Decision 230/2013 Mr George Watson and the Scottish Ministers Performance payments and hospitality Reference No: 201201880 Decision Date: 21 October 2013

Summary

On 6 August 2012, Mr Watson asked the Scottish Ministers (the Ministers) for information about performance payments made to, and hospitality received by, staff. Following a review, the Ministers disclosed some information, but withheld the remainder under section 38(1)(b) of FOISA on the grounds that it was personal data, disclosure of which would breach the first data protection principle. Mr Watson was dissatisfied and applied to the Commissioner for a decision. The Ministers disclosed additional information to Mr Watson during the investigation.

The Commissioner found that the Ministers had been entitled to withhold information which would identify the recipients of performance payments or the junior members of staff who had received hospitality, but that other information should be disclosed to Mr Watson. The Commissioner also found that the Ministers failed to comply with section 10(1) of FOISA by failing to respond to

Mr Watson's request within the statutory time limits.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 10(1)(a) (Time for compliance); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1. On 6 August 2012, Mr Watson asked the Ministers for information about bonus payments made to, and hospitality received by, staff, specifically:

full details of all staff who received a bonus payment (referred to by the Ministers as a "performance payment") in the last two financial periods, including the Office of the Permanent Secretary;

full details of all hospitality received by staff in all directorates.

2. The Ministers did not respond to the request and, on 13 September 2012, Mr Watson requested a review.

3. The Ministers notified Mr Watson of the outcome of their review on 21 September 2012. The Ministers explained that performance payments were made to individuals in 2010/2011, but had not been made subsequently. The Ministers provided a summary of performance payments per pay band (e.g. the number of performance payments made in each band and the total amount paid per band) and gave Mr Watson information including the range of payments. The Ministers also disclosed some information about the hospitality which staff had received in 2010/2011 and informed Mr Watson that hospitality received by Strategic Board Members (senior officials) was published and accessible from a referenced webpage. The Ministers informed Mr Watson that they considered that the remaining information was exempt from disclosure under section 38(1)(b) of FOISA.

4. On 26 September 2012, Mr Watson emailed the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Watson provided reasons for his dissatisfaction on 1 October 2013. His dissatisfaction focussed on two separate matters:

(i) the Ministers' reliance on the exemption in section 38(1)(b) and

(ii) the Ministers' failure to respond to his initial request within the time required by FOISA.

5. The application was validated by establishing that Mr Watson made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review their response to that request.

Investigation

6. On 22 October 2012, the Ministers were notified in writing that an application had been received from Mr Watson and were asked to provide the Commissioner with the information withheld from him. The Ministers provided the information and the case was allocated to an investigating officer.

7. The investigating officer confirmed with Mr Watson the scope of his application and specifically that he was seeking performance payments made to and hospitality received by staff for the previous two financial years.

8. The investigating officer subsequently contacted the Ministers, providing them with an opportunity to comment on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions, with particular reference to the exemption in section 38(1)(b).

9. Following further correspondence with the Ministers, on 21 December 2012 and 4 February 2013, the Ministers provided Mr Watson with additional information about performance payments made to staff and about the hospitality received by staff.

10. On 22 May 2013, the Ministers provided comments on the failure to respond to Mr Watson's initial request. On 9 September 2013, the Ministers provided further details as to how staff record the hospitality they receive.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, and parts of submissions, made to her by both

Mr Watson and the Ministers. She is satisfied that no matter of relevance has been overlooked.

12. The Ministers provided the Commissioner with two spreadsheets containing information on performance payments made to staff and hospitality received by staff. (The Ministers had disclosed a redacted version of the hospitality spreadsheet to Mr Watson, but withheld the remaining information under section 38(1)(b) of FOISA.)

13. For the purposes of the Commissioner's decision, it is noted that the Ministers publish the performance payments made to the Cabinet[1] and the hospitality received by the Cabinet[2], the Strategic Board[3] and special advisors[4].

Section 38(1)(b) of FOISA

14. The Ministers confirmed they considered that the information which had not been disclosed to Mr Watson was exempt from disclosure under section 38(1)(b) of FOISA, on the basis that it was the personal data of individuals, the disclosure of which would breach the first data protection principle.

15. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (b) (as appropriate), exempts personal data from disclosure if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.

Is the information under consideration personal data?

16. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (see the Appendix for the full definition).

17. The Commissioner accepts that, in terms of section 1(1) of the DPA, the information withheld by the Ministers is the personal data of the member of staff receiving the performance payment or the offer of hospitality. The individuals in question are identifiable from the information and, given its nature (e.g. the name of the individual, the department for which they work, their pay band, pay range and the performance payment or hospitality they received), the Commissioner is satisfied that the information clearly relates to them.

Would disclosure of the information breach the first data protection principle?

18. The Ministers argued that disclosure of the information would breach the first data protection principle. The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed (in this case, disclosed into the public domain in response to Mr Watson's information request) unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data (as defined by section 2 of the DPA), at least one of the conditions in Schedule 3 to the DPA is also met. (The Commissioner is satisfied that the withheld information does not fall into any of the categories of sensitive personal data listed in section 2 of the DPA.)

19. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[5] (the CSA case) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.

20. Condition 1 of Schedule 2 permits personal data to be processed if the data subject consents to the data being processed. The Ministers stated that they had not sought the data subjects' consent for disclosure; given the number of individuals involved, it was not possible to consider writing to the individuals to ask for consent for their data to be disclosed. The Commissioner considers that seeking consent would not, in the circumstances, have been reasonable.

21. The Commissioner has therefore concluded that condition 1 in Schedule 2 cannot be met in this case.

22. The Commissioner considers that the only other condition in Schedule 2 to the DPA which might apply in this case is condition 6. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

23. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

(i) Is Mr Watson pursuing a legitimate interest or interests?

(ii) If yes, is the processing necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects.

(iii) Even if the processing is necessary for Mr Watson's legitimate interests, is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects? As noted by Lord Hope in the CSA case, given that there is no presumption in favour of the release of personal data under the general obligation laid down in FOISA, the legitimate interests of Mr Watson must outweigh the rights, freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Mr Watson.

Is Mr Watson pursuing a legitimate interest or interests?

24. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on section 38 of FOISA[6] states:

In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

25. Mr Watson was asked about his legitimate interests in requesting the information. He explained that he required the information to verify that the individuals were receiving performance payments and/or hospitality on the basis of the work they undertook, as opposed to being given such payments or hospitality on the basis of an unhealthy relationship with specific companies.

26. In their submissions, the Ministers stated that they had not asked Mr Watson why he considers that he has a legitimate interest in the withheld information, but accepted that, as a campaigner (Mr Watson is Chairman of Residents Against Turbines Scotland), he has a legitimate interest in how public money is spent.

27. The Commissioner recognises that Mr Watson, as an individual and as a campaigner, has a legitimate interest in the disclosure of information which would improve transparency in relation to the receipt of performance payments and/or hospitality by staff, both in relation to the spending of public money and in ensuring transparency in relation to hospitality offered to staff by external parties.

Is the processing necessary for the purposes of those interests?

28. The Commissioner must now consider whether disclosure of the personal data is necessary in order to satisfy the legitimate interests identified above. In doing so, she must consider whether these interests might reasonably be met by any alternative means.

29. In all the circumstances of this case, the Commissioner can identify no viable means of meeting Mr Watson's legitimate interests which would interfere less with the privacy of the relevant data subjects than the provision of the withheld personal data. In the circumstances, she is satisfied that disclosure of the personal data is necessary to meet the legitimate interests in question.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

30. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr Watson's legitimate interests, she is now required to consider whether that disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Mr Watson and the data subjects in question. Only if the legitimate interests of Mr Watson outweigh those of the data subjects in question can the information be disclosed without breaching the first data protection principle.

31. In considering the rights, freedoms and legitimate interests of the data subjects, the Ministers advanced arguments as to those individuals' expectations of privacy. They maintained that the individuals concerned would not have any reasonable expectation that information confirming that they had received a performance payment or had received hospitality would be disclosed into the public domain.

32. The Commissioner has considered these arguments carefully and has also taken into account the guidance on this point in her briefing on the section 38 exemptions[7], which identifies relevant factors as including:

whether the information relates to the individual's public or private life

the potential harm or distress that may be caused by disclosure

whether the individual has objected to disclosure

the reasonable expectations of the individual as to whether their information would be disclosed.

