Decision 252/2013 Mr Paul Hutcheon and the Scottish Ministers

First Minister's diary

Reference No: 201300654
Decision Date: 14 November 2013

Summary

On 8 October 2012, Mr Hutcheon asked the Scottish Ministers (the Ministers) for the information in the First Minister's official and personal diaries between 1 January 2011 and 8 October 2012.

The Ministers withheld information as either; otherwise accessible, or as personal data the disclosure of which would breach the first data protection principle. Following an investigation, the Commissioner found that the Ministers had dealt with Mr Hutcheon's request for information in accordance with Part 1 of FOISA and did not require them to take any further action.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a), (2)(a) and (2)(e)(ii) (Effect of exemptions); 25(1) (Information otherwise accessible); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1. On 8 October 2012, Mr Hutcheon wrote to the Ministers requesting the following information:

1. A copy of First Minister Alex Salmond's official diary between 1 January 2011 to 8 October 2012, including entries that are deemed personal engagements/personal meetings

2. If First Minister Alex Salmond has a separate personal diary from his official diary, please provide me with a copy of his personal diary between 1 January 2011 to 8 October 2012

Mr Hutcheon referred to a recent decision by the UK Information Commissioner (the ICO) on the diary of Mayor Boris Johnson (Case Ref: FS50431334)[1].

2. Mr Hutcheon wrote to the Ministers on 10 November 2012, requesting a review because they did not respond to his initial request.

3. The Ministers notified Mr Hutcheon of the outcome of their review on 12 February 2013.

a. In respect of the first part of his request, the Ministers withheld some information under section 38(1)(b) (Personal information) and section 39(1) (Health and safety). They also explained that the First Minister's diary was published on the Scottish Government's website, without the information withheld under these sections, and was therefore exempt in term of section 25(1) of FOISA. The Ministers provided a link to the published information on Ministerial engagements and journeys.

b. In respect of the second part of his request, the Ministers informed Mr Hutcheon they did not hold any information.

4. On 5 March 2013, Mr Hutcheon wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

5. The application was validated by establishing that Mr Hutcheon made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

6. On 15 March 2013, the Ministers were notified in writing that an application had been received from Mr Hutcheon and were asked to provide the Commissioner with the information withheld from him. The case was then allocated to an investigating officer and the withheld information was provided during the investigation.

7. The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions. They were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested, and to provide certain further information on the nature of the diary.

Commissioner's analysis and findings

8. In coming to a decision on this matter, the Commissioner considered all the withheld information and the relevant submissions, or parts of submissions, made to her by both

Mr Hutcheon and the Ministers. She is satisfied that no matter of relevance has been overlooked.

Section 25(1) - Information otherwise accessible

9. Under section 25(1) of FOISA, information is exempt if an applicant can reasonably obtain that information other than by requesting it under section 1(1). The exemption in section 25 is absolute, in that it is not subject to the public interest test set out in section 2(1)(b) of FOISA.

10. The Ministers responded that some information was exempt because it was reasonably obtainable, and provided two links to it on the Scottish Government website. Mr Hutcheon provided no particular reasons why he disagreed with the Ministers' application of this exemption.

11. Having looked at this information, the Commissioner accepts that it falls within the scope of

Mr Hutcheon's request and is also satisfied that it could reasonably be obtained by him other than by requesting it under section 1(1) of FOISA. Therefore, she accepts that it is exempt (and properly withheld) under section 25(1) of FOISA.

Section 38(1)(b) - Personal information

12. The Ministers applied the exemption in section 38(1)(b) of FOISA to the remaining withheld information.

13. The information requested by Mr Hutcheon, and withheld by the Ministers, is the First Minister's official Diary. This is held electronically by the Ministers. The Ministers provided the Commissioner with the Diary in spreadsheet form. This spreadsheet indicates the date, times, location, activity (for example, whether a meeting, phone call, travel, interview, etc.) and persons involved.

14. Also contained in the diary are private, party and constituency slots, all marked as such. The Ministers confirmed that those entries marked "private" were private in the sense of being personal to the First Minister himself (and not relating to fulfilling his official role as First Minister).

15. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, 38(2)(b), exempts information from disclosure if it is "personal data" as defined in section 1(1) of the DPA and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

16. In order to rely on this exemption, therefore, the Ministers must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles.

Is the information personal data?

17. "Personal data" are defined in section 1(1) of the DPA as data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

18. The Ministers noted that Mr Hutcheon had specifically asked for details of the First Minister's private and personal diary. In addition, they submitted that the First Minister's diary would "by the very nature of his work contain the personal details of individuals who have been in communication with him." In all the circumstances, they considered the information withheld under section 38(1)(b) to be personal data.

19. The Commissioner agrees with this submission. The withheld information clearly relates to living individuals, who can be identified from it. In line with definition (a) of "personal data", the Commissioner accepts that the information is either the personal data of the First Minister himself, or of other individuals.

