts.

21. Mr Watson questioned why the accounts did not contain information in relation to the Community Benefit Fund. The Council has stated that if a Community Council had received Community Benefit Fund money within the time period specified by Mr Watson's request, this would be shown on the accounts (which were provided).

22. The Council explained to the Commissioner that the Community Benefit Fund operates entirely separately of the Council and of the regular funding of the Community Councils. The Council acknowledged that this was another area where its decision to respond to three requests together had caused some confusion. The Council suggested that its "not held" review response was based on what was known about the Kilgallioch Community Benefit Fund. The Council has now confirmed that the New Luce Community Council accounts do in fact contain Community Benefit Fund information, in relation to the North Rhins Windfarm Community Fund. The Council confirmed that the other accounts do not hold information in relation to Community Benefit Fund.

23. The above points made by the Council were conveyed to Mr Watson by the investigating officer on 15 September 2015.

24. The Council was asked how it had ensured that all information falling within Mr Watson's request was located. The Council replied that all information covered by Mr Watson's request was processed by a small team of Council staff, all of whom were consulted with regards to establishing what information the Council holds in relation to Mr Watson's request. The Council supplied confirmation from the relevant manager that no further information falling within Mr Watson's request had been found.

25. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining whether a Scottish public authority holds information, the Commissioner will consider the scope, quality, thoroughness and results of the searches carried out by the public authority. She will also consider, where appropriate, any reason offered by the public authority to explain why it does not hold the information.

26. The Commissioner accepts that the Council interpreted Mr Watson's request for the "full audited accounts" for the respective Community Councils in a reasonable way, and located all the information that fell within his request.

Section 38(1)(b) - Personal information

27. Mr Watson believed he should have received information about the identity of the person who signed off the financial statements for each Community Council.

28. During the investigation, the Council stated that it would provide Mr Watson with the names of those who had signed off the accounts, and acknowledged that such information should not have been withheld from Mr Watson. However, the Council believed that it was correct in terms of FOISA to withhold the signatures and the contact details of the signatories.

29. Mr Watson confirmed that he did not wish the signatures, or the specific addresses of the signatories, but he wanted information showing the home town of the signatories. The Council continued to withhold that information in terms of section 38(1)(b) of FOISA. The Commissioner's decision, therefore, concerns only the addresses (home town) of the signatories.

30. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, (2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

31. To rely on this exemption, the Council must show, firstly, that the information is personal data for the purposes of the DPA and, secondly, that disclosure of those data would contravene one or more of the data protection principles to be found in Schedule 1. The Council submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first and sixth data protection principles.

Is the information under consideration personal data?

32. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is the possession of, or is likely to come into the possession of, the data controller" (the full definition is in Appendix 1).

33. The Council argued that that there was a "very substantial risk" of identification of individuals if town locations were disclosed to Mr Watson.

34. The Commissioner accepts that the name of the town in which a person lives can be that person's personal data, if the person can be identified either from this information alone or from this information in combination with other available information relating to the individual. In this case, the Commissioner accepts that the name of the town, and the fact that the person had signed off the accounts for the Community Council could allow certain third parties familiar with the locality to identify the persons who had signed the accounts.

35. The locations therefore comprise personal data for the purposes of section 1(1) of the DPA. The name of a town alone is not personal data, but it becomes personal data in the context created by the information held by the Council and disclosed to Mr Watson. A disclosure of information under FOISA cannot be regarded in isolation but must be considered in the context created by the request.

Would disclosure contravene the first data protection principle?

36. The Council submitted that disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully. The processing in this case would be the disclosure of the information into the public domain, in response to Mr Watson's request.

37. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met. In this case, the Commissioner is satisfied that the data under consideration are not sensitive personal data.

38. Disclosure of personal data in response to an information request would be "processing" within the terms of the DPA. The Commissioner will first consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the information would be fair and lawful.

39. There are three separate aspects to the first data protection principle:

(i) fairness

(ii) lawfulness and

(iii) the conditions in the schedules.

These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

40. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the information to Mr Watson. In any event, neither Mr Watson nor the Council has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (the individuals to whom the data relate).

41. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does Mr Watson have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr Watson's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

42. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1], that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Mr Watson must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Watson.

Does Mr Watson have a legitimate interest in obtaining the personal data?

43. There is no definition in the DPA of what constitutes a "legitimate interest". The Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance[2] on section 38 of FOISA states:

In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

44. Mr Watson required the information to enable him to pursue a legitimate purpose, i.e. public scrutiny of the process of auditing the Community Council accounts. He asked for information about the addresses of the signatories because he wished to ensure they were "real persons".

45. The Commissioner accepts that Mr Watson has a legitimate interest in knowing the identities of those who sign off the Community Council accounts. Community Councils are voluntary organisations set up by legislation and run by local residents to act on behalf of their area. Their specific role can vary according to their local area's needs and they can complement the role of the local authority whilst not being part of local government. The Commissioner recognises that there is a public interest in understanding the working of such organisations and how they interact with Scottish public authorities, and that this public interest implies there is a legitimate interest in some level of scrutiny. The Council itself accepted that point and disclosed the names of those persons, in the interests of transparency and accountability.

