Decision 248/2013 Mr Paul Hutcheon and the University of Glasgow
Meetings and communications with principal
Reference No: 201302061
Decision Date: 7 November 2013
Summary
On 10 June 2013, Mr Hutcheon asked the University of Glasgow (the University) for information concerning meetings and communications with named individuals. The University withheld information on the basis that it was personal data and exempt under FOISA.
Following an investigation, the Commissioner found that the University was entitled to withhold the information under section 38(1)(b) of FOISA, as it comprised personal data the disclosure of which would breach the first data protection principle.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 10 June 2013, Mr Hutcheon wrote to the University, requesting the following information:
a) Between March 3rd 2013 and June 10th 2013, did the University principal meet with the parents (or one of the parents) of [named individual]? If so, please provide the dates of the meetings, the location of the meetings, and the names of the people present.
b) Regarding question 1, please provide me with all communications on the arrangements of any meetings that took place. The communications should include the initial request for any such meetings.
c) Between March 3rd 2013 and June 10th 2013, please provide me with all communications between the university principal and the parents of [named individual], on issues specifically relating to [named individual].
2. The University responded on 8 July 2013. Mr Hutcheon was informed that the information was withheld under sections 38(1)(b) and 36(2) of FOISA, with explanations of why these exemptions were considered to apply.
3. On 22 July 2013, Mr Hutcheon wrote to the University requesting a review of its decision. He explained why he did not consider the exemptions applied.
4. The University notified Mr Hutcheon of the outcome of its review on 20 August 2013, upholding its original decision without modification.
5. On 3 September 2013, Mr Hutcheon wrote to the Commissioner's office, stating that he was dissatisfied with the outcome of the University's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Mr Hutcheon made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7. On 4 September 2013, the University was notified in writing that an application had been received from Mr Hutcheon and was asked to provide the Commissioner with any information withheld from him. The University responded with the information requested and the case was then allocated to an investigating officer.
8. The investigating officer subsequently contacted the University, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. The investigating officer's questions focused in particular on the University's application of section 36(2) and 38(1)(b) of FOISA: the University responded with full submissions on these points.
9. Mr Hutcheon provided submissions on the legitimate interest he believed he was pursuing.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Hutcheon and the University. She is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal Information
11. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate) exempts personal data from release if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
12. The University submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first, second, sixth and eighth data protection principles. Therefore, it argued that the information was exempt under section 38(1)(b) of FOISA.
13. In considering the application of this exemption, the Commissioner will therefore first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first and (if necessary) the other data protection principles claimed.
14. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
15. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."
16. The Commissioner has considered the submissions received from the University and Mr Hutcheon on this point, along with the withheld information. In the circumstances, taking account that Mr Hutcheon's request relates to information held concerning specific individuals, she is satisfied that the information requested relates to those living individuals, who can be identified from the information. The information is biographical in relation to, and focuses on, those individuals. The Commissioner therefore accepts that the information would be those individuals' personal data, as defined by section 1(1) of the DPA.
The first data protection principle
17. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain in response to Mr Hutcheon's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (the full text of the principle is set out in the Appendix)
18. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.
19. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
20. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure to Mr Hutcheon. In any event, neither Mr Hutcheon nor the University has argued that any other condition would be relevant. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individuals to whom the data relate).
21. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a. Is Mr Hutcheon pursuing a legitimate interest or interests?
b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject(s)?
c. Even if the processing is necessary for Mr Hutcheon's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
22. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Hutcheon must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the personal data to Mr Hutcheon.
Is the applicant pursuing a legitimate interest or interests?
23. The University submitted that it did not consider Mr Hutcheon to have a legitimate interest for the purposes of condition 6. Whilst acknowledging that "legitimate interest" for the purposes of condition 6 was not to be equated with the public interest provided for by by section 2(1)(b) of FOISA, the University submitted that the Commissioner's advice on the public interest test was still relevant in considering whether Mr Hutcheon had a legitimate interest. It noted in particular that the public interest was not to be equated with matters which were "of interest to the public": disclosure must be in the interests of the public and not merely of individual interest.
24. The University acknowledged that Mr Hutcheon might argue that the information was of interest to the public, but argued that he did not have a legitimate interest in obtaining the information which did not relate to anyone who was a public figure or an office holder of the University. It also emphasised that, in addition to its responsibilities in respect of the disciplinary process, it owed the individual concerned a duty of care.
25. Mr Hutcheon submitted that, as a journalist, he had a legitimate interest in gathering information for a "public interest" story. He explained that the individual named in his request was the subject of the University's disciplinary process and he believed it to be in the public interest to know whether the principal (who was not involved in the disciplinary process) met with the parents during that process, with a view to ensuring that the process was fair and not marked by lobbying.
26. Having considered all relevant submissions she has received on this point, along with the withheld personal data, the Commissioner accepts that Mr Hutcheon - as a journalist - may have a legitimate interest in the disciplinary process of the University and whether, in any given case, that process has been conducted fairly. However, she does not accept that would be pursuing such a legitimate interest in seeking the personal data under consideration in this case: while she cannot comment in any detail on the content of the information, she does not consider it to be of sufficient relevance to engage Mr Hutcheon's legitimate interest.
27. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the personal data under consideration. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA. In reaching this conclusion, she has not found it necessary to consider the other data protection principles referred to in the University's submission.
28. As the Commissioner has concluded that all of the information withheld by the University was correctly withheld in terms of section 38(1)(b) of FOISA, she is not required (and does not intend) to consider the exemption in section 36(2) in relation to that information.
DECISION
The Commissioner finds that the University of Glasgow (the University) complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Hutcheon.
Appeal
Should either Mr Hutcheon or the University of Glasgow wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
7 November 2013
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