The first data protection principle: fair and lawful processing

20. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing under consideration here would be disclosure in response to Mr Hutcheon's information request.

21. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the personal data under consideration in this case do not fall into any of the categories set out in that definition. Therefore, it is not necessary to consider the conditions in Schedule 3 to the DPA in this case.

22. There are three separate aspects to the first data protection principle:

a. fairness,

b. lawfulness and

c. the conditions in the schedules.

These three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

23. The Commissioner must now go on to consider whether there are any conditions in schedule 2 to the DPA which would permit the personal data to be disclosed. Where a schedule 2 condition can be met, she must then go on to consider whether the disclosure of the personal data would otherwise be fair and lawful.

Can any Schedule 2 condition be met?

24. In their submissions, the Ministers argued that none of the conditions in Schedule 2 were met in this case, with the result that disclosure would be neither fair nor lawful.

25. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[2] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.

26. Condition 6 would appear to be the only condition in Schedule 2 which might permit disclosure to Mr Hutcheon in the circumstances of this case. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. the individuals to whom the data relate).

27. There are, therefore, three tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr Hutcheon pursuing a legitimate interest or interests?

(ii) If yes, is disclosure necessary for the purposes of these legitimate interests? In other words, is the disclosure proportionate as a means and fairly balanced to its ends, or could the legitimate interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for these purposes, would the disclosure nevertheless be unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

28. There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA. This means the legitimate interests of Mr Hutcheon must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Mr Hutcheon.

Is Mr Hutcheon pursuing a legitimate interest or interests?

29. Mr Hutcheon expressed his legitimate interests as follows:

? as a journalist, I wish to see who our elected First Minister has been meeting, as well as writing about these meetings for the Sunday Herald's readers. I believe the issue of who the FM meets is in the public interest and that I am helping further the public interest in seeking this information.

30. The Ministers submitted that, as a journalist, Mr Hutcheon might consider he had an interest in the First Minister's private and personal data. However, they were not convinced that his status as a journalist should override the First Minister's own rights to privacy and a personal life. They considered that, while Mr Hutcheon might have an interest in who contacted the First Minister and why, this should not override an individual's right to be able to communicate private and personal issues to the First Minister.

31. The Commissioner has interpreted Mr Hutcheon's interests, as expressed above, to be in relation to transparency and scrutiny of the First Minister's actions. Although these interests are general in nature, given the prominence of, and responsibilities inherent in, the First Minister's role she accepts they are legitimate interests for an investigative journalist, and for the wider public. The Commissioner notes that Mr Hutcheon did not identify any specific interest in the content of the diary, or any of the activities which may be covered in it, which might have provided more compelling legitimate interests in the circumstances.

Is disclosure necessary for the purposes of these legitimate interests?

32. The Commissioner must now consider whether disclosure is necessary for the purposes of

Mr Hutcheon's legitimate interests. In doing so she must consider whether these interests might reasonably be met by any alternative means.

33. Mr Hutcheon explained why he believed it necessary to obtain the withheld information:

I believe disclosure of the official diary is necessary because a) voters should not just "take it as read" that diaries should be secret, b) the public is entitled to make its own judgments about the FM's meetings, based on publication of the full information requested, and c) the information already published is a mere snapshot, and not sufficient.

34. The Ministers' submissions referred to the information they published already on the First Minister's engagements. They noted that Mr Hutcheon was an experienced political journalist, who would be aware of the information published regularly. It was unclear to them what interest the additional information sought might have for Mr Hutcheon, and they did not believe he had identified why such personal details were necessary.

35. The Commissioner has considered the submissions from Mr Hutcheon and the Ministers, in the light of the recent decision by the Supreme Court in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[3]. In this case the Supreme Court stated (at paragraph 27 of the judgment):

? A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. Thus, for example, if Mr Irvine had asked for the names and addresses of the employees concerned, not only would article 8 have clearly been engaged, but the [C]ommissioner would have had to ask [herself] whether [the requester's] legitimate interests could have been served by a lesser degree of disclosure.

36. The Ministers appear to argue that Mr Hutcheon's legitimate interests might reasonably be met by the information they publish on Ministerial engagements, although they have made no attempt in their submissions to correlate that information and the information in Mr Salmond's diary. They do not appear to believe that disclosure of further information from the diary is necessary for Mr Hutcheon's purposes.

37. On the other hand, Mr Hutcheon does not consider the published information to be sufficient for his purposes. He describes it as "a mere snapshot", although he does not explain this view or provide any other reasons why he considers it inadequate.

