|
Decision 215/2012 Mr Andrew Buchan and the Keeper of the Records of Scotland
Content of specified files
Reference No: 201202035
Decision Date: 19 December 2012 |
Summary
Mr Buchan asked the Keeper of the Records of Scotland (the Keeper) for unredacted copies of files relating to certain specified residential establishments. The Keeper withheld this information on the basis that it was personal data, the disclosure of which would breach the first data protection principle.
Following an investigation, the Commissioner found that the Keeper was entitled to withhold the information on this basis.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i),and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 30 July 2012, Mr Buchan emailed the Keeper requesting copies of files relating to certain specified residential establishments.
2.The Keeper responded on 17 August 2012. The Keeper advised Mr Buchan that he would be able to view redacted copies of the files at General Register House in Edinburgh. Mr Buchan was advised that he would not be entitled to receive any personal data relating to individuals within the files on the basis that such information was exempt from disclosure in terms of section 38(1)(b) of FOISA.
3.On 28 August 2012, Mr Buchan emailed the Keeper requesting a review of the decision. In particular, Mr Buchan indicated that he wished to receive the information that was redacted from the publicly available files.
4.The Keeper notified Mr Buchan of the outcome of the review on 1 October 2012. The Keeper reiterated that Mr Buchan could view redacted copies of the files at General Register House, but upheld the decision that the redacted information was exempt from disclosure in terms of section 38(1)(b) of FOISA.
5.On 5 October 2012, Mr Buchan wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Keeper's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6.The application was validated by establishing that Mr Buchan had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.
Investigation
7.On 12 November 2012, the investigating officer notified the Keeper in writing that an application had been received from Mr Buchan, giving an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking for a response to specific questions. In particular, the Keeper was asked to justify the reliance on any provisions of FOISA which were considered applicable to the information requested. The Keeper was also asked to provide the Commissioner with a sample of the information withheld from Mr Buchan.
8.The Keeper responded by providing a sample of the withheld information and provided submissions on the application of the exemption in section 38(1)(b) of FOISA to the withheld information.
9.The relevant submissions received from both the Keeper and Mr Buchan will be considered fully in the Commissioner's analysis and findings below.
Commissioner's analysis and findings
10.In coming to a decision on this matter, the Commissioner has considered the submissions made to her by both Mr Buchan and the Keeper and is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) of FOISA ? personal information
11.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or, as appropriate, 38(2)(b), exempts information from disclosure if it is "personal data" as defined in section 1(1) of the DPA, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
12.In order to rely on this exemption, therefore, the Keeper must show firstly that the information being withheld is personal data for the purposes of the DPA, and secondly that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
Is the information personal data?
13.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
14.The Keeper has applied the exemption in section 38(1)(b) to the redacted information on the basis that it comprises the names of residents and employees at specified residential establishments.
15.The Commissioner is satisfied that all of the information under consideration is the personal data of the individuals concerned as they can be identified from it and it relates to them. She will go on to consider whether this information is exempt from disclosure under section 38(1)(b) of FOISA.
Would disclosure of the personal data contravene the first data protection principle?
16.The Keeper argued that disclosure of the personal data would breach the first data protection principle. This requires that personal data be processed fairly and lawfully and, in particular, that it shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. The processing under consideration in this case is disclosure of the personal data into the public domain in response to Mr Buchan's information request.
17.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.For example, if there is a specific condition in the schedules which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
18.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether the disclosure of this personal data would otherwise be fair and lawful.
Can any of the conditions in Schedule 2 to the DPA be met?
19.When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights and freedoms or legitimate interests of the data subject.
20.Having considered all the conditions in Schedule 2, the Commissioner finds that only condition 6 might be applicable in the circumstances of this case.
21.Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s) (i.e. the individual(s) to whom the data relate).
22.There are a number of different tests which must therefore be satisfied before condition 6 can be met. These are:
Does Mr Buchan have a legitimate interest in obtaining the personal data?
If yes, is disclosure necessary to achieve these legitimate interests?In other words, is the disclosure proportionate as a means and fairly balanced as to its ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subjects?
Even if processing is necessary for Mr Buchan's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects?
23.There is no presumption in favour of the release of personal data under the general obligation laid down in FOISA. Accordingly, the legitimate interests of Mr Buchan must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Keeper was correct to refuse to disclose the personal data to Mr Buchan.
Does Mr Buchan have a legitimate interest?
24.There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on section 38 of FOISA[2] states:
In some cases, the legitimate interest might be personal to the applicant ? e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
25.In this case, Mr Buchan provided the Commissioner with his reasons for requiring the information. These are very personal to Mr Buchan and the Commissioner will not repeat them within this decision. The reasons are, in any event, known to the Keeper.
26.Having considered these submissions, the Commissioner has concluded that Mr Buchan has a legitimate interest in obtaining the personal data under consideration.
Is disclosure necessary to achieve those legitimate interests?
27.The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so she must consider whether these interests might reasonably be met by any alternative means.
28.In all the circumstances of this case, the Commissioner can identify no viable means of meeting Mr Buchan's legitimate interests which would interfere less with the privacy of the relevant data subjects than the provision of the withheld personal data. In the circumstances, she is satisfied that disclosure of those personal data is necessary to meet the legitimate interests in question.
Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?
29.The Commissioner must next go on to consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the individuals whose personal data it is.
30.As noted above, this test involves a balancing exercise between the legitimate interests of Mr Buchan and those of the individuals in question. Only if the legitimate interests of Mr Buchan outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
31.In the Commissioner's briefing on section 38 of FOISA, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
the potential harm or distress that may be caused by the disclosure
whether the individual objected to the disclosure
the reasonable expectations of the individuals as to whether the information should be disclosed
32.The Keeper argued that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused to the rights and freedoms or legitimate interests of the data subjects or their families. The Keeper also submitted that the obligations of a data controller, alongside Article 8 of the European Convention on Human Rights and the general law of confidentiality, should all take precedence over any possible interest in disclosure.
33.The Keeper also submitted that the data subjects would have no expectation that their names and personal details would be placed in the public domain.
34.Having considered the information in question, the Commissioner agrees that the individuals in question would not have any expectation that these particular details would be publicly disclosed, which would be the effect of the disclosure of the information under FOISA. She recognises that the information under consideration in this case is of a type that should be treated as confidential, and which data subjects would reasonably expect to remain private.
35.In this particular case, having balanced the legitimate interests of the data subjects against those identified by Mr Buchan, the Commissioner finds that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused in this case to the rights and freedoms or legitimate interests of the data subjects. The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in this case.
36.Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would be unfair. As condition 6 cannot be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was therefore properly withheld under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that the Keeper of the Records of Scotland complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Buchan.
Appeal
Should either the Keeper of the Records of Scotland or Mr Buchan wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
19 December 2012
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
?
(e) in subsection (1) of section 38 ?
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=661&sID=133
