Decision 215/2011 Mr Peter Cherbi and Orkney Health Board

Information regarding the resignation of a named employee

Reference No: 201101133
Decision Date: 28 October 2011

Summary

Mr Peter Cherbi requested from Orkney NHS Board (NHS Orkney) information relating to the resignation of a named employee. NHS Orkney responded by providing Mr Cherbi with a copy of statement (announcing the resignation) published on its website and advising him that it considered personal data to be exempt from disclosure in terms of section 38(1)(b) of FOISA. Following a review, Mr Cherbi remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, during which NHS Orkney identified further information falling within the scope of Mr Cherbi's request and applied additional exemptions to this information, the Commissioner found that NHS Orkney had dealt with Mr Cherbi's request for information in accordance with Part 1 of FOISA.He concluded that NHS Orkney was entitled to withhold the requested information from Mr Cherbi in terms of section 38(1)(b) and 36(1) of FOISA.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (4) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 36(1) (Confidentiality) and 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 12 May 2011, Mr Cherbi wrote to Orkney NHS Board (NHS Orkney) requesting information concerning the resignation of a named employee (referred to hereafter as "the employee") from NHS Orkney for personal reasons.

2.NHS Orkney responded on 27 May 2011. It provided Mr Cherbi with a copy of the public statement it made regarding the employee's resignation, and advised him that it considered any detailed personal data it held about the employee to be exempt from disclosure under section 38(1)(b) of FOISA.

3.On the same day, Mr Cherbi wrote to NHS Orkney requesting a review of its decision.Mr Cherbi drew NHS Orkney's attention to the fact that the employee had taken up an appointment with another Scottish public authority shortly after leaving NHS Orkney's employment. Mr Cherbi commented that the employee is subject to public scrutiny in relation to decisions made in that new post, and that he, as a journalist, has a legitimate interest in obtaining information on the reasons surrounding their resignation from NHS Orkney.

4.NHS Orkney notified Mr Cherbi of the outcome of its review on 23 June 2011. In its review, NHS Orkney confirmed that it was withholding information from Mr Cherbi in terms of section 38(1)(b) of FOISA.

5.On 23 June 2011, Mr Cherbi wrote to the Commissioner, stating that he was dissatisfied with the outcome of NHS Orkney's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Mr Cherbi had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 27 June 2011, NHS Orkney was notified in writing that an application had been received from Mr Cherbi and was asked to provide the Commissioner with any information withheld from him. NHS Orkney responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted NHS Orkney, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, NHS Orkney was asked to justify its reliance on any provisions of FOISA it considered applicable to the information requested, with particular reference to the exemption in section 38(1)(b).NHS Orkney was also asked to fully consider the scope of Mr Cherbi's request and to confirm whether it had identified (and provided the Commissioner with copies of) all of the relevant information it held.

9.NHS Orkney responded to this letter on 3 August 2011. In this response, NHS Orkney provided answers to the questions raised by the investigating officer and provided copies of four additional documents that it had identified as falling within the scope of Mr Cherbi's request.NHS Orkney provided submissions in relation to these documents (and that previously identified), citing additional exemptions.

10.Mr Cherbi was also invited to comment on the matters raised by this case, particularly in relation to his legitimate interests in accessing the withheld information insofar as it was personal data, and his consideration of the public interest test.Mr Cherbi's comments were received on 16 September 2011.

11.All submissions received from NHS Orkney and Mr Cherbi, insofar as relevant, are considered in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr Cherbi and NHS Orkney and is satisfied that no matter of relevance has been overlooked.

The withheld information

13.NHS Orkney identified five documents as containing the information requested by Mr Cherbi.For the purposes of this Decision Notice, the five documents are referred as documents A, B, C, D and E.

14.In its submissions NHS Orkney stated that it was applying the following exemptions to the information contained in these documents:

Documents A and C were being withheld under section 38(1)(b) of FOISA

Document B was being withheld under sections 30, 36(1) and 38(1)(b) of FOISA

Document D was being withheld under sections 30 and 36(1) of FOISA

Document E was being withheld under sections 30, 36(1) and (2) and 38(1)(b) of FOISA

15.Having considered these documents, the Commissioner has noted that certain information within documents A and B relates to matters other than the resignation of the employee (including the wider operations of the department in which they worked, and the future of their post).

16.The Commissioner considers that this information falls outwith the scope of Mr Cherbi's information request, and so has excluded it from consideration in what follows.References to documents A and B in what follows are references to the parts of these documents that fall within the scope of Mr Cherbi's information request.

Section 38(1)(b) ? Personal information

17.NHS Orkney has applied the exemption in section 38(1)(b) of FOISA to documents A, B, C and E on the basis that this information is personal data of a third party, and disclosure of this information would breach the first data protection principle.