38. The Commissioner has considered the submissions provided by both parties, and the published information referred to by the Ministers. The published information does not correspond entirely with the diary and neither party has provided strong arguments to support their views. Whilst it is not clear how the published information is "a mere snapshot", on balance the Commissioner accepts that the general legitimate interests identified by

Mr Hutcheon cannot be met in full without disclosure of the withheld personal data, and that (to that extent) disclosure is necessary for the purposes of these legitimate interests.

Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

39. The Commissioner must now consider whether disclosure would nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects. This involves a balancing exercise between the legitimate interests of Mr Hutcheon and those of the data subjects. Only if the legitimate interests of Mr Hutcheon outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

40. In the Commissioner's briefing on section 38 of FOISA[4], she notes a number of factors which should be taken into account at this stage. These include:

? whether the information relates to the data subject's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

? the potential harm or distress that may be caused by disclosure

? whether the data subject objected to the disclosure

? the reasonable expectations of the data subject as to whether the information should be disclosed.

41. The Ministers argued that, while Mr Hutcheon, along with others (particularly journalists), might have an interest in who contacted the First Minister and why, that this should not override the right of individuals to be able to communicate private and personal issues to the First Minister. Equally, they did not believe that interest should override the First Minister's own rights to privacy and a personal life.

42. In this case, there is a range of data subjects to be considered, including the First Minister and others (acting in both private and public capacities and having varying degrees of seniority and public profile). The Ministers did not differentiate between the various categories of people who met and spoke with the First Minister in their original submission, and were asked for more detail on why the first data protection principle would be breached by disclosure (bearing in mind that the legitimate interests engaged may vary depending on who the data subjects were, whom they represented, the nature of their contact, and so on). They were asked to differentiate between the various types of individuals involved, with reference to (for example):

? the capacity in which the individual was dealing with the First Minister 

? the profile or activities of those not acting in an official capacity

? the reasonable expectations of those individuals as to disclosure.

43. The Ministers responded that, generally, the individuals concerned would not have an expectation that information about the fact they were meeting the First Minister would be released to third parties. They identified particular concerns in relation to individuals not employed in the public sector, and particularly in relation to phone calls. If the exact nature of the call was not recorded, then it was impossible to say whether the call was of a personal nature or business related. They acknowledged that they had not attempted to identify any further recorded information which might confirm this, or which might shed any light on the expectations of the individuals concerned.

44. The Ministers responses were poor and did not go beyond what is set out in the preceding paragraph in relation to the factors referred to in paragraph 40. Like Mr Hutcheon, they provided only general arguments in support of their position, in this case relating largely to the reasonable expectations of the data subjects.

45. The Commissioner has considered the arguments made by both Mr Hutcheon and the Ministers. She finds these to be finely balanced, largely because in neither case are they of particular substance, or focused on the information under consideration or the reasons why it should or should not be disclosed. There are no other factors the Commissioner is in a position to consider.

46. The Commissioner must approach the balancing exercise required by condition 6 on the basis that there is no presumption in favour of the release of personal data under the general obligation laid down by FOISA.

47. In relation to the data subjects' expectations, the Commissioner considers it reasonable to take account of the Ministers' retrospective publication of information on the First Minister's engagements in addition to the submission set out above, given the weight attached to it by the Ministers .It would be reasonable to conclude in this case that what could be published, had been, taking into account personal information as it related to each of the data subjects.

48. In all the circumstances of this case, particularly on the basis of the reasonable expectations of the data subjects, the Commissioner is not satisfied that Mr Hutcheon's legitimate interests are sufficiently strong to outweigh the prejudice she accepts would be caused by disclosure to the legitimate interests of the data subjects. Therefore, she finds that disclosure would be unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of those data subjects, with the result that condition 6 in Schedule 2 to the DPA cannot be met in relation to the withheld personal data. However, this conclusion is specific to the circumstances of this case and it is not to say that in the circumstances of other cases arguments about the legitimate interests of the requester would necessarily be outweighed by similar, very general submissions from the Ministers.

49. Having accepted that disclosure of the withheld personal data would be unwarranted in this case as described above, the Commissioner concludes, for the same reasons, that disclosure would be unfair. In the absence of a Schedule 2 condition permitting disclosure, she also finds that disclosure would be unlawful.

50. Having considered all the relevant tests, the Commissioner finds that disclosure of the withheld personal data would contravene the first data protection principle. Consequently, she accepts that this information was properly withheld under the exemption in section 38(1)(b) of FOISA.

51. As the Commissioner has accepted that all of the requested information was properly withheld under other exemptions in FOISA, she does not find it necessary to consider the Ministers' application of section 39(1) of FOISA in this case.

DECISION

The Commissioner finds that the Ministers complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Hutcheon.

Appeal

Should either Mr Hutcheon or the Scottish Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner
13 November 2013

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

(a) section 25;

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

25 Information otherwise accessible

(1) Information which the applicant can reasonably obtain other than by requesting it under section 1(1) is exempt information.

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

[1]

[2]

[3]

[4]