33. The circumstances in which the data subjects received performance payments or accepted hospitality are different, and raise different issues when considering whether Mr Watson's legitimate interests outweigh their own interests. Therefore, the Commissioner will consider the balancing exercise separately in relation to information about performance payments and details of hospitality.

Performance payments

34. In their submissions, the Ministers explained that the performance payments made to staff in Bands A to C were granted on the basis of exceptional overall performance and if staff met certain criteria. This performance assessment, reached through the annual appraisal process, would be confirmed by the counter-signing officer and would trigger a performance payment.

35. Given that performance payments were made only where staff were assessed as having performed exceptionally overall, disclosure of information showing that a performance payment had been made directly equates, in the Ministers' view, to the disclosure of appraisal markings. The Ministers explained that staff would have no expectation that their appraisal markings would be made public.

36. The Ministers commented that, where there are small numbers of staff [in a department] but no performance payments have been made [to that department] then it becomes clear that none had been assessed as "exceptional". Disclosure of payments data therefore could be distressing for those who could be identified as not receiving a performance payment, since their work contribution may be seen as less valuable than colleagues who have received payments for exceptional performance.

37. The Ministers also explained that, where one-off payments have been made to individual members of staff, those members of staff will have decided for themselves which friends and family they wished to know about it. Publication of this detailed information would remove that discretion. Since all FOI responses which release information for the first time are published on the Scottish Government's website, the revelation that individuals have received payments that they may have chosen not to disclose could be expected to cause distress.

38. In relation to senior staff, the Ministers explained that performance payments to Senior Civil Service (SCS) employees are set by the Cabinet Office of the UK Government and the Scottish Government has no discretion to implement a separate system.

39. The Ministers stated that they are committed to improving transparency on salary information (including performance payments) in relation to its most senior staff. The remuneration of members of the Strategic Board is (and has been for a number of years) provided in ?5,000 bands in the Scottish Government's Audited Accounts[8]. In line with guidance from the UK Cabinet Office in October 2010, publication of remuneration was extended to Director-level, again in ?5,000 bands.

40. The Commissioner has considered the Ministers' submissions and notes specifically that performance payments for staff in bands A to C are granted only when performance is considered "exceptional" and not when an individual simply meets their targets and objectives for the year. The Commissioner accepts that, given the circumstances in which such payments are made, disclosure of information which would show that an identifiable individual had (or had not) received a performance payment would reveal information about the performance assessment they had received in the appraisal process.

41. The Commissioner accepts that most employees and employers have a general expectation that information relating to the appraisal of an individual employee's performance should be treated confidentially. She has agreed with this approach in previous decisions[9]. Given this expectation, the Commissioner accepts that disclosure of information showing whether or not an individual had, or had not, achieved "exceptional" performance would be likely to cause distress to that individual. The Commissioner also accepts that, where individuals had received a performance payment, but had chosen not to make this known, disclosure could cause unwarranted prejudice to their rights and freedoms or legitimate interests. (The Commissioner notes the Ministers' concerns regarding disclosure on their website. She notes that any information which is disclosed under FOISA is considered to be disclosed into the public domain.)

42. The Commissioner has accepted that Mr Watson has a legitimate interest in the disclosure of information which would increase transparency in relation to the receipt of performance payments. As noted elsewhere, information about performance payments has already been made available. Information about performance payments to members of the Strategic Board (the civil service "top table") are published on the Scottish Government website (showing that no such payments were made in 2010-11). The Ministers also disclosed to Mr Watson some information about performance payments to employees in bands A to C and in the SCS pay bands, such as the number of performance payments made for each grade and the total amount paid out for each grade.

43. The Commissioner finds that the information which is publicly available goes a long way towards satisfying Mr Watson's legitimate interest in information about performance payments.

44. Having balanced the legitimate interests of the data subjects against those of Mr Watson, the Commissioner finds that any legitimate interests served by disclosure of the remaining personal data (information which would identify those individuals who had received performance payments) would not outweigh the unwarranted prejudice that would be caused in this case to the rights and freedoms or legitimate interests of the individuals in question. The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in relation to this information.

45. Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects as described above, the Commissioner must also conclude that its disclosure would be unfair. As no condition in Schedule 2 to the DPA can be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information and that this information was properly withheld under section 38(1)(b) of FOISA.

Hospitality

46. Employees who receive hospitality with an estimated value of over ?15 are required to register certain details in a Human Resources (HR) database, creating an entry which is only visible to the employee and HR staff. In responding to Mr Watson's request, the Ministers created a spreadsheet from this database and disclosed information from some fields in the database (including the Directorate in which the staff are employed; the donor; description of the hospitality and an estimate of its value). The Ministers took the view that the remaining information (including the employee's name and grade, and the circumstances in which the hospitality was offered) comprised personal data and that its disclosure would contravene the first data protection principle. The Ministers therefore withheld the information under section 38(1)(b) of FOISA.

47. In their submissions, the Ministers stated that disclosure of the remaining information (information which would identify which individuals had received hospitality) would be unwarranted by reason of prejudice to the rights and freedoms of the individuals named or identifiable from the information because of the potential harm or distress which might be caused by disclosure.

48. The Ministers maintained that, when staff recorded details of the hospitality they had received in the HR database, they would have no expectation that the information might be disclosed under FOISA. They explained that the Scottish Government's Data Protection statement ensures that no personally identifiable information will be made available without the individual's consent. The Ministers stated that the data subjects had a reasonable expectation that details of the hospitality they received should not be disclosed, and had not given their consent for this to happen.

49. The Ministers considered that the likelihood of staff receiving hospitality varies across roles within the Scottish Government, and some individuals would have received more hospitality than others simply because of the area in which they work and the particular role they undertake. The Ministers expressed concern that the disclosure of such information would be taken out of context and could be misrepresented to the prejudice of the individual.

50. The Ministers provided the Commissioner with their internal guidance on hospitality and gifts, which sets out the following guiding principles for staff:

their conduct should not foster the suspicion of any conflict between their official duty and their private interests;

their actions, when acting in an official capacity, should not give the impression to any member of the public, to any organisation with which they deal or to their colleagues that they have been or may have been influenced by a gift or consideration to show favour or disfavour to any person or organisation;

if staff are in doubt about the propriety of accepting a gift or an item of hospitality they must consult Human Resources. In areas where the offer of gifts is a frequent occurrence, Deputy Directors or Chief Professional Officers may wish to consult Human Resources about the possibility of introducing guidance specific to their staff's needs.

51. The Ministers stated that information on hospitality received relates to both the public and private lives of individual staff members. In the vast majority of cases, the Commissioner found that there was a direct link between the professional working life of the individual concerned and the hospitality they received, such as an invitation to attend a work-related event. In any event, even where the link between the hospitality and the professional duties of the employee were not obvious, staff were required to record details of the hospitality and to consider whether acceptance would give rise to an actual or potential conflict of interest. The Commissioner therefore takes the view that the personal data recorded about offers of hospitality relates to the professional duties of the staff involved and to the standards which the Scottish Government has set for its staff.

52. The (UK) Information Commissioner, who is responsible for enforcing and regulating the DPA throughout the UK, has published guidance on the disclosure of personal data of public authority employees[10]. The guidance sets out key questions to consider as to whether employees have a reasonable expectation that their information will not be disclosed and include the following key questions:

53. "Whether the information relates to the employee in their professional role or to them as individuals. Information about an employee's actions or decisions is still personal data, but given the need for accountability and transparency, there must be some expectation of disclosure. On the other hand information that may be held in a personnel file about their health or disciplinary record or payroll information relate to them as individuals and there is a greater expectation that this information would not be disclosed."

The same guidance states:

"It is reasonable to expect that a public authority would disclose more information relating to senior employees than more junior ones. Senior employees should expect their posts to carry a greater level of accountability, since they are likely to be responsible for major policy decisions and the expenditure of public funds. However, the terms 'senior' and 'junior' are relative and it is not possible to set an absolute level across the public sector."

54. This position is reflected in the (Scottish) Commissioner's own guidance on the section 38(1)(b) exemption.[11]

55. The Ministers have explained that hospitality information is held in individual's personnel record and that staff have not been informed that this information could be requested and possibly disclosed under FOISA. In these circumstances, and in view of the guidance from the (UK) Information Commissioner, the Commissioner considers it appropriate to distinguish between the reasonable expectations of senior employees and non-senior employees when considering whether it would be fair to disclose the personal data about the hospitality they received.

Senior staff

56. In the context of this case, in relation to hospitality, the Commissioner considers it reasonable to regard as "senior" any member of staff at or above the level of Deputy Director. The Commissioner notes that the Scottish Government does not routinely publish the names or pay bands of Deputy Directors, but considers that these officials have the status of senior staff because of their decision-making responsibilities and levels of accountability.

57. Senior employees within the Scottish Government should have an expectation that their work-related activity will be open to scrutiny. There is a greater requirement for transparency in relation to the professional activities of senior staff responsible for taking decisions and influencing policy. The Commissioner recognises that senior employees might have had only a limited expectation that information about the hospitality they had been offered would be disclosed, but she does not consider that the information relates in any significant way to their private lives. Nor does she consider that its disclosure would be likely to cause them damage or distress, given their seniority.

58. In line with the comments above, the Commissioner considers that the disclosure of the hospitality received by senior employees would not constitute an unwarranted intrusion into those individuals' private lives.

59. The Commissioner has taken account of the submissions by the Ministers that the [senior] staff in question have not consented to the disclosure of the information. However, consent is only one of many considerations to be taken into account when considering whether condition 6 of schedule 2 to the DPA would permit disclosure. The Commissioner would make the observation that consent was not given because it was not sought, as Ministers did not differentiate between senior and non-senior staff when arguing that seeking consent was unreasonable given the number of employees concerned.

60. In any event, all staff should be aware that all recorded information held by an authority is potentially disclosable under FOISA.

61. The Commissioner has balanced the legitimate interests of the data subjects who are senior staff against the legitimate interests identified by Mr Watson. Having done so, the Commissioner finds that Mr Watson's interests outweighs any unwarranted prejudice that would be caused to the rights, freedoms or legitimate interests of the data subjects. The Commissioner is therefore satisfied that condition 6 of schedule 2 of the DPA can be met in this case.

62. The Commissioner considers that, where it relates to senior staff, disclosure of the information withheld under section 38(1)(b) in the hospitality spreadsheet would be fair, for the reasons already outlined above in relation to condition 6. She notes the Ministers' argument that some staff are more likely than others to be given hospitality, due to the nature of their job; however, she does not accept that, in relation to senior staff, this outweighs Mr Watson's legitimate interest in information which would permit scrutiny and increase transparency of the hospitality received from external parties. She notes the point the Ministers make about the risk that information may be taken out of context but would remind the Ministers that it is open to them to provide context should they wish to do so.

63. Whilst the Ministers have not provided any separate submissions to argue that disclosure would be unlawful, the Commissioner (having concluded that condition 6 of schedule 2 to the DPA can be met) is unable, in any case, to identify any specific law forbidding disclosure.

64. The Commissioner therefore concludes that disclosure of personal data about the hospitality received by senior staff would not breach the first data protection principle. She accordingly concludes that the exemption in section 38(1)(b) was wrongly applied to that information, and requires the Ministers to provide it to Mr Watson.

Non-senior staff

65. As noted above, the Ministers did not distinguish between senior and non-senior staff in their submissions as to why disclosure of the information about hospitality would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects.

66. The Ministers have argued that staff have a general expectation that their personal data will not be disclosed without their consent, in line with the Scottish Government's data protection statement. While staff should be aware that all recorded information is potentially disclosable under FOISA, the Commissioner accepts that the Scottish Government does not routinely publish personal information relating to non-senior staff.

67. The Commissioner takes the view that disclosure of personal data relating to non-senior employees, against their reasonable expectations, would prejudice the data subjects' interests to a degree which (in the circumstances of this particular case) would outweigh

Mr Watson's legitimate interest in disclosure of the withheld personal data. Non-senior employees carry a lower level of accountability and are less likely to be responsible for major policy decisions and the expenditure of public funds.

