Decision 201/2017: Mrs X and Fife Council Disclosure of reports and costs Reference No: 201701342 Decision Date: 7 December 2017 Summary The Council was asked for information concerning the disclosure of two reports, the costs pertaining to the reports and related costs of sickness absence. The Council disclosed some information. It explained that it did not hold some of the other information requested, and withheld other information it considered to be personal data. At review stage, the Council changed its position to neither confirming nor denying it held the information originally withheld as personal data. It upheld its original position for the remainder of the information requested. The Commissioner was satisfied with the Council's position on the other matters raised, but found that it was not entitled to refuse to confirm or deny whether it held information it had originally refused to provide. By the end of the investigation, the Commissioner was satisfied that the Council did not in fact hold this information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 17(1) (Notice that information is not held); 18(1) (Further provisions as respects responses to request); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for the purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 2 February 2017, Mrs X made a request for information to Fife Council (the Council). Referring to review reports compiled by the Council as part of an internal investigation, Mrs X asked for the following information:

(i) Which senior manager authorised the sending of the first report to a member of the public?

(ii) Which senior manager sent the report?

(iii) Who authorised sending the second report to the same member of the public?

(iv) The cost to the Health and Social Care budget of the two reports.

(v) The cost of sickness pay for specified individuals.

2. The Council issued its response on 2 March 2017. It provided Mrs X with some information in response to parts (i)-(iii). For part (iv), it informed Mrs X, in terms of section 17 of FOISA, that it did not hold information on the costs of preparing the two reports. For part (v), it refused to provide the sickness pay costs, as it considered these to be personal data which was exempt from disclosure under section 38(1)(b) (Personal information) of FOISA.

3. On 3 March 2017, Mrs X wrote to the Council requesting a review of its decision on the following basis:

· For parts (i) and (ii), Mrs X was not satisfied that the Council's response had provided the information requested.

· For part (iv), noting that other public bodies had disclosed - under FOI legislation - the financial costs of recent investigations, Mrs X was dissatisfied that the Council had failed to provide the information requested.

· For part (v), emphasising that she had not requested the sick pay costs of individual persons, Mrs X was dissatisfied with the Council's refusal to provide the information requested. She disputed that the information was personal or commercially sensitive.

4. Mrs X raised no dissatisfaction with the Council's response to part (iii) of the request.

5. The Council notified Mrs X of the outcome of its review on 30 March 2017, modifying its original decision as follows:

· For part (i), the Council informed Mrs X, in terms of section 17 of FOISA, that it did not hold information detailing who authorised the sending of the first report.

· For part (ii), the Council refused to disclose the name of the individual who sent the first report, as it considered this to be personal data which were exempt from disclosure under section 38(1)(b) of FOISA.

· For part (iv), the Council upheld its original decision that it did not hold information on the costs of preparing the two reports. This, the Council explained, was because individual staff members did not record their time against individual subject matters.

· For part (v), the Council informed Mrs X that, at the time it responded to her request, it had not established whether or not it actually held the information requested concerning sickness costs. Modifying its original decision, the Council informed Mrs X, in terms of section 18 of FOISA, that it could neither confirm nor deny whether it held this information, as to do so would be contrary to the public interest. If the information existed, the Council explained, it would be considered to be personal data and therefore exempt from disclosure under section 38(1)(b) of FOISA.

6. On 2 August 2017, Mrs X wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. Mrs X stated she was dissatisfied with the outcome of the Council's review because it had refused to answer her questions.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that Mrs X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

8. On 6 September 2017, the Council was notified in writing that Mrs X had made a valid application. The Council was asked to send the Commissioner the information withheld from Mrs X. The Council provided the information and the case was allocated to an investigating officer.

9. At the start of the investigation, the investigating officer sought further clarification from Mrs X on the scope of her dissatisfaction. On 6 October 2017, Mrs X clarified that not only was she unhappy with the Council's refusal to provide information (parts (ii) and (v)), she was also dissatisfied with its response to parts (i) and (iv) of her request, as she believed this information must be held by the Council.

10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application, and answer specific questions. These focused on:

· the searches carried out to identify and locate any information held by the Council and falling within the scope of parts (i) and (iv) Mrs X's request,

· the Council's justification for its reliance on any provisions of FOISA it considered applicable to the information requested, and

· why, having initially informed Mrs X that some information was held but considered to be exempt from disclosure, the Council changed its position at review stage to neither confirming nor denying whether that information was held.