18.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (b) (as appropriate), exempts personal data from disclosure if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.

19.In considering the application of this exemption, the Commissioner will firstly consider whether the information is personal data as defined in section 1(1) of the DPA and, if it is, whether disclosure would breach the first data protection principle.

Is the information under consideration personal data?

20.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

21.Having considered the information contained in documents A, B, C and E, the Commissioner accepts that it is entirely the personal data of the named employee.In reaching this conclusion, he has noted that the content of the documents focus entirely on the resignation of the named employee, and they contain information about that employee's service history and the reasons for and terms of their resignation. The Commissioner is therefore satisfied that the information contained in documents A, B, C and E relates to a living individual who can be identified from that information, and that it is therefore personal data as defined in section 1(1)(a) of the DPA.

22.The Commissioner must now go on to consider whether disclosure of documents A, B, C and E would breach any of the data protection principles contained in Schedule 1 to the DPA. As noted above, NHS Orkney argued that disclosure would breach the first data protection principle.

Would disclosure breach the first data protection principle?

23.The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing under consideration in this case is disclosure into the public domain in response to Mr Cherbi's information request.

24.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

25.In the circumstances of this particular case, the Commissioner finds it appropriate to consider first whether there are any Schedule 2 conditions which would permit disclosure of the withheld personal data. Only if he is satisfied that there are, will he go on to consider whether any of the withheld information is sensitive personal data and, if so, whether there are any applicable Schedule 3 conditions.

Can any of the conditions in Schedule 2 of the DPA be met?

26.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.

27.The Commissioner considers that only condition 6 in Schedule 2 might be considered to apply in this case. Condition 6 allows personal data to be processed (in this case, disclosed in response to Mr Cherbi's information request) if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

28.There are a number of tests which must be met before condition 6(1) can apply. These are:

Does Mr Cherbi have a legitimate interest in obtaining this personal data?

If so, is the disclosure necessary to achieve those legitimate aims? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject (i.e. the employee to whom the data relates)?

Even if disclosure is necessary for the legitimate purposes of the applicant, would disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject? As noted by Lord Hope (above), there is no presumption in favour of the release of personal data under the general obligation laid down in FOISA. Accordingly, the legitimate interests of Mr Cherbi must outweigh the rights, freedoms or legitimate interests of the data subject before condition 6(1) will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that NHS Orkney was correct to refuse to disclose the personal data to Mr Cherbi.

Does Mr Cherbi have a legitimate interest?

29.Mr Cherbi was asked to comment on his legitimate interest in obtaining the personal data. He submitted thatthenamed employee took up a senior post with another Scottish public authority shortly after leaving NHS Orkney's employ and that it is in his interests, as an investigative journalist, to determine the reasons behind this person's resignation from NHS Orkney.Mr Cherbi referred to NHS Orkney's press release (announcing the resignation of the named employee) in which it states that another NHS Health Board would provide support (in the relevant area) until formal arrangements were made.

30.Mr Cherbi argued that he has a legitimate interest in fully understanding the circumstances surrounding the employee's resignation, given that another region's NHS Board had to provide support to NHS Orkney at short notice.

31.Mr Cherbi also argued that, in his role as an investigative journalist, he has a legitimate interest in finding out the "true circumstances" surrounding the named employee's resignation in order to ascertain whether the public statements made by NHS Orkney regarding the employee's service and resignation were honest.Mr Cherbi also maintained that it was in the public interest to ascertain the reasons for the employee's resignation, and whether these would impact on the employee's ability to provide a satisfactory service in his/her new post.He also maintained that he had a legitimate interest in establishing whether the employee's appointment to his/her current post was based on a full consideration of the facts.

32.Having considered these submissions, together with the withheld personal data, the Commissioner is satisfied that a legitimate interest exists in relation to those data, at least to the extent that disclosure would contribute to public scrutiny of the matters Mr Cherbi refers to.

Is disclosure of the information necessary to achieve these legitimate interests?

33.The Commissioner must now consider whether disclosure of the withheld personal data is necessary for the legitimate interests identified above and in doing so he must consider whether these interests might reasonably be met by any alternative means.

34.In this case, the Commissioner can identify no viable means of meeting Mr Cherbi's legitimate interest (in scrutinising the circumstances surrounding the named employee's resignation from NHS Orkney) which would interfere less with the privacy of the relevant data subject than the provision of the withheld personal data. In the circumstances, the Commissioner is satisfied that disclosure of those personal data is necessary to meet the legitimate interests in question.

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?

35.NHS Orkney has argued that public disclosure of this information (which is the effect of a disclosure under FOISA) would cause significant distress to the named employee.It indicated that it considered the withheld information to relate to the named employee's private life. NHS Orkney has noted the employee has not given permission for the information to be disclosed and it has submitted that disclosure of the withheld information would cause significant distress to the employee.

