Decision 263/2013 Mr Kevin O'Sullivan and the Scottish Ministers
David Coulthard's work for Road Safety Scotland
Reference No: 201301655
Decision Date: 21 November 2013
Summary
On 22 May 2013, Mr O'Sullivan asked the Scottish Ministers (the Ministers) for information relating to the recent work done by Mr David Coulthard for Road Safety Scotland. The Ministers responded by explaining that they did not hold certain of the information, withholding the remainder under section 38(1)(b) of FOISA. They considered this information to be personal data, disclosure of which would breach the first data protection principle.
Following an investigation, the Commissioner found that the Ministers were not entitled to withhold the information under section 38(1)(b) of FOISA. She required the Ministers to disclose this information.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6).
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 22 May 2013, Mr O'Sullivan asked the Ministers for information relating to the recent work done by David Coulthard for Road Safety Scotland, specifically:
a) Was David Coulthard paid to take part in the campaign?
b) If so, how much was the fee? Was it a one-off or part of a deal? Please give details.
c) Was any tax deducted by Road Safety Scotland/Scottish Government from any payments made?
2. The Ministers responded on 19 June 2013, withholding information which would answer parts a) and b) of Mr O'Sullivan's request. They considered this to be personal data, disclosure of which would contravene the data protection principles (and therefore applied section 38(1)(b) of FOISA).
3. In response to part c) of Mr O'Sullivan's request, the Ministers explained that an individual's personal taxation arrangements were their own responsibility and that individual, and not the organisation making the payments, was required to ensure to ensure tax was paid if and when due. Mr O'Sullivan did not question the Ministers' response to part c) of his request. As such, the Commissioner will not consider it further.
4. On 20 June 2013, Mr O'Sullivan wrote to the Ministers to request a review of their decision. Mr O'Sullivan set out detailed reasons as to why he considered the information should be disclosed. He did not believe the Ministers had struck the right balance between the fair processing principle in the DPA, and the legitimate interests of both himself and the public. Mr O'Sullivan also believed the exemption in section 32 of the DPA (Journalism, literature and art) applied to the information.
5. The Ministers notified Mr O'Sullivan of the outcome of their review on 11 July 2013, upholding their original decision without modification. They explained why they did not consider section 32 of the DPA to be applicable.
6. On 17 July 2013, Mr O'Sullivan wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
7. The application was validated by establishing that Mr O'Sullivan made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
8. On 23 July 2013, the Ministers were notified in writing that an application had been received from Mr O'Sullivan and were asked to provide the Commissioner with any information withheld from him. The Ministers responded with the information requested and the case was then allocated to an investigating officer.
9. The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA).
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr O'Sullivan and the Ministers. She is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal information
11. The Ministers applied the exemption in section 38(1)(b) to information which would address parts a) and b) of Mr O'Sullivan's request. The Ministers argued that disclosure of this information would breach the first data protection principle.
12. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
13. In order to rely on this exemption, therefore, the Ministers must show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
Is the information personal data
14. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the appendix).
15. The Commissioner is satisfied that the withheld information is personal data in line with the definition in part a) of section 1(1) of the DPA. A living individual, David Coulthard, can be identified from this information. The information clearly relates to him, as it can be considered to be biographical about, and to focus on, him.
Would disclosure breach the first data protection principle?
16. As noted above, the Ministers argued that making this information available would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing in this case would be making the information available in response to Mr O'Sullivan's request.
17. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and she is satisfied that the personal data under consideration in this case do not fall into any of the categories set out in that definition. Therefore, it is not necessary to consider the conditions in Schedule 3 in this case.
18. These include condition 10, which applies when "the personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph". Paragraph 3 in the Schedule to The Data Protection (Processing of Sensitive Personal Data) Order 2000 provides for the disclosure of sensitive personal data which is in the substantial public interest and to which certain conditions (broadly, relating to unlawful or improper conduct), where that disclosure is for the "special purposes" as defined in section 3 of the DPA, with a view to publication the data controller believes to be in the public interest. Under section 3 of the DPA, these "special purposes" are defined as journalism, artistic purposes and literary purposes.