11. As the Council was withholding some personal data under the exemption in section 38(1)(b) of FOISA, Mrs X was also asked to explain why she believed she had a legitimate interest in accessing this information.

12. Both parties provided submissions to the Commissioner.

13. During the investigation, the Council informed the Commissioner that it wished to change its position regarding its response to part (v) of the request. It provided submissions to the effect that it held no information falling within the scope of this part of the request. The Council confirmed it now wished to rely on section 17 of FOISA for this information, and that it no longer sought to rely on section 18. The Commissioner will consider the application of these provisions later in this decision.

Commissioner's analysis and findings

14. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mrs X and the Council. He is satisfied that no matter of relevance has been overlooked.

Section 18 of FOISA - "neither confirm nor deny" - part (v) of request

15. In its review outcome of 30 March 2017, the Council applied section 18 of FOISA, refusing to confirm or deny whether it held any information falling within the scope of part (v) of Mrs X's request, or whether that information existed. The Council adhered to this position in its initial submissions to the Commissioner.

16. Section 18 of FOISA allows Scottish public authorities to refuse to confirm or deny whether they hold information in the following limited circumstances:

(i) a request has been made to the authority for information which may or may not be held by it; and

(ii) if the information were held by the authority (and it need not be), it could give a refusal notice under section 16(1) of FOISA, on the basis that the information was exempt information by virtue of any of the exemptions in sections 28 to 35, 38, 39(1) or 41 of FOISA; and

(iii) the authority considers that to reveal whether the information exists or is held by it would be contrary to the public interest.

17. It is not sufficient for the public authority to simply claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if it existed and was held, would be exempt information under one or more of the listed exemptions. Where the exemption is subject to the public interest test in section 2(1)(b) of FOISA, the authority must also be able to satisfy the Commissioner that the public interest in maintaining the exemption outweighs any public interest there would be in disclosing any relevant information it held.

18. Where an authority has chosen to rely on section 18, the Commissioner must first establish whether, if the information existed and was held by the public authority, it would be justified in refusing to disclose the information by virtue of any of the exemptions provided for by sections 28 to 35, 38, 39(1) or 41 of FOISA (including any public interest test, where relevant). If he accepts this, he must then go on to establish whether the authority is justified in stating that to reveal whether the information exists or is held would be contrary to the public interest.

19. In its review outcome, the Council explained to Mrs X that, prior to issuing its original response to part (v) of the request, it had failed to establish what (if any) information was held. The Council changed its original decision (that it did not hold the information) and informed Mrs X that, in terms of section 18 of FOISA, it could neither confirm nor deny whether it held the information requested. It explained to Mrs X that, if it did hold any information falling within the scope of part (v) of her request, it could be withheld under the exemption in section 38(1)(b) of FOISA. Essentially, it adhered to this position in its initial submissions to the Commissioner.

20. During the investigation, the Council reached the conclusion that that it did not, in fact, hold any information falling within the scope of part (v) of the request and withdrew its reliance on section 18. It informed the Commissioner that it now wished to rely on section 17 of FOISA for this part of Mrs X's request. The Commissioner will consider the application of section 17 later in this decision.

21. In this case, the Commissioner is of the view that the Council's initial response to part (v) of Mrs X's request clearly stated that the information she sought existed and was held by the Council. The review response confirmed that the Council was refusing to provide the information, which it considered to be personal data and therefore exempt from disclosure under section 38(1)(b) of FOISA.

22. By refusing to provide the information under section 38(1)(b), the Council gave Mrs X a formal refusal notice in terms of section 16 of FOISA. It follows from the issue of a refusal notice under section 16 - a refusal to disclose information which the authority holds and which it considers to be exempt - that the authority giving that notice is confirming it holds the information to which the request relates. That, in any event, was evident from the Council's original response.

23. The Commissioner notes the Council's explanation, in its review outcome, that it had failed to originally identify whether or not the information was held, prior to issuing its original response. The Commissioner does not accept that an authority can confirm to a requester that the information is held (even, as the Council has submitted in this case, in error) and then subsequently revert to a position where it refuses to confirm or deny the existence of that information. To do so would make no sense and, in the Commissioner's view, would bring into disrepute a provision designed for a very serious purpose.

24. The Commissioner is also concerned to note that, at the time it issued its review outcome, the Council had failed to conclude whether or not it held any information falling within the scope of part (v) of the request. While section 18 provides that a public authority does not have to reveal whether or not information is held, in order to be able to issue a section 18 notice, a public authority must first establish whether or not it holds the information requested. There is no provision in FOISA that allows public authorities to rely on section 18 purely to mask any uncertainty they have about whether or not they actually hold the requested information. In responding to any information request, it is fundamental that a public authority must first determine what, if any, information it holds, in line with the provisions in section 1 of FOISA. There is no exception to this when considering a response under section 18.

25. In all the circumstances, therefore, the Commissioner finds that the Council was not entitled to apply section 18 of FOISA in responding to part (v) of Mrs X's request for review.

26. Given that, during the investigation, the Council withdrew its reliance on section 18 of FOISA for this part of Mrs X's request, he does not require it to take any further action in response to this failure.

27. The Commissioner will now go on to consider whether the Council was entitled to apply section 17 to part (v) of Mrs X's request, along with the other parts for which it made this claim.

Whether the Council held any information - parts (i), (iv) and (v) of request

28. Under section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received.

29. Under section 17(1) of FOISA, where an authority receives a request for information it does not hold, it must give the applicant notice in writing to that effect.

30. The standard proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant information is (or was, at the time the request was received) actually held by the public authority.

Part (i) of request

31. In this case, the Council notified Mrs X, in its review outcome, that it did not hold the information she had asked for. The Council maintained this position in its submissions to the Commissioner.

32. The Council provided the Commissioner with details of the searches carried out in reaching this conclusion. It explained that, at review stage, the Director of Social Care, the Service Manager and two Divisional General Managers had been asked to search their emails and all communications in relation to this matter. These searches identified no information falling within the scope of part (i) of the request. The Council confirmed it was satisfied, following the review, that a thorough search for this information had been carried out and no information was held.

33. During the investigation, the Council was asked to carry out, and duly conducted, a search of a former employee's email account and personal drives. Again, no information falling within the scope of this part of the request was identified.

34. The Council confirmed its position was that the release of the first report was simply not authorised. To support this, the Council provided the Commissioner with a copy of a report of a related investigation carried out by external solicitors, Anderson Strathern (the "AS Report"). The Council submitted that this report (dated 19 June 2017 and thus post-dating Mrs X's request) did not state who authorised the sending of the first report. In the Council's view, the AS Report concluded that there was no authorisation, concurring with the Council's position.

35. In her submissions to the Commissioner, Mrs X argued that the AS Report clearly showed that Council senior managers were aware, from the beginning, who agreed that the first report should be sent.

36. Mrs X submitted that, given the impact the report's release had had on the health of an individual, it was morally and legally appropriate to know who authorised the first report to be sent. This would allow consideration of what formal course of action could be taken against the individual(s) involved.

37. The Commissioner has considered all relevant submissions on this matter and the terms of the request. The Commissioner is satisfied that the Council took adequate, proportionate steps to establish whether it held information falling within part (i) of the request. He accepts that any information relevant to part (i) would have been identified using the searches described by the Council.

38. The Commissioner has also taken account of the content of the AS Report. While this report documents the series of events which led to the release of the first report, he must concur with the Council's view that it does not record who authorised the sending of the first report. In the Commissioner's view, had any such authorisation been given, in all likelihood this would have been documented in the AS Report.

39. The Commissioner is therefore satisfied, on the balance of probabilities, that the Council does not (and did not, on receiving the request) hold the information requested in part (i). By giving notice under section 17 at review stage, therefore, the Council complied with Part 1 of FOISA.

Part (iv) of request

40. In this case, the Council notified Mrs X, in both its initial response and its review outcome, that it did not hold the information she had asked for. The Council maintained this position in its submissions to the Commissioner.

41. The Council explained that it did not maintain a corporate time recording system. While individual services might record time against an individual file (for example, within its Legal Services department), there was no time recording, across the Council or within specific areas, relating to this particular matter. In any event, the Council submitted, any time recording would relate to staff time only and not to any other indirect costs.

42. The Council acknowledged that, while it could arrange for those involved to provide an estimate of the time they had spent on this matter, it was under no obligation to create new information in order to be able to provide a response to an information request. Neither did the Council consider that such an estimate would provide an accurate or meaningful response.

43. In conclusion, the Council was satisfied that it did not hold the information requested in part (iv).

44. In her submissions to the Commissioner, Mrs X argued that the costs involved would have been substantial. She considered that the Council should be required to provide an estimate of the costs so it could be held to account publicly for its expenditure. In Mrs X's view, the taxpayers of Fife had a right to know the costs involved, yet the Council was unwilling to disclose this information in fear of being seen to be wasteful, negligent or even corrupt.

45. Mrs X was of the view that the information should be disclosed, to allow consideration of what further action could be taken to hold the Council and its officers to account.

46. The Commissioner has considered all relevant submissions on this matter and the terms of the request. He is satisfied that the Council took adequate, proportionate steps to establish whether it held any information falling within the scope of part (iv).

47. The Commissioner recognises that it is normal practice for the Council (and indeed many other public and private bodies) to deal with matters, such as the issue referenced here, as part of its routine, core activity and there is no expectation, requirement, or indeed common practice to record the costs involved.

48. As indicated in many previous decisions, the Commissioner cannot compel public authorities to create new information (including estimates) in order to be able to satisfy an information request.

49. In light of this, the Commissioner is satisfied that the Council does not (and did not, on receiving the request) hold the information requested in part (iv). By giving notice under section 17, therefore, the Council complied with Part 1 of FOISA.

Part (v) of request

50. As rehearsed previously in this decision, during the investigation the Council changed its position for this part of Mrs X's request. It informed the Commissioner that it had come to the conclusion that it did not hold the information requested, confirming it now wished to rely on section 17 of FOISA for part (v).

51. The Council explained that it had interpreted this part of Mrs X's request as the cost of sickness absence for specified employees, following the release of the first report in January 2016. This was the Council's interpretation of this part of the request throughout the entire process, without variation.

52. During the investigation, the Council informed the Commissioner that, although it held information that recorded the reason (provided by the employee or, where appropriate, a medical practitioner) for any absence due to sickness, i.e. the medical condition, the record would not include any specific work issue to which the absence might be attributed. Accordingly, the Council submitted, it was not possible to establish a direct link between any sickness absence and the release of the first report.

53. The Council explained that searches had been carried out by staff within its Human Resources and Payroll departments, using the employees' names and payroll numbers, covering the period from 1 January 2015. The Council provided the Commissioner with screenshots of the search results, to support its position that the information requested was not held.

54. In her submissions to the Commissioner, Mrs X argued that it was in the public interest to know how much it cost the Council in sickness pay for specified individuals who, she believed, were absent as a direct consequence of the Council's investigation.

55. Mrs X submitted that she had not requested a breakdown of the cost for each individual, but rather a total cost. She argued that it was not possible to conclude, from a total financial cost of sickness absence, the cost attributable to each individual, the length of time each individual was absent, or the reasons for their absence.

56. Mrs X believed that the issue here was not a personal data one, as raised by the Council, but a very real public interest issue regarding the expensive costs of a contrived series of investigations. In her view, were the sickness absence costs relating to the Council's investigation made public, the senior managers involved would have to be held to account.

57. The Commissioner has considered all relevant submissions on this matter and the terms of the request. He is satisfied that the Council would need to be able to establish a link between the investigations referred to in the request and sickness absences of the staff concerned before it could say it held information falling within the scope of part (v).

58. The Commissioner recognises that it is normal practice for the Council (and indeed many other public and private bodies) to record the reasons for sickness absence in line with the information provided by an employee (or, where required, by the medical practitioner certifying the absence). He accepts that such information will only record the medical reason for the absence and will not extend to recording details of any specific work issue which may have given rise to the absence. Indeed, even where a medical reason for an absence may be recorded as "work related", that will be the extent of the level of detail held. It is not for the Commissioner to determine whether such information should be recorded or, as rehearsed above, to require public authorities to create new information in order to be able to satisfy an information request.

59. In any event, the Commissioner has considered fully the submissions provided by the Council on the searches it carried out for this part of the request. In the light of all relevant submissions, the Commissioner is satisfied that, by the end of the investigation, the Council had taken adequate, proportionate steps to establish whether it held any information falling within the scope of part (v). He finds that the Council does not (and did not on receiving the request) hold the information requested in part (v).

60. To comply with section 17(1) of FOISA, however, the Council should have given Mrs X the requisite notice by, at the latest, the conclusion of its review.

Section 38(1)(b) (Personal information) of FOISA - part (ii) of request

61. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, section 38(2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

62. In order to rely on this exemption, the Council must show, firstly, that any such information would be personal data for the purposes of the DPA and, secondly, that disclosure of that data would contravene one or more of the data protection principles to be found in Schedule 1.

63. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

64. The Council was asked to confirm whether it wished to continue to rely on section 38(1)(b) of FOISA in respect of the withheld information relating to part (ii) of Mrs X's request and, if so, to explain the basis on which it was doing so.

65. In response, the Council informed the Commissioner that it wished to rely on the information provided in its review outcome. In the absence of any further submissions, the Commissioner has taken the Council's review response to part (ii) as being its submissions on the application of section 38(1)(b).

Is the information under consideration personal data?

66. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

67. The Council submitted that the information under consideration in this case was personal data as defined by section 1(1) of the DPA. It explained that the information related to an employee who released the first report, specifically that individual's name.

68. The Commissioner has considered the Council's submissions on this point, along with the withheld information. In line with these submissions, he is satisfied that the information comprises personal data. It records the name of the individual who sent the report. Clearly, it is possible to identify a living individual from it. It is about that individual and so can be said to relate to him/her. It is therefore that individual's personal data, as defined by section 1(1) of the DPA.

69. As indicated above, the Commissioner considers the withheld information to be the personal data of the individual to whom it relates. In the circumstances, including the terms of the request and the actual information held, he does not consider it would be possible to disclose any of the withheld information without a real risk remaining that the individual could be identified: consequently it would remain that individual's personal data.

Would disclosure contravene the first data protection principle?

70. The Council argued that disclosure of the withheld personal data would contravene the first data protection principle. This requires that personal data are processed fairly and lawfully. The processing in this case would be the disclosure of the information into the public domain, in response to Mrs X's request.

71. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that the personal data in question are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for him to consider the conditions in Schedule 3 in this case.

72. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, he must then consider whether disclosure of the information would be fair and lawful.

73. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

74. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of the information to Mrs X. In any event, neither Mrs X nor the Council has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual to whom the data relates).

75. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does Mrs X have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for Mrs X's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

76. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of Mrs X must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mrs X.

Does Mrs X have a legitimate interest in obtaining the personal data?

77. In her submissions, Mrs X provided the Commissioner with background information, from her perspective, on the matters that had led to the release of the first report to a member of the public, and the events and consequences that had resulted from this disclosure. Given the sensitivity of these matters, the Commissioner is unable to go into these in any further detail within this decision notice: however, he has taken full account of Mrs X's submissions on these points.

78. Mrs X argued that, given the adverse impact on specific individuals that had resulted following the report's disclosure, it was morally and legally appropriate to know, through the FOI process, who sent the first report. Mrs X submitted that this would allow consideration of what formal action could be taken against the individual involved.

79. In Mrs X's view, the Council's refusal to provide this information was an effort to protect a senior manager, and was completely at odds with its open and transparent policies.

80. The Council accepted that Mrs X had a legitimate interest in knowing the name of the person who released the first report.

81. The Commissioner has considered all the relevant submissions he has received on this point, along with the withheld personal data.

82. The Commissioner considers that Mrs X has a legitimate interest in the withheld information, as disclosure would provide transparency about the individual who sent the first report to a member of the public. Given the issues surrounding the sensitivity of the report, its disclosure into the public domain and the consequences resulting from that disclosure, the Commissioner considers that this is, at least potentially, a matter of wider public interest, and he considers this relevant in this case for the purposes of determining whether Mrs X herself has a legitimate interest. In all the circumstances, he accepts that Mrs X has a legitimate interest in obtaining the withheld personal data.

Is disclosure necessary to achieve those legitimate interests?

83. The Commissioner must now go on to consider whether disclosure of the withheld personal data would be necessary to meet the legitimate interest he has identified above. As indicated above, this will include consideration of whether the legitimate interest might be met by alternative means which interfered less with the privacy of the data subject.

84. In this case, the Commissioner has carefully considered all relevant submissions he has received, along with the withheld information. He accepts that the legitimate interest in transparency he has identified above cannot be met in full without disclosure of the withheld personal data. To that extent, disclosure is necessary, so he must go on to consider whether it would nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Would disclosure nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

85. This involves a balancing exercise between the legitimate interests of Mrs X and those of the data subject. Only if the legitimate interests of Mrs X outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.

86. In the Commissioner's briefing on the personal information exemption in section 38 of FOISA[1], he notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

(i) whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

(ii) the potential harm or distress that may be caused by disclosure;

(iii) whether the individual objected to the disclosure;

(iv) the reasonable expectations of the individual as to whether the information should be disclosed.

87. In her submissions, Mrs X informed the Commissioner that the information was required to allow consideration of what formal action could be taken against the individual who had released the first report.

88. The Council did not make any submission on whether the information related to the data subject's private life, or whether the data subject had any reasonable expectation that their personal data would be disclosed into the public domain.

89. The Council submitted that, having considered the consequences of disclosure of this information into the public domain, it concluded that this would likely have an unjustified adverse effect on the data subject. In the Council's view, disclosure of the information could expose the data subject to threats or reprisals potentially causing harm.

90. As such, the Council believed disclosure would cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject, and that this outweighed any legitimate interest Mrs X had in obtaining the information. Accordingly, the Council concluded that condition 6 of Schedule 2 to the DPA could not be met.

91. The Commissioner has taken account all relevant submissions by both parties, together with the withheld information.

92. The Commissioner has already found that Mrs X has a legitimate interest in obtaining the information, to allow consideration of any formal action which might be taken against the individual involved. He accepts that Mrs X has strong (and understandably) personal reasons for requiring disclosure of the personal information. However, he must approach this question on the basis that disclosure under FOISA would be to the world at large, and not just to Mrs X.

93. The Commissioner acknowledges that the withheld personal data record the name of the employee who released the first report to a member of the public, and this therefore relates to that individual's public life. He recognises that this individual could be considered to be relatively senior, and therefore subject to a higher level of scrutiny. The Commissioner considers it is still appropriate, however, to consider what reasonable expectation the data subject would have (in the particular circumstances of this case) in relation to disclosure of the information concerned into the public domain, and the potential harm or distress that may be caused by its disclosure.

94. Given the subject matter of the first report and the circumstances surrounding its disclosure (considered at length in the AS Report) to a member of the public, in the absence of any satisfactory evidence to the contrary, the Commissioner is of the view that the data subject would likely have had no expectation that their identity, in this context, would be placed into the public domain.

95. The Commissioner is also of the view, taking account of all the circumstances, disclosure of the information would likely have the potential to cause considerable harm and distress to the data subject, as claimed by the Council, and would therefore be unwarranted.

96. Having considered the competing interests outlined above, the Commissioner must balance them. Having done so, in this particular case, the Commissioner finds that Mrs X's legitimate interests are outweighed by the unwarranted prejudice that would be caused to the data subject's rights, freedoms and legitimate interests. That being the case, the Commissioner must also conclude that disclosure would be unfair. Consequently, the Commissioner is satisfied that the requirements of condition 6 in Schedule 2 to the DPA cannot be met in this case.

97. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the withheld information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.

Other matters

98. The Commissioner notes Mrs X's dissatisfaction that, following its original response, the Council subsequently changed its response to certain parts of her request at review stage.

99. Section 21(4)(a) and (b) of FOISA provides that, when responding to a requirement for review, a Scottish public authority may uphold, modify or substitute its original decision. That said, the Commissioner would urge the Council, and indeed all Scottish public authorities, to ensure that their initial response to an information request is accurate and informed.

Decision The Commissioner finds that Fife Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mrs X. The Commissioner finds that the Council was entitled to: (i) give notice, in terms of section 17(1) of FOISA, that it held no information falling within the scope of parts (i) and (iv) of Mrs X's request, and (ii) withhold the information covered by part (ii) of the request under section 38(1)(b) of FOISA, given that it comprised personal data and disclosure would contravene the first data protection principle. However, the Commissioner also finds that the Council was not entitled to refuse to either confirm or deny, in terms of section 18 of FOISA, whether the information requested in part (v) of the request existed or was held by it. Given that, by the end of the investigation, the Commissioner was satisfied that the Council did not hold any information falling within the scope of part (v), and so could rely on section 17(1) of FOISA, he does not require the Council to take any action in respect of this failure in response to Mrs X's application. He must find, however, that the Council failed to comply with section 17(1) in not giving the requisite notice in response to Mrs X's requirement for review.

Appeal

Should either Mrs X or Fife Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

7 December 2017

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

…

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---