36.NHS Orkney has acknowledged that the role held by the named employee was a senior position, but, given the content of the withheld information, NHS Orkney does not consider that it would be 'fair' to release this information, nor does it consider it to be information that requires public scrutiny.NHS Orkney has concluded that disclosure of the requested information would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the named employee.

37.The Commissioner has considered these arguments carefully when considering the balance of the legitimate interests of the data subject against those identified by Mr Cherbi (set out above). He has also taken into account the guidance[2] on this point in his own briefing on the section 38 exemption, which identifies relevant factors as including:

whether the information relates to the employee's public or private life

the potential harm or distress that may be caused by disclosure

whether the employee has objected to disclosure

the reasonable expectations of the employee as to whether their information would be disclosed.

38.The Commissioner acknowledges that some of the withheld information could be seen as relating to the employee's public life, in so far as it relates to the employee's senior role in a Scottish public authority.The Commissioner also accedes that it could be argued that, in the interests of transparency and accountability, the circumstances surrounding the named employee's departure from NHS Orkney should be disclosed, given that another NHS body had to provide interim support to NHS Orkney following the resignation.The Commissioner considers that there are arguments in favour of disclosing any information that might reveal why such a working arrangement was agreed.

39.However, having reviewed the content of the withheld information, the Commissioner accepts that the named employee would have had no expectation that his/her personal data would be disclosed.He recognises that the information under consideration in this case is of a type that would normally be treated as confidential, and which data subjects would quite reasonably expect to remain private.The Commissioner also accepts NHS Orkney's submissions that disclosure would be likely to cause significant distress to the named employee. The Commissioner also notes that the employee objected to disclosure of the requested information.

40.In this particular case, therefore, having balanced the legitimate interests of the data subject against those identified by Mr Cherbi, the Commissioner finds that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused in this case to the rights and freedoms or legitimate interests of the data subject. The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in this case.

41.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interest of the data subject, as described above, the Commissioner must also conclude that its disclosure would be unfair. As no condition in Schedule 2 to the DPA can be met, he would also regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information in the withheld personal data and that this information was properly withheld under section 38(1)(b) of FOISA.

42.Having reached this conclusion, he does not find it necessary to consider the application of section 38(1)(b) as read with section 38(2)(ii) of FOISA, or whether any of the withheld information could be considered to fall within any of the categories of sensitive personal data set out in section 2 to the DPA.

43.Given that the Commissioner has found the entirety of documents A, B, C and E to be exempt in terms of section 38(1)(b) of FOISA, he will not go on to consider any of the other exemptions applied to these documents.

Section 36(1) - Confidentiality

44.Section 36(1) of FOISA exempts from disclosure information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings, including communications which are subject to legal professional privilege. One aspect of legal professional privilege is legal advice privilege, which NHS Orkney argued applies to all of the information contained within document D.

45.For legal advice privilege to apply, certain conditions must be fulfilled: the information being withheld must relate to communications with a legal adviser, such as a solicitor or an advocate (this may include an in-house legal adviser); the legal adviser must be acting in his/her professional capacity, and the communications must occur in the context of the legal adviser's professional relationship with his/her client.

46.The information withheld under section 36(1) is a communication between NHS Scotland Central Legal Office (the CLO) and NHS Orkney.The Commissioner notes that the CLO provides legal advice to all parts of NHS Scotland (including all NHS Health Boards) and that this communication provided written advice in response to a telephone conversation in which NHS Orkney had sought such advice. The legal advice was therefore given within a relationship where the legal advisers (the CLO) provided advice in a professional capacity to the client (NHS Orkney).

47.There is a further matter to be considered, however, before the Commissioner can determine whether, or the extent to which, the section 36(1) exemption is applies in this case. Information can only be privileged if it is also confidential. The claim of confidentiality must be capable of being sustained at the time the exemption is claimed.

48.A claim of confidentiality will not be capable of being maintained where the information has (prior to the conclusion of the public authority's review) been made public, either in full or in a summary sufficiently detailed to have the effect of disclosing the advice. Where confidentiality has thus been lost in respect of part or all of the information under consideration, any privilege associated with that information will also effectively be lost. Having considered NHS Orkney's submissions on this point, the Commissioner is satisfied that the legal advice referred to above has not been made public, either in full or in summary.

49.The Commissioner is therefore satisfied that the withheld information includes information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings. As a result, the Commissioner accepts that the information withheld by NHS Orkney under section 36(1) of FOISA is exempt from disclosure.

50.The exemption in section 36(1) is a qualified exemption, which means that its application is subject to the public interest test set out in section 2(1)(b) of FOISA. Therefore, having decided that the information is exempt under section 36(1), the Commissioner must go on to consider whether, in all circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.

