Decision 272/2013 Ms Deborah Millar and South Lanarkshire Council
Future of Crawfordjohn Primary School
Reference No: 201301991
Decision Date: 3 December 2013
Summary
On 6 June 2013, Ms Millar asked South Lanarkshire Council (the Council) for the written responses from all parents with regard to their views on the future rebuild or discontinuation of Crawfordjohn Primary School. The Council withheld this information under section 38(1)(b) of FOISA, as personal data, the disclosure of which would breach the first data protection principle. The Commissioner accepted this following an investigation.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 6 June 2013, Ms Millar wrote to the Council requesting the following information:
"? a copy of the written responses from all parents with regards to their views on the future rebuild or discontinuation of Crawfordjohn Primary School? There should be seven written responses and one telephone response."
2. The Council responded on 3 July 2013 and withheld the information (with reasons) under sections 38(1)(b), 30(b)(ii) and 36(2) of FOISA. The Council provided Ms Millar with a copy of her own response in terms of the DPA.
3. On 4 July 2013, Ms Millar wrote to the Council requesting a review of its decision. She believed any personal data could be redacted to permit disclosure of the remaining information. Ms Millar also stated that she was not interested in the content of the responses, "just the actual amount of responses given as this issue has been continually disputed".
4. The Council notified Ms Millar of the outcome of its review on 2 August 2013, upholding its decision to withhold the information under section 38(1)(b) of FOISA. However, it did not uphold the application of the exemptions in sections 36(2) and 30(b)(ii). The Council confirmed that the withheld information comprised seven written and one telephone response.
5. On 23 August 2013, Ms Millar wrote to the Commissioner, stating that she was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Ms Millar made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7. On 30 August 2013, the Council was notified in writing that an application had been received from Ms Millar and was asked to provide the Commissioner with the information withheld from her. The Council responded with the information requested and the case was then allocated to an investigating officer.
8. The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions relating to its application of section 38(1)(b).
9. The Council confirmed that it still wished to rely on section 38(1)(b) of FOISA to withhold the information. It provided a submission on this, but also asked the Commissioner to take account of its responses to Ms Millar, both initially and on review.
10. Following further discussions with Ms Millar, which confirmed the breakdown of the responses as previously indicated by the Council, she confirmed that she wished the Commissioner to make a decision on the withheld information. She wished to confirm whether the views of respondents had been accurately represented
Commissioner's analysis and findings
11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Ms Millar and the Council. She is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal information
12. The Council withheld information in terms of section 38(1)(b) of FOISA, on the basis that disclosure would breach the first data protection principle. Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (b) (as appropriate), exempts personal data if its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.
13. In considering the application of this exemption, the Commissioner will firstly consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether its disclosure would breach the first data protection principle.
Is the information under consideration personal data?
14. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is the possession of, or is likely to come into the possession of, the data controller ..." (the full definition is in the Appendix).
15. Following discussion with Ms Millar, the Commissioner does not consider it possible to restrict the scope of information within the consultation responses which could meet Ms Millar's request. Given that her concerns relate to the true meaning of each response, and given the nature of the responses, the Commissioner has concluded that the request should be interpreted as relating to the full responses.
16. The Council submitted that the information was the personal data of the senders of the consultation responses, because they were expressing their personal views on the options available to the Council in relation to Crawfordjohn Primary School. In the Council's view, the correspondence had the views of identifiable individuals as its central theme and so amounted to the personal data of those individuals.
17. The Commissioner has considered the withheld information and is satisfied that it is personal data. Each response identifies a living individual or individuals. The information in the responses is biographical in relation to those individuals and focuses on them: it expresses views on aspects of their personal and family lives. The Commissioner is therefore satisfied that the information relates to those individuals.
18. The Commissioner has also considered Ms Millar's point, made when seeking a review, that personal data might be removed through redaction, permitting disclosure of the rest of the withheld information. Given the nature of the information, relating to a small number of individuals in a small community, she does not consider this would be possible while retaining information of any substance: a significant risk of identification would still remain (essentially, this was the conclusion reached by the Council on review).
The first data protection principle
19. The Council submitted that disclosure of the withheld information would contravene the first data protection principle. It referred to its initial response to Ms Millar and the outcome of its review, both of which stated that the individuals whose responses were recorded would not expect those responses to be made public.
20. The first data protection principle states that personal data shall be processed fairly and lawfully. It also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The Commissioner is satisfied that none of the withheld information constitutes sensitive personal data: therefore, she is not required to consider whether any of the conditions in Schedule 3 can be met.
21. The processing in this case would be by disclosure into the public domain in response to Ms Millar's request. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner[1], that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the person or persons to whom the data relate).
22. The Council was asked whether any of the conditions in Schedule 2 to the DPA would allow the information to be disclosed. It confirmed that it had considered the application of condition 6, which the Commissioner agrees is the only condition which might be applicable in this case. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
23. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:
? Is Ms Millar pursuing a legitimate interest or interests?
? If so, is the disclosure necessary for the purposes of those interests? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could the interests be met by means which interfered less with the privacy of the data subject(s)?
? Even if disclosure is necessary for those purposes, would it nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s)? As noted by Lord Hope in the above judgment, there is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Ms Millar must outweigh the rights and freedoms or legitimate interests of the data subject(s) before condition 6 will permit the personal data to be disclosed.
Is Ms Millar pursuing a legitimate interest or interests?
24. Ms Millar indicated why she considered the information should be disclosed. She wished to verify the Council's handling of the consultation, and in particular its attributing of positions on the reinstatement of the school (in favour/not in favour/undecided) to certain persons.