19. As explained above, the withheld information is not sensitive personal data and therefore the Order referred to in the previous paragraph cannot apply. There is nothing in Schedule 2 to the DPA which relates specifically to the "special purposes": the only other provision relating to them is section 32 of the DPA
20. Section 32 is an exemption from certain requirements of the DPA. Subject to certain other conditions, personal data processed only for the "special purposes" are exempt from (amongst other things) the provisions of the data protection principles, apart from the seventh data protection principle. This may facilitate disclosure by a person processing such data for these purposes (which the Ministers, as opposed to media organisations, are unlikely to be doing in any event), but it does not create a requirement that such data be disclosed under FOISA, or by itself provide an interest in the disclosure of such data under FOISA. The Commissioner does not consider section 32 to have any inherent relevance to disclosure under FOISA.
21. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
22. The Commissioner must now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether the disclosure of personal data would otherwise be fair and lawful.
23. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
Can any Schedule 2 condition be met?
24. As the Ministers acknowledged, condition 6 would appear to be the only condition in Schedule 2 which might be relevant in the circumstances of this case (although they concluded that the condition could not be fulfilled by disclosure of the withheld information). Condition 6 allows personal data to be processed if the processing is necessary for the purpose of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e the individual to whom the data relate).
25. As explained in the Commissioner's guidance on this exemption[2] there are a number of different tests which must be satisfied before condition 6 can be met. These are:
? Is Mr O'Sullivan pursuing a legitimate interest or interests?
? If yes, is the processing necessary for Mr O'Sullivan's legitimate interests? In other words, is the processing proportionate as a means and fairly balanced to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?
? Even if the processing is necessary for Mr O'Sullivan's legitimate interests, is it unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
26. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by FOISA. Accordingly, the legitimate interests of Mr O'Sullivan must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Mr O'Sullivan.
Is Mr O'Sullivan pursuing a legitimate interest or interests?
27. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on personal information states:
In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
28. Mr O'Sullivan explained that as a freelance journalist he was carrying out an investigation into "high net worth" individuals, and in this connection he believed it was in both his interests and those of the general public to disclose the amount of money paid to Mr Coulthard for his part in the Transport Scotland road safety campaign. Mr O'Sullivan considered that the Ministers' decision to withhold this information displayed a lack of transparency on how public money was spent, particularly where there was justifiable anger about the tax arrangements of both corporate entities and private individuals.
29. Mr O'Sullivan also considers that disclosure of the information would satisfy both his and the public interest in knowing whether statements made by the Scottish Government on tax avoidance (particularly the Finance Secretary's public intention to take a firm approach against those engaged in tax avoidance) were in fact being undermined by its own actions.
30. The Commissioner has considered these comments carefully, noting that the Ministers accept Mr O'Sullivan is pursuing a legitimate interest. In the circumstances, she accepts that Mr O'Sullivan and the general public have a legitimate interest in the understanding whether Mr Coulthard was paid for his work on the Transport Scotland road safety campaign, and, if so, how much his fee was (and whether this was one-off or part of a deal).
Is the processing necessary for the purposes of these interests?
31. When considering this, the Commissioner must consider whether the interests she has identified might reasonably be met by any alternative means, which would interfere less with the privacy of the individual whose personal data has been withheld.
32. While the Ministers acknowledged that Mr O'Sullivan had legitimate interests in disclosure of the information, they did not consider that divulging the withheld information would give Mr O'Sullivan any extra information in relation to Mr Coulthard's tax arrangements, which they believed to be one of Mr O'Sullivan's key interests.
33. The Commissioner accepts the submission made by the Ministers, but recognises that disclosure of the withheld information would fulfil both Mr O'Sullivan's and the public's interest in understanding how public money is spent, and whether best value is achieved by that expenditure.
34. The Commissioner is not aware of any other viable means of meeting these interests which would interfere less with the privacy of the data subject than providing the information requested. For this reason, she is satisfied that disclosure of the information is necessary for the purposes of Mr O'Sullivan's legitimate interests.
Would disclosure be unwarranted by reason of prejudice to the legitimate interests of the data subject(s)?
35. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr O'Sullivan's legitimate interests, she must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Mr O'Sullivan and those of the data subject. Only if the legitimate interests of Mr O'Sullivan outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.