46. In this case, Mr Watson has been given the names of the signatories. It is information about where they live that has been withheld. The Commissioner must consider whether he has a legitimate interest in this information. After considering all relevant submissions she has received on this point, she does not accept that Mr Watson could be said to be pursuing a legitimate interest in relation to this information. She accepts that there may be a general public interest in transparency so the public can have confidence that the respective Community Council accounts are properly audited. She accepts that Mr Watson as a member of the public does have such a concern. However, the Commissioner notes that the Council has disclosed the names of the persons who signed off the accounts. She is not convinced that disclosing the name of the town in which the signatory lives renders the auditing process more accountable, while it would be an intrusion into the private lives of those persons.

47. Mr Watson has suggested to the Commissioner that he needs the information in order to ascertain whether the individuals named by the Council are indeed real people. He has not supported this with evidence or information about what his specific concerns are and why he has concerns about them. Given the lack of evidence to support such a concern, the Commissioner does not accept that Mr Watson has demonstrated he has a legitimate interest in having the withheld information.

48. Even if the Commissioner had accepted that Mr Watson was pursuing a legitimate interest in the withheld information, and that disclosure of information about where the signatories live was necessary for achieving his legitimate interests, she would still find disclosure would nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects.

49. Only if the legitimate interests of Mr Watson outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle. In the Commissioner's briefing on section 38 of FOISA, the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise. These include:

? whether the information relates the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

? the potential harm or distress that may be caused by the disclosure;

? whether the data subjects have objected to the disclosure; and

? the reasonable expectations of the individual as to whether the information would be disclosed.

50. The Commissioner accepts that the withheld information pertains to the data subjects' private lives, in that it relates to their home address, which is inherently private in this context.

51. The Council pointed out that the data subjects would not expect the withheld information to be made available to the general public in this way and such disclosure could lead to someone attempting to contact the signatories. The Council thought such an approach could cause distress to the data subjects. The Commissioner agrees.

52. The Commissioner, being satisfied that the three tests as set out above are not fulfilled, finds that the processing is not permitted by condition 6(1) of Schedule 2 to the DPA. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would be unfair. The Commissioner therefore finds that the first data protection principle would be breached by disclosure.

53. Given that the Commissioner has found that disclosure would breach the first data protection principle, she is not required to consider whether it would also breach the sixth data protection principle, as argued by the Council.

54. Having found that disclosure of the withheld personal data would breach the first data protection principle, the Commissioner finds that it was properly withheld by the Council under section 38(1)(b) of FOISA.

55. The Council initially withheld the names of the signatories under section 38(1)(b) of FOISA, but later decided to disclose this information. The Commissioner finds that the Council wrongly applied the exemption in section 38(1)(b) of FOISA to the names of the signatories. Disclosure of this information is permitted by condition 6(1) of Schedule 2 to the DPA and would not lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects.

Timescales

56. Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the request to comply with a request for information. This is subject to qualifications which are not relevant in this case.

57. At review, the Council apologised for the delay in responding to Mr Watson's three requests. The Council explained that the lateness was due to staff absence, for various reasons. The Council assured Mr Watson that to avoid a similar situation arising, further training was to be provided to all FOI Administrators and a Council-wide email was to be developed and circulated to all staff to ensure they provide information to the FOI Administrators as soon as possible. A new "escalation policy" would ensure that senior managers were notified about late responses to information requests.

58. During the investigation, the Council advised the Commissioner the further training has now been provided to staff and that the new escalation policy is in place.

59. It is a matter of fact that the Council did not provide a response to Mr Watson's requests for information within 20 working days, so the Commissioner finds that the Council failed to comply with section 10(1) of FOISA.

60. Mr Watson has expressed considerable dissatisfaction at the breach in timescale by the Council. The Commissioner notes that the Council has taken steps to ensure that in future it complies with timescales. In the light of these actions, and because the Council has apologised to Mr Watson and responded to his requirement for review, the Commissioner does not require the Council to take any further action in relation to its failure to comply with the statutory timescale for responding to Mr Watson's requests.

Decision The Commissioner finds that Dumfries and Galloway Council (the Council) partially failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information requests made by Mr Watson by: (i) withholding some personal data under section 38(1)(b) of FOISA (in breach of section 1(1)) and (ii) failing to respond to Mr Watson's information requests within 20 working days (in breach of section 10(1) of FOISA). The Commissioner does not require the Council to take any action in response to Mr Watson's application.

Appeal

Should either Mr Watson or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner

17 December 2015

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

?

10 Time for compliance

(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-

(a) in a case other than that mentioned in paragraph (b), the receipt by the authority of the request; or

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

6. Personal data shall be processed in accordance with the rights of data subjects under this Act.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---

[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx