Decision 206/2010 Mr Ian Benson and the University of Glasgow

Staff email addresses

Reference No: 201001153
Decision Date: 8 December 2010

Summary

Mr Benson asked the University of Glasgow (the University) to provide a list of the workplace email addresses for all staff.

The University refused Mr Benson's request.It advised that the information as requested was exempt from disclosure under section 25 of the Freedom of Information (Scotland) Act 2002 (FOISA), and provided details of website access to staff email addresses.This decision was upheld after review. Mr Benson remained dissatisfied and applied to the Commissioner for a decision.

After investigation, the Commissioner found that the exemptions in section 25 and section 30(c) (as later applied by the University) could not be upheld, the information being neither otherwise accessible to the applicant nor likely to cause substantial prejudice to the effective conduct of public affairs through its disclosure.However, as Mr Benson now had access to the information by other means, the Commissioner did not find it necessary to order disclosure of the information.

 

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) section 1(1) and (6) (General entitlement); 2(1) and (2)(a) (Effect of exemptions); 11(1) and (2) (Means of providing information); 25(1) (Information otherwise accessible) and 30(c) (Prejudice to effective conduct of public affairs)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1.On 26 April 2010, Mr Benson wrote to the University to request the following information:

"A list of the workplace e-mail addresses for all staff.By workplace I am referring to corporate e-mail addresses ending in .ac.uk.By staff I am referring to all individuals employed by your institution.Please note that I do not require any segmentation of the list or any associated details."

2.The University responded to Mr Benson's request the same day, on 26 April 2010.It advised him that the information was available on its website, and provided a link.It advised that the information was exempt from disclosure under section 25 of FOISA, as it was otherwise accessible.

3.On 27 April 2010, Mr Benson wrote to the University to seek a review of its response.He argued that the exemption in section 25 of FOISA was not appropriate, given the work required to compile a list of email addresses from the information available on the University website.He advised the University that he suffered from keyboard strain which limited his daily computer work.The work involved in compiling a list of email addresses from the University website would make serious inroads into his daily quota of keyboard time.He believed that the University had an obligation to consider whether information which was generally "reasonably accessible" was also reasonably accessible to him as the applicant.

4.Mr Benson also queried whether the information available on the website was likely to be the same as the data available from the University's email server.He believed it was incorrect to claim that the information he had asked for was available from the website.

5.Mr Benson referred to section 11 of FOISA (Means of providing information).He considered that supplying a list of addresses as originally requested was (in terms of section 11(1)) a "reasonably practicable" step for the University to take.

6.The University provided its review response on 25 May 2010.It provided some additional information about the way in which the email addresses on its website were kept up-to-date, and advised that it had also taken into account the personal circumstances that he had outlined.However, the University upheld the response given previously, namely, that the information requested was available from its website.

7.Mr Benson remained dissatisfied with the University's response and applied for a decision from the Commissioner, in terms of section 47(1) of FOISA, on 5 June 2010. While he was happy to accept the University's assurance that the data on its website was up to date, he felt that the University had failed to address his argument that this information was not reasonably accessible to him.He stated that other universities had provided lists of email addresses without delay or requiring excessive keyboard use on his part.

8.The application was validated by establishing that Mr Benson had made a request for information to a Scottish public authority and had applied for a decision from the Commissioner only after asking the authority to review its response to that request.The case was then allocated to an investigating officer.

Investigation

9.On 1 July 2010, the University was notified in writing that an application had been received from Mr Benson, and was invited to provide comments on his application, as required by section 49(3)(a) of FOISA.

10.The University was asked whether its response to Mr Benson of 25 May 2010 had taken into account the statement he had provided about his disability (email of 27 April 2010).The University was invited to comment on the application of the exemption in section 25 of FOISA.It was also asked whether it would be possible, technically, for it to produce a single list of the staff email addresses available on its website, and if so, whether the University would be prepared to provide this to Mr Benson in settlement of the case.Finally, the University was asked whether any staff had ever notified concerns regarding the availability of their email address.

11.The University responded on 23 July 2010, addressing each of these points.The University advised that in responding to Mr Benson it had taken into account advice and guidance received from both the Commissioner's office and (UK) Information Commissioner's office, and had also been mindful of the Information Tribunal Decision EA/2006/0027, which had discussed the risk of business disruption by electronic means such as spam and phishing emails.

12.A further submission was received from the University on 24 August 2010, in which the University argued that the information requested by Mr Benson was also exempt from disclosure under section 30(c) of FOISA.

13.Relevant submissions received form both the University and Mr Benson are considered in detail in the next part of this decision notice.

14.During the investigation of another of Mr Benson's applications for a decision, he provided information about computer software which enables the user to harvest emails from individual websites.This information was taken into consideration by the Commissioner in reaching his decision on this case.

Commissioner's analysis and findings

15.In coming to a decision on this matter, the Commissioner has considered all of the information withheld and the submissions which have been presented to him and is satisfied that no matter of relevance has been overlooked.

Format of information requested

16.The University does not offer a list of email addresses on its website.The University has confirmed that it would be possible to compile such a list, at a cost of around ?500 due to the staff time required.The University is reluctant to incur these costs in supplying information which it regards as freely and reasonably obtainable through its website.

17.Before considering the exemptions applied by the University, the Commissioner will consider whether Mr Benson is entitled, under FOISA, to specify that the information requested should be provided in list format.

18.Section 11(2) of FOISA provides that where an applicant has asked for a copy of the information, a digest or summary of the information, or the opportunity to inspect a record containing the information, the authority must comply with their stated preference insofar as it is reasonably practical for it to do so (section 11(1)).

19.The Commissioner does not consider that a request for information in list format is the same as a request for information in digest or summary form.The terms "digest" and "summary" imply that the information has been condensed or abbreviated in some way, whereas a list is a series of related items presented sequentially but not necessarily condensed or abbreviated.

20.The Commissioner therefore finds that section 11(1) of FOISA does not require to be considered in relation to Mr Benson's request for a list of email addresses, and that Mr Benson was not entitled, under section 11 of FOISA, to stipulate that the University should provide the information requested in list format.

21.The Commissioner will go on to consider the exemptions applied by the University.

Section 25 of FOISA

22.Under section 25(1) of FOISA, information which an applicant can reasonably obtain other than by requesting it under section 1(1) of FOISA is exempt information. The exemption in section 25(1) is absolute, in that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.

23.In this case, the University advised Mr Benson that the information he sought (all staff email addresses) was exempt under section 25 as it was already available from its website at www.gla.ac.uk/stafflist .This page allows the user to search for individual members of staff by surname or part of surname; by college or university service; or by school or research institute.

24.In his request for a review (27 April 2010), Mr Benson disputed that this was sufficient to satisfy his request, arguing that he had asked for a list of email addresses and that the volume of work required in order to construct a list of the email addresses by accessing the information on the website was so great that the information could not be described as reasonably accessible.Mr Benson calculated that to compile a list would require 40,649 mouse clicks (7 clicks for each of 5807 staff) and would take him 24 hours.

25.Mr Benson went on to explain that physical problems limited the amount of time each day he could spend using a keyboard.He believed the University had an obligation to consider whether information deemed reasonably accessible generally was also reasonably accessible to him as the particular applicant.

26.In his application to the Commissioner, Mr Benson argued that the email addresses on the University website did not fulfil the definition of a list, in much the same way that a box of loose invoices did not constitute a set of accounts.The Commissioner has addressed this point already, and has found that Mr Benson is not entitled to stipulate that the information requested should be provided as a list.The question for the Commissioner to consider, in relation to section 25(1) of FOISA, is whether or not the information requested (all staff email addresses) could be reasonably obtained by Mr Benson other than by requesting it under section 1(1) of FOISA.

27.As the Commissioner has said in his published guidance[1], section 25 has a different focus from other exemptions in FOISA.It is not about withholding information from the public, but instead recognises that where information is already available to the applicant there is no need to provide an alternative right of access through FOISA.

28.The exemption also differs from others in FOISA in requiring that the particular circumstances of the applicant be taken into account in deciding whether the information is already available to them by other means.Information which is reasonably obtainable by one applicant may not be accessible to another.

29.In its submission, the University described advice given by a representative of the (UK) Information Commissioner at a meeting of the HE/FE Records Manager and Information Compliance Group, which it wished the Commissioner to take into account in reaching his decision.The University stated that the advice given to the meeting was that where a public authority had informed the applicant that the information was otherwise accessible, and had supplied a [website] link (where available), then the authority's obligations under FOI legislation had been discharged and the length of time it might or might not take the applicant to work their way through the information was outwith the authority's responsibility.

30.The University also described advice received from the (Scottish Information) Commissioner's office, to the effect that if the information in question was accessible without any previous experience or knowledge of the University and its structure, and it was possible to interrogate the system in a number of ways, it could be regarded as reasonably accessible.It was noted that this guidance was issued with the disclaimer that it could not be regarded as definitive if the case was appealed to the Commissioner, as has now happened.

31.As stated above, section 25 can only apply where the information is reasonably obtainable by the person who has requested it.The University was asked whether it had taken into account Mr Benson's statement about his restricted ability to use a keyboard, when reviewing its response to his request.

32.The University advised that it had noted and carefully considered Mr Benson's statement.However, the University was aware that Mr Benson's request was one of 7 requests he had submitted to Further Education institutions within a 48 hour period; that Mr Benson runs a website which offers to make freedom of information requests to UK Universities; that this website has published reports which are compiled by sending the same FOI request to all 125 UK Universities and tabulating the responses; and that Mr Benson has made frequent and lengthy postings to the Times Higher Education website.The University took the view that these activities did not appear to correspond with Mr Benson's statement regarding his disability, or his ability to submit and manage his information requests.

33.The University did not accept Mr Benson's assessment that it would take 7 clicks to access each email address, and concluded that his calculation of the time required to access the information must also be queried.

34.The Commissioner agrees with the University that 7 clicks are not required to access each email address, when starting from www.gla.ac.uk/stafflist.However, given that there are around 6000 staff email addresses on the University website, each of which must be accessed individually, the Commissioner believes it is reasonable to accept that significant work would be required on Mr Benson's part to obtain all staff email addresses in this way.The question is whether the amount of work required would mean that the information is not reasonably obtainable by Mr Benson.

35.Mr Benson advised the Commissioner that he could access, copy and paste no more than four email addresses a minute from the University website.At four email addresses per minute, it would take 25 hours to copy and paste 6000 email addresses.Mr Benson has explained that the intensive use of the mouse required in copying and pasting means that he can only work on such tasks for short periods.In his view, the length of time required to complete the task would effectively prevent him from accessing all the information covered by his request.

36.The Commissioner believes that Mr Benson has provided a reasonable estimate of the time required by any person to locate, copy and paste the email addresses singly.For the exemption in section 25 to apply, the information must be "reasonably" obtainable by the applicant, not simply obtainable.The Commissioner takes the view that in a case such as this, the time required to obtain the information should be taken into account in assessing whether the exemption applies.Although individual staff email addresses are easily accessible through the University website, Mr Benson asked for all staff email addresses.The Commissioner considers that information which would take Mr Benson (or indeed any applicant) around 25 hours to obtain cannot be described as "reasonably" obtainable.

37.The Commissioner therefore finds that the exemption in section 25(1) of FOISA was wrongly applied to the information requested by Mr Benson.

Section 30(c) of FOISA

38.Section 30(c) of FOISA applies where the disclosure of information would "otherwise" prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs. The word "otherwise" refers (by exception) to the exemptions in section 30(a) and (b).Section 30(c) is a broad exemption, and the Commissioner expects any public authority citing this exemption to show what specific harm (which must be at the level of substantial prejudice) would, or would be likely to, be caused to the conduct of public affairs by release of the information.

39.This exemption is subject to the public interest test laid down by section 2(1)(b) of FOISA.

40.The University has argued that to supply a list of email addresses for all members of staff would be likely to result in unsolicited marketing emails to all staff, which could cause major disruption (possibly resulting in an effective shut-down of the University's email systems) and consequently a real and significant burden in terms of expense and distraction to the University and its staff.The University therefore considered that disclosure of the information requested would, or would be likely to, prejudice substantially the University's ability to conduct its affairs effectively.

41.The University confirmed that there had been instances where its employees had expressed concerns and submitted complaints regarding the availability of their email addresses and the unwanted spam, phishing emails and marketing or advertising material they believed had resulted from this availability.The University stated that such unsolicited contact had caused disruption to these individuals personally and professionally and consequently to the University's ability to operate effectively, and that it was understandably concerned about this issue.The University did not provide or make reference to any specific examples of such harm.

42.The University referred to a decision from the Information Tribunal (Appeal No. EA/2006/0027)[2], which discussed the risk of business disruption by electronic means such as spam and phishing emails.It was mindful that the Information Tribunal had given serious consideration of this issue as a substantial factor militating against the disclosure of email lists (as detailed in the Appeal Decision previously mentioned) and advised that the views expressed by the Tribunal directly corresponded with the views of the University's Department of Computing Service.

43.The University considered that in terms of the public interest, the public interest in disclosure of the information was slight, especially in view of the fact that staff email addresses were freely available and accessible through the University's website.The University considered that the public interest in withholding the information was greater than the public interest in disclosure.

44.Mr Benson provided the Commissioner with information about his reasons for requiring all staff email addresses, which related to his website AcademicFOI.com.He confirmed that he hoped to acquire email addresses for all staff in UK Universities, and that he planned to contact staff once or twice a year.He explained that the emails would be sent in blocks, in a way designed to avoid overloading any University email server.He did not believe that the use he would make of the email addresses would cause the sort of disruption envisaged by the University or change existing patterns of email traffic in any material way.

45.Mr Benson referred to some of the ways in which organisations could protect themselves from spam email, and argued that if a University failed to take such measures, this was not a reason to refuse an information request.

46.The Commissioner must consider the effects of disclosure to the public at large, not just to Mr Benson, as information disclosed under FOISA is considered to enter the public domain. Assuming he were satisfied that Mr Benson himself did not intend to use the information in a way which could harm the University, he would still require to consider whether disclosure of a list of staff email addresses into the public domain would, or would be likely to, prejudice substantially the University's ability to conduct its public affairs effectively.

47.The Commissioner does not consider that the University has demonstrated that disclosure of all staff email addresses would, in itself, substantially prejudice the University's ability to conduct its business effectively.The University has alluded to the disruptive effect of spam and phishing emails, but has not explained why the danger of such disruption would be materially increased by disclosure of a list of emails which are individually available on its website.

48.The Commissioner notes that the University has in place a policy and procedures for dealing with spam email[3], showing that it has already taken measures to protect its systems from disruption.

49.The University has referred to arguments put forward in relation to the Information Tribunal decision EA/2006/0027, but has not explained why these are relevant to the particular circumstances in which the University operates (for example, why its existing anti-spam measures might fail to cope with an increase in spam caused by disclosure of the list; or what impact an increase in spam might have in terms of the staff time or other resources required to deal with it).

50.As stated in his published guidance on the use of the exemption in section 30(c), and as noted above, the Commissioner expects any public authority citing this exemption to show what specific harm (which must be at the level of substantial prejudice) would, or would be likely to, be caused to the effective conduct of public affairs by release of the information.The Commissioner does not accept that the University has provided him with such evidence.Accordingly, the Commissioner cannot uphold the use of the exemption in section 30(c) of FOISA in relation to the information requested by Mr Benson.

51.As he has found the exemption in section 30(c) of FOISA to have been wrongly applied, the Commissioner is not required to consider the balance of public interest in disclosing or withholding the information, as set out in section 2(1)(b) of FOISA.

Conclusion

52.Neither of the exemptions applied by the University has been upheld by the Commissioner, and the normal course of action would be for the Commissioner to require the University to provide Mr Benson with the withheld information.However, during the investigation, Mr Benson informed the Commissioner that he now has access to a software programme which is capable of producing a list of the email addresses found on the University website.The Commissioner accepts Mr Benson's statement that he did not have access to such a programme when he made his information request to the University, but given that Mr Benson can now access the email addresses in a way which makes them "reasonably obtainable", the Commissioner does not require the University to provide this information to him as a result of this decision notice.

DECISION

The Commissioner finds that the University of Glasgow (the University) failed to comply with Part 1 (and in particular section 1(1)) of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Ian Benson.

The Commissioner finds that the University was not justified in withholding the information requested under the exemptions in section 25(1) and section 30(c) of FOISA.

For the reasons given in paragraph 52, however, the Commissioner does not require the University to provide Mr Benson with the information he requested.

Appeal

Should either Mr Benson or the University wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
8 December 2010

 

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1General entitlement

(1)A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6)This section is subject to sections 2, 9, 12 and 14.

2Effect of exemptions

(1)To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a)the provision does not confer absolute exemption; and

(b)in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

(a)section 25;

?

11Means of providing information

(1)Where, in requesting information from a Scottish public authority, the applicant expresses a preference for receiving it by any one or more of the means mentioned in subsection (2), the authority must, so far as it is reasonably practicable, give effect to that preference.

(2)The means are ?

(a)the provision to the applicant, in permanent form or in another form acceptable to the applicant, of a copy of the information;

(b)such provision to the applicant of a digest or summary of the information; and

(c)the provision to the applicant of a reasonable opportunity to inspect a record containing the information.

?

25 Information otherwise accessible

(1)Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.

?

30Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act -

?

(c)would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

[1] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=2663&sID=107

[2] http://www.informationtribunal.gov.uk/DBFiles/Decision/i101/MoD.pdf

[3] http://www.gla.ac.uk/services/it/regulationscommitteesandpolicies/securitypolicies/spampolicy/ and http://www.gla.ac.uk/services/it/forstaff/usinge-mail/spamfilterservice/