Public interest test

51.As the Commissioner has noted in a number of previous decisions, the courts have long recognised the strong public interest in maintaining the right to confidentiality of communications between legal adviser and client on administration of justice grounds. Many of the arguments in favour of maintaining confidentiality of communications were discussed in a House of Lords case, Three Rivers District Council and others v Governor and Company of the Bank of England[3], and the Commissioner will apply the same reasoning to communications attracting legal professional privilege generally.

52.NHS Orkney submitted that disclosure of document D was not in the public interest, on the basis that it is primarily a discussion document that outlines the options open to NHS Orkney regarding the employee's specific circumstances.The document does not provide any final outcomes and NHS Orkney has argued that its release into the public domain would only cause confusion and speculation, which would not be in the public interest.

53.NHS Orkney also argued that any legal advice provided in such cases must be given to clients on a confidential basis and that routine disclosure of this type of information would damage the flow of advice and reduce the effectiveness of professional relationships. NHS Orkney suggests that this would not be in the public interest.

54.NHS Orkney does not appear to have considered whether there are any public interest considerations favouring disclosure of the withheld information, and has simply argued that the requested information should not be disclosed.

55.In his submissions, Mr Cherbi has stated that he does not believe that legal professional privilege applies to the information he is seeking and he does not accept that the exemption contained in section 36(1) of FOISA applies.As noted above, Mr Cherbi has argued that the general public has a right to know the circumstances of the employee's resignation from NHS Orkney.

56.The Commissioner has considered all of the public interest arguments made.He accepts that there is a general public interest in authorities being open to scrutiny and being accountable for their actions. He considers that this extends to knowing whether NHS Orkney is making employment decisions for the good of the service it provides to the public. He acknowledges that disclosure of any information (such as this legal advice) that might reveal further details of the circumstances that led to the named employee's resignation and their post being temporarily filled by another authority.In so doing, it would contribute to transparency and accountability.

57.As stated above, however, there is a long-recognised and strong public interest in maintaining the right to confidentiality of communications between legal adviser and client on administration of justice grounds, and in his instance the Commissioner accepts NHS Orkney's argument that there is a greater public interest in allowing NHS Orkney to obtain and consider legal advice in confidence than in disclosing the information.

58.On balance, therefore, the Commissioner is satisfied, in all the circumstances of this case, that the public interest in disclosing the information in this case is outweighed by the public interest in maintaining the exemption in section 36(1).

Comment on the Board's handling of Mr Cherbi's request

59.Section 1(1) of FOISA creates a general entitlement to access information held by a Scottish public authority (subject to the application of any exemptions in Part 2 of FOISA, and any other relevant provisions in Part 1).

60.In order to comply with section 1(1), an authority must therefore take steps to identify all information falling within the scope of a request, and provide it to the applicant, unless it is exempt from disclosure under Part 2 of FOISA, or otherwise subject to one or more of the provisions set out in Part 1 of FOISA.

61.In response to Mr Cherbi's request for review, NHS Orkney identified one document that fell within the scope of his request and which it withheld in terms of section 38(1)(b) of FOISA.However, during the investigation, it identified a further four documents that fell within the scope of Mr Cherbi's request.

62.In its submissions, NHS Orkney indicated that initially it had only considered item A as falling within the scope of Mr Cherbi's request on the basis that it provided the final data. However, after considering the questions posed by the investigating officer, NHS Orkney accepted that it held other documentation that also fell within the terms of Mr Cherbi's request, and it went on to identify four other documents that were relevant to the request (documents B, C, D and E).

63.The Commissioner is satisfied that, by the end of the investigation, NHS Orkney had identified all relevant information falling under the scope of Mr Cherbi's request.However, it is clear that it failed to properly identify all relevant information prior to the Commissioner's investigation.In this particular case, this failure did not affect the outcome of the Commissioner's decision since he has found that all relevant information to be exempt from disclosure.

64.However, the Commissioner wishes to highlight that failing to identify and consider all relevant information following receipt of requests risks breaching Part 1 of FOISA.He would encourage NHS Orkney to ensure that request handling is supported by proper consideration of the scope of the request and appropriate searches to identify all relevant information.

DECISION

The Commissioner finds that, in respect of the matters specified in the application, Orkney NHS Board (NHS Orkney) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Peter Cherbi.

The Commissioner finds that NHS Orkney was entitled to withhold the requested information in terms of section 38(1)(b) and 36(1) of FOISA.

Appeal

Should either Mr Cherbi or NHS Orkney wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
28 October 2011

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

36 Confidentiality

(1) Information in respect of which a claim to confidentiality of communications could be maintained in legal proceedings is exempt information.

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living employee who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the employee and any indication of the intentions of the data controller or any other person in respect of the employee;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx

[3] (2004) UKHL 48