Decision 239/2016: Mrs Anne Lindsay and the Office of the Scottish Charity Regulator Correspondence from an individual Reference No: 201601426 Decision Date: 8 November 2016 Summary OSCR was asked for a specific letter it had received. OSCR withheld the information under exemptions relating to law enforcement and personal information. The Commissioner accepted that OSCR was entitled to withhold all of the information as personal data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definition of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretive provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 23 June 2016, Mrs Lindsay made a request for information to the Office of the Scottish Charity Regulator (OSCR). The information requested was a specific piece of correspondence, sent to OSCR by a named individual.

2. OSCR did not respond to Mrs Lindsay's request. On 4 August 2016, Mrs Lindsay wrote to OSCR, requesting a review in respect of its failure to respond.

3. OSCR notified Mrs Lindsay of the outcome of its review on 4 August 2016. OSCR withheld the information under the exemptions on sections 35(1)(g) (Law enforcement) and 38(1)(b) (Personal information) of FOISA.

4. On 8 August 2016, Mrs Lindsay wrote to the Commissioner. She applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mrs Lindsay was dissatisfied with the outcome of OSCR's review because she did not consider the information should be withheld from her.

Investigation

5. The application was accepted as valid. The Commissioner confirmed that Mrs Lindsay made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

6. On 16 August 2016, OSCR was notified in writing that Mrs Lindsay had made a valid application. OSCR was asked to send the Commissioner the information withheld from Mrs Lindsay. OSCR provided the information and the case was allocated to an investigating officer.

7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. OSCR was invited to comment on this application and answer specific questions. In particular, it was asked to justify its reliance on the exemptions claimed in responding to Mrs Lindsay.

8. OSCR responded, providing submissions on the exemptions applied to the withheld information.

9. During the investigation, OSCR informed Mrs Lindsay that part of the information withheld from her was already available in the public domain. OSCR informed Mrs Lindsay that this information was technically exempt from disclosure under section 25(1) of FOISA. This was on the basis that it could be reasonably obtained by her otherwise than by requesting it under FOISA. Nonetheless, OSCR also disclosed a copy of the information to Mrs Lindsay at this stage.

10. During the investigation, the investigating officer also sought, and received, submissions from Mrs Lindsay.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mrs Lindsay and OSCR. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) (Personal information)

12. OSCR applied the exemption in section 38(1)(b) of FOISA to the withheld information, on the basis that it was all the personal data of a specified individual. OSCR considered disclosure of the information would breach the first data protection principle and that none of the conditions in Schedule 2 to the DPA could be met.

13. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, section 38(2)(b), exempts information from disclosure if it comprises "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

14. The exemption in section 38(1)(b) of FOISA is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

15. In order to rely on this exemption, OSCR must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Schedule 1.

Is the information under consideration personal data?

16. The Commissioner will firstly consider whether the information withheld is personal data. "Personal data" is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller. (The full definition is set out in Appendix 1.)

17. The Commissioner is satisfied that the information under consideration is personal data, in line with the definition in part (a) of section 1(1) of the DPA. A living individual, who is the subject of the correspondence, can be identified from this information. Given its nature (specifically naming the individual and saying something of biographical significance about them), the Commissioner is satisfied that the information relates to that individual.

Would disclosure contravene the first data protection principle?

18. As noted above, OSCR submitted that disclosing this information would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. The processing in this case would be making the information publicly available in response to Mrs Lindsay's request.

Can any of the conditions in Schedule 2 be met?

19. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1], that the conditions require careful treatment in the context of a request for information under FOISA. They were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).

20. It appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Mrs Lindsay. In any event, neither Mrs Lindsay nor OSCR have suggested that any other condition would be relevant.

21. Condition 6 allows personal data to be processed where that processing is necessary for the purposes of legitimate interests pursued by the data controller, or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

22. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

? Does Mrs Lindsay have a legitimate interest in obtaining the personal data?

? If so, is disclosure necessary to achieve those legitimate interests? In other words, is disclosure proportionate as a means and fairly balance as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

? Even if disclosure is necessary for these purposes, would it nevertheless be unwarranted by reason of prejudice to the rights, freedoms or legitimate interests of the data subjects? As noted by Lord Hope in the above judgment, there is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Mrs Lindsay must outweigh the rights and freedoms or legitimate interest of the data subject before condition 6 will permit the personal data to be disclosed.

23. There is no definition in the DPA of what constitutes a "legitimate interest." The Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance on section 38 of FOISA[2] states:

In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety

24. OSCR stated that it understood Mrs Lindsay believed she had a legitimate interest in knowing the content of the correspondence. However, in its view, the disclosure of the information would be of interest to her and not to the public as a whole.

25. Mrs Lindsay explained why she considered she had a legitimate interest in obtaining the withheld information. (The Commissioner is unable to reproduce her reasons, or OSCR's comments on those reasons, within this Decision Notice, without breaching the obligation of confidentiality in section 45 of FOISA.)