68. The Commissioner therefore finds that condition 6 of Schedule 2 of the DPA cannot be met in relation to the personal data of non-senior employees. For the reasons she has identified above, she also considers that disclosure would be unfair and, in the absence of a condition permitting disclosure, unlawful. Consequently, she is satisfied that the information was correctly withheld under section 38(1)(b) of FOISA.

69. However, the Commissioner is satisfied that there is some information which the Ministers would be able to disclose to Mr Watson, which would go some way to fulfilling his legitimate interests.

70. As Lord Rodger commented at paragraph 73 of the CSA case:

even if the information does constitute "personal data", the [public authority] will still be obliged to supply it, if that can be done without contravening the data protection principles in Schedule 1 to the [DPA]. And, if supplying the information in one form would contravene those principles, in my opinion, section 1(1) of [FOISA] obliged [the public authority] to consider whether it could comply with its duty by giving the information in another form.

71. Having considered the hospitality information held by the Ministers, the Commissioner considers that, if the information capable of identifying individual non-senior staff members is redacted, the remaining information would be effectively anonymised and would no longer comprise personal data.

72. The Commissioner therefore requires the Ministers to provide Mr Watson with the grades of the members of staff receiving the hospitality, whether it was accepted and the date it was offered. The Commissioner does, however, recognise that there may specific instances not immediately obvious from the information she has seen, where providing this information, when read in conjunction with information already disclosed could lead to an individual being identifiable (e.g. if there was only one individual of a particular grade in a particular directorate). In those instances, the Commissioner requires the Ministers to disclose as much information as possible without identifying the individual and to provide her with a brief explanation.

Compliance with timescales

73. Section 10(1) of FOISA allows Scottish public authorities a maximum of 20 working days after receipt of a request to comply with a request for information, subject to certain exceptions which are not applicable in this case.

74. In their submissions, the Ministers explained that, in order to supply the information sought on hospitality, it was necessary to classify a large volume of information sometimes with limited contextual detail, which contributed to the longer time to respond than normal. The Ministers apologised that they were unable to complete the work within the 20 day deadline.

75. The Commissioner notes these points, but has concluded that, given that the Ministers did not provide a response to Mr Watson's request for information within 20 working days, the Ministers failed to comply with section 10(1) of FOISA.

76. As Mr Watson received a response to his requirement for review, the Commissioner does not require the Ministers to take any action in relation to this breach in respect of this application.

DECISION

The Commissioner finds that the Scottish Ministers (the Ministers) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Watson.

The Commissioner notes that information was disclosed to Mr Watson by the Ministers, not only in response to his request for review, but during the investigation. Of the remaining information, the Commissioner finds, for the reasons set out above, that the Ministers were entitled to withhold information on performance payments, and some, but not all, of the information on hospitality, under section 38(1)(b) of FOISA.

The Commissioner also finds that the Ministers failed to comply with section 10(1) of FOISA in not responding to Mr Watson's request within the statutory timescale.

The Commissioner requires the Ministers to provide Mr Watson with the information specified in the paragraphs 64 and 72 of this decision, by 5 December 2013.

Appeal

Should either Mr George Watson or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner
21 October 2013

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

10 Time for compliance

(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-

(a) in a case other than that mentioned in paragraph (b), the receipt by the authority of the request; or

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

---

[1] http://www.scotland.gov.uk/Publications/2011/09/29132216/2

[2] http://www.scotland.gov.uk/About/People/14944/Events-Engagements/gifts

[3] http://www.scotland.gov.uk/About/People/strategic-board/business-expenses

[4] http://www.scotland.gov.uk/About/People/14944/Special-Advisers/gifts-hospitality

[5] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[6] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.asp?lID=3085&sID=133

[7] [7] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.asp?lID=661&sID=133

[8] http://www.scotland.gov.uk/Publications/2011/09/29132216/2

[9] For example, Decision 058/2013 Mr John WH McLean and the Scottish Parliamentary Corporate Body http://www.itspublicknowledge.info/applicationsanddecisions/Decisions/2013/201202663.aspx

[10] http://www.ico.org.uk/~/media/documents/library/Environmental_info_reg/Practical_application/section_40_requests_for_personal_data_about_employees.pdf

[11] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.asp?lID=3085&sID=133