25. The Council did not believe Ms Millar was pursuing a legitimate interest. Referring to her request for review, it commented that she disputed the amount of requests given by parents in connection with the informal consultation, not the contents of the consultations per se. The Council failed to see how this could amount to a legitimate interest in relation to disclosing the content of the responses.
26. As someone who has responded to the consultation and is affected by it and any decision made about the school in question, the Commissioner accepts that Ms Millar does have a legitimate interest in the number who responded, who responded and how they responded: clearly, there is also a wider community interest in these matters. As indicated above, the Commissioner does not believe it would be practicable to verify these matters without consideration of the content of the responses.
Is disclosure of the information necessary for the purposes of these legitimate interests?
27. The Commissioner must now consider whether disclosure of the personal data is necessary for the legitimate interests identified above. In doing, so she must consider whether these interests might reasonably be met by any alternative means.
28. In this respect, the Council submitted - while disagreeing that Ms Millar had a legitimate interest - that the relevant information had been provided to Mrs Millar already in a less intrusive way than supplying copies of the responses. It submitted that Ms Millar simply did not believe the Council and, presumably, wished to check by herself.
29. The Commissioner agrees with this submission of the Council - that, in essence, appears to be what Ms Millar is seeking to do.
30. As indicated above, the investigating officer and the Commissioner's Deputy Head of Enforcement have considered the withheld information and confirmed the breakdown of the responses (seven written responses and one telephone response; three in favour of reinstatement, four not in favour and one undecided). This corresponds to information provided to Ms Millar, and more widely to those affected by the Council's proposals for the school. There would appear to be no scope for ambiguity as to whether the Council has reflected the information it holds accurately.
31. The Commissioner has considered the submissions from Ms Millar and the Council carefully, in the light of the recent decision by the Supreme Court in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[2]. In this case the Supreme Court stated (at paragraph 27 of the judgment):
? A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. Thus, for example, if [applicant] had asked for the names and addresses of the employees concerned, not only would article 8 [of the European Convention on Human Rights] have clearly been engaged, but the Commissioner would have had to ask himself whether his legitimate interests could have been served by a lesser degree of disclosure.
32. On balance, having considered the submissions of both parties, the Commissioner acknowledges that disclosure of the withheld information would allow a degree of additional scrutiny in relation to the consultation. The Commissioner acknowledges that the Council has already made available information on the breakdown of the responses, which reflects accurately the information it holds on these matters. As to whether the one record produced by the Council as opposed to the individual respondents (a record of a telephone conversation) reflects that conversation accurately, the Commissioner cannot comment: in relation to the conversation, that is the information the Council holds.
33. On the other hand, the Commissioner has also identified concerns on Ms Millar's part (which she acknowledges fall within Ms Millar's legitimate interests) as to who made the responses held by the Council. From her own knowledge of the situation, Ms Millar does not understand who the various responses could be from, if the breakdown is accurate. To that extent, at least, the Commissioner accepts that disclosure is necessary to meet Ms Millar's legitimate interests: she could not acquire a full understanding of that point other than through disclosure of the withheld information.
34. The Commissioner must, therefore, go on to consider the interests of the data subjects.
Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?
35. The Commissioner must consider whether disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Ms Millar and those of the data subjects. Only if the legitimate interests of Ms Millar outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
36. The Council submitted that the data subjects would not expect the withheld information to be made available to the general public in this way. The Council explained that it had not indicated at any point to those making responses that any information they supplied would then be disclosed. This had been an informal consultation: by contrast, in the subsequent, more formal, process, consultees were informed that their views might be made public. The Council submitted that the withheld responses contained opinions and views individuals would not wish to be publicly known.
37. In the Commissioner's briefing on section 38 of FOISA[3], the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise. These include:
? whether the information relates the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);
? the potential harm or distress that may be caused to by the disclosure;
? whether the individual has objected to the disclosure; and
? the reasonable expectations of the individual as to whether the information would be disclosed.
38. The Commissioner accepts that the information pertains to the data subjects' personal lives. Inevitably, much of it pertains to the personal lives of young children and therefore (while it is not sensitive personal data within the definition in section 2 of the DPA) consideration of its disclosure to the public must be approached with a greater degree of sensitivity than would be required if it related to the personal lives of adults with full legal capacity.
39. No indication has been given to the Commissioner of the objection of the data subjects to disclosure, but equally there has been no indication of consent.
40. The Council did not make any specific submissions about the disclosure causing distress to the data subjects.
41. In all the circumstances, the Commissioner accepts that the individuals whose information has been withheld would not have any reasonable expectation that their personal data would be publicly disclosed (which is the effect of the disclosure of information under FOISA) in the context of Ms Millar's information request.
42. On balance, while the Commissioner accepts that disclosure of the withheld information would be necessary to fulfill Ms Millar's legitimate interests, in this instance she does not agree that this outweighs the prejudice that would be caused by disclosure to the data subjects' rights and freedoms or legitimate interests. Consequently, she finds that such prejudice would be unwarranted. The Commissioner is therefore satisfied that condition 6 of Schedule 2 is not met in this case.
43. Having concluded that disclosure of the withheld information would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects, the Commissioner must also conclude that disclosure would be unfair. In the absence of a condition permitting disclosure, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was properly withheld under section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that the Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Ms Millar.
Appeal
Should either Ms Millar or South Lanarkshire Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
3 December 2013
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
...
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] 2008 UKHL 47:
[2]
[3]