26. In the Commissioner's view, Mrs Lindsay has a legitimate interest in obtaining the withheld personal data under consideration here. The Commissioner is satisfied that Mrs Lindsay has demonstrated she has a personal interest (extending beyond mere curiosity) in the nature and content of the withheld information.

Is disclosure necessary to achieve those legitimate aims?

27. Having concluded that Mrs Lindsay has a legitimate interest in obtaining the personal data under consideration, the Commissioner must now consider whether disclosure of the personal data is necessary to achieve those legitimate aims, or whether these legitimate aims can be achieved by means which interfere less with the privacy of the data subject.

28. Having reviewed the withheld information, the Commissioner cannot identify any other viable means of meeting Mrs Lindsay's interests which would interfere less with the privacy of the data subject than providing the withheld personal data. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mrs Lindsay's legitimate interests

Would disclosure cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?

29. The Commissioner is satisfied that disclosure of the withheld personal data is necessary to fulfil Mrs Lindsay's legitimate interests, but must now consider whether that disclosure would cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Mrs Lindsay and those of the data subject. Only if the legitimate interests of Mrs Lindsay outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.

30. In the Commissioner's briefing on the personal information exemption, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

? whether the information relates to an individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

? the potential harm or distress that may be caused by disclosure;

? whether the individual objected to the disclosure; and

? the reasonable expectations of the individual as to whether the information should be disclosed.

31. OSCR submitted that the data subject was neither a public official nor an employee of a public authority. OSCR considered the information related to the data subject's private life, not their public life. In OSCR's view, disclosure of the information would be unwarranted as it could prejudice the rights of the data subject to privacy and to protection from any detriment they might suffer as a result of disclosure.

32. Mrs Lindsay explained why the information was important to her. The Commissioner is unable to reproduce her exact reasons here (for the reasons set out in paragraph 25 above); suffice to say they are very personal to Mrs Lindsay. They relate to matters which are of obvious concern to her.

33. The Commissioner has considered all of the submissions made to her when balancing the legitimate interests in this case.

34. In the Commissioner's view, there would be no expectation on the part of the data subject that personal data of this nature would be disclosed into the public domain in response to a request made under FOISA. She accepts that the information relates to the individual's private life. In the circumstances, the Commissioner is satisfied that disclosure of the information would have the potential to cause considerable harm and distress to the data subject.

35. The Commissioner accepts that Mrs Lindsay has strong (and understandable) personal reasons for requiring disclosure of the personal information. However, she must approach this question on the basis that disclosure under FOISA would be to the world at large and not just to Mrs Lindsay. Having considered the competing interests in this particular case, she find that Mrs Lindsay's legitimate interests are outweighed by the prejudice that would be caused to the data subject's rights, freedoms and legitimate interests. Consequently, the Commissioner is satisfied that the requirements of condition 6 of Schedule 2 to the DPA cannot be met in this case.

36. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 to the DPA which would permit disclosure of the information. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure of the information would breach the first data protection principle and that the information is therefore exempt from disclosure (and was properly withheld) under section 38(1)(b) of FOISA.

37. Given that she has found the information to be exempt from disclosure under section 38(1)(b), the Commissioner is not required to go on to consider whether the information would also be exempt under section 35(1)(g) of FOISA.

Additional comments on OSCR's handling of the request

38. The following does not form part of the Commissioner's findings on compliance in this case, and was not raised formally in Mrs Lindsay's application. However, it covers practice issues which arose during this investigation which she wishes to bring to OSCR's attention.

39. As noted above, during the investigation, OSCR informed Mrs Lindsay that part of the information requested was available in the public domain and readily accessible to her. OSCR had previously intimated that the information requested was exempt from disclosure under section 35(1)(g) of FOISA.

40. In its submissions to the Commissioner, OSCR explained that this information had been overlooked in its original consideration of Mrs Lindsay's request. As noted above, OSCR notified Mrs Lindsay that this information was already publicly available and disclosed a copy of the information to Mrs Lindsay.

41. The Commissioner is pleased that this oversight was rectified during the investigation. However, she would ask OSCR to reflect on this and ensure that all relevant information falling within the scope of a request is identified and considered in future.

42. The Commissioner notes also that OSCR failed to respond to Mrs Lindsay's request for information and did not provide a response until after she had required it to review that failure.

43. The Commissioner would ask OSCR to ensure, as far as possible, that responses to information requests are made timeously, in accordance with the requirements of section 10(1) of FOISA.

Decision The Commissioner finds that, in respect of the matters specified in the application, the Office of the Scottish Charity Regulator complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mrs Lindsay.

Appeal

Should either Mrs Lindsay or the Office of the Scottish Charity Regulator wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

8 November 2016

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---