36. In the Commissioner's briefing on personal information[3], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
? the potential harm or distress that may be caused by disclosure
? whether the individual objected to the disclosure
? the reasonable expectations of the individual as to whether the information should be disclosed.
37. In their submissions, the Ministers commented that when Mr Coulthard agreed to take part in the campaign he did not have any reasonable expectation that his personal data would be released to third parties.
38. The Ministers explained that the contract for Mr Coulthard's participation in this campaign was negotiated by a third party organisation working on behalf of the Scottish Government. This was done on a confidential basis, with confidentiality being agreed between all parties.
39. The Ministers added that, although Mr Coulthard is a well-known public figure, he still had a right to expect that a data controller such as the Scottish Government would not provide his personal data to a journalist who could reasonably be expected to publish allegations about his personal taxation arrangements (as they believed to be implicit in his request).
40. Mr O'Sullivan has commented that the DPA placed less importance on the protection of personal data when the data related to "professional life", as he believed to be the case here, in relation to a payment to Mr Coulthard for work on a road safety campaign.
41. The Commissioner notes that the Ministers asked Mr Coulthard whether he would consent to the disclosure of the withheld information, but did not receive a response. While relevant to the overall balancing exercise, it does not necessarily follow from this that disclosure would be unwarranted.
42. The Commissioner acknowledges the comments made by Mr O'Sullivan about the fact that the withheld information relates to work carried out by Mr Coulthard in his professional life. It is work for which Mr Coulthard would use his professional skills in a project intended for the public benefit. While not a public servant, he is clearly a public figure. For these reasons, presumably, he was employed to do the work. However, she must take into account all factors bearing on Mr Coulthard's reasonable expectations as to how his personal data would be processed, and on any potential harm or distress from disclosure.
43. Having read the agreement between Mr Coulthard and the Scottish Government, the Commissioner does not accept that there is anything in this agreement which would lead Mr Coulthard to have a reasonable expectation that details of any payment made would remain confidential and would not be disclosed in response to a FOISA request. There is no specific reference to confidentiality and she can identify no basis for implying a relationship of confidentiality from the circumstances.
44. The Commissioner also notes that the withheld personal data would not enlighten Mr O'Sullivan about Mr Coulthard's tax arrangements. Consequently, their disclosure would not appear to carry a significant risk of harm or distress in the form argued by the Ministers.
45. In all the circumstances, having considered the arguments made by both Mr O'Sullivan and the Ministers, and having weighed Mr O'Sullivan's legitimate interests against the legitimate interests, rights and freedoms of Mr Coulthard, the Commissioner has concluded that those of Mr O'Sullivan outweigh those of Mr Coulthard. As a result, she has determined that disclosure would not be unwarranted in this case.
46. Having drawn these conclusions, the Commissioner finds that condition 6 in Schedule 2 (to the DPA) can be met in this case in relation to disclosure of the withheld personal data.
47. As the Commissioner has not accepted that disclosure of the personal data would lead to unwarranted prejudice to the rights, freedoms or legitimate interests of Mr Coulthard, the Commissioner also concludes, for the same reasons, that disclosure of the withheld information would not be unfair.
48. In the absence of any other reason for finding disclosure to be unlawful (and none has been put forward by the Ministers), and given that she is satisfied that condition 6 can be met, the Commissioner must find that disclosure would be lawful. The Commissioner therefore finds that disclosure of the withheld information which would address parts a) and b) of Mr O'Sullivan's request would not breach the first data protection principle, and so this information was not properly withheld under the exemption in section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that the Scottish Ministers (the Ministers) failed to comply with Part 1 (and in particular section 1(1)) of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr O'Sullivan. She finds that the Ministers were not entitled to withhold information falling within the scope of parts a) and b) of Mr O'Sullivan's request under section 38(1)(b) of FOISA.
The Commissioner therefore requires the Ministers to disclose the information which would fulfil parts a) and b) of Mr O'Sullivan's request by 6 January 2014.
Appeal
Should either Mr O'Sullivan or the Scottish Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
21 November 2013
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?.
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - the principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1]
[2]
[3]
