Decision 278/2013 Ms Rachael Pringle and the Scottish Ministers
Relocation of employees
Reference No: 201301993
Decision Date: 6 December 2013
Summary
On 11 July 2013, Ms Pringle asked the Scottish Ministers (the Ministers) for a range of information relating to the relocation of Scottish Government employees. The Ministers provide her with some information and withheld other information on the basis that it was personal data and exempt under FOISA.
Following an investigation, the Commissioner found that the Ministers did not hold some of the information requested and were entitled to withhold other information as personal data, disclosure of which would breach the first data protection principle.
The Commissioner also found that the Ministers failed to respond to Ms Pringle's request within the required timescale.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 10(1)(a) (Time for compliance); 17(1) (Notice that information is not held); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 11 July 2013, Ms Pringle wrote to the Ministers, requesting all available information regarding the relocation of all Scottish Government employees from January 2010 to January 2011. She stipulated that this should include information on:
a) employee grade
b) department
c) nationality
d) length of service
e) age of employee
f) housing type and size (and information on relocation packages)
g) distance between old and new workplaces from the employee's original residence.
2. On 13 August 2013, Ms Pringle wrote to the Ministers requesting a review, on the basis that the Ministers had failed to respond to her request.
3. The Ministers notified Ms Pringle of the outcome of their review on 15 August 2013. They apologised for the delay in responding and provided some information to Mrs Pringle (including information on the relevant departments) stating that other information was not routinely disclosed and could not be included. They also stated that information relating to employee grades had been excluded as this might allow individuals to be identified.
4. On 26 August 2013, Mrs Pringle wrote to the Commissioner's office, stating that she was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
5. The application was validated by establishing that Mrs Pringle made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
6. On 3 September 2013, the Ministers were notified in writing that an application had been received from Mrs Pringle and were asked to provide the Commissioner with any information withheld from her. The Ministers responded with the information requested and the case was then allocated to an investigating officer.
7. The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions. The investigating officer's questions focused in particular on the application of section 38(1)(b) of FOISA: the Ministers responded with full submissions on these points.
8. The Ministers submitted that they did not hold information falling within points 1f) and g) above, and that the remaining information was exempt as disclosure would breach the first data protection principle (and therefore section 38(1)(b) of FOISA applied).
9. During the investigation, some further information was provided to Ms Pringle. She informed the Commissioner that she had not been provided with the information listed at paragraph 1 above and wished to continue with her application. Mrs Pringle was given the opportunity to provide further submissions (particularly on the legitimate interest she believed she was pursuing), but did not respond.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mrs Pringle and the Ministers. She is satisfied that no matter of relevance has been overlooked.
Information held by the Ministers
11. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to certain qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it. The qualifications contained in section 1(6) are not applicable in this case.
12. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with information the authority should hold. If no such information is held by the authority, section 17(1) of FOISA requires it to give the applicant notice in writing to that effect.
13. The Ministers provided submissions to the Commissioner explaining what information employees were required to provide when seeking payment of allowances and expenses under the relocation scheme. These did not include the information requested at points 1f) and g) above. The Ministers further explained that they had no reason to gather such information and therefore did not hold it.
14. Having considered all relevant submissions and the terms of the request, the Commissioner accepts that the Ministers interpreted Ms Pringle's request reasonably and took adequate, proportionate steps in the circumstances to establish what information they held and which fell within the scope of the request. She is satisfied that they did not hold any information falling within the scope of points 1f) and g).
15. The Commissioner must also find, however, that the Ministers should have given Ms Pringle notice that they did not hold this information. In not doing so, they failed to comply with section 17(1) of FOISA.
Section 38(1)(b) - Personal Information
16. The Ministers submitted that the withheld information was personal data for the purposes of the DPA and that its disclosure would contravene the first data protection principles. Therefore, it argued that the information was exempt under section 38(1)(b) of FOISA.
17. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (2)(b) (as appropriate), exempts personal data from release if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.
18. In considering the application of this exemption, the Commissioner will therefore first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first and data protection principle. The Commissioner will also consider whether any of the information is sensitive personal data as defined in section 2 of the DPA: if it is, she will consider the implications of that status for the application of the first data protection principle.
19. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Is the information under consideration personal data?
20. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."
21. The Commissioner has considered the submissions received from the Ministers on this point, along with the withheld information. She concludes that information in the remaining undisclosed categories (insofar as held by the Ministers) must be found to relate to the individuals concerned. The information is biographical in relation to those individuals and focuses on them.
22. The Ministers also provided submissions as to how the disclosure of the data in question could lead to the identification of those individuals. The Commissioner accepts that disclosure of the information could lead to such identification, with other available information. In all the circumstances, therefore, she accepts that (if disclosed) the information would be those individuals' personal data, as defined by section 1(1) of the DPA.
23. The Commissioner has considered whether any of the personal data in question is sensitive personal data as defined by section 2 of the DPA. Having considered all relevant submissions, she does not find that any of it falls within this definition, so she is not required to consider the conditions in Schedule 3 of FOISA.
The first data protection principle
24. The first data protection principle states that personal data shall be processed fairly and lawfully. (The processing in this case would be disclosure of the information into the public domain in response to Ms Pringle's request.) The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met.
25. The Commissioner will now consider whether there are any conditions in Schedule 2 which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.
26. There are three separate aspects to the first principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
27. In the circumstances, as the Ministers have acknowledged, condition 6 in Schedule 2 to the DPA would appear to be the only condition which might permit disclosure to Ms Pringle. The Ministers do not believe condition 6 can be met in this case. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
28. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a. Is Ms Pringle pursuing a legitimate interest or interests?
b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could those interests be achieved by means which interfere less with the privacy of the data subject?
c. Even if the processing is necessary for Ms Pringle's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
29. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mrs Pringle must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Ministers were correct to refuse to disclose the personal data to Ms Pringle.
Is the applicant pursuing a legitimate interest or interests?
30. The Ministers noted reasons why Ms Pringle might consider herself to have a personal interest in obtaining the withheld personal data, but did not believe this extended to a legitimate interest.
31. Mrs Pringle did not make any submissions on this point, although she was invited to do so.
32. Having considered all relevant submissions she has received on this point, the Commissioner notes that Mrs Pringle may have a personal interest in the withheld personal data. However, nothing in the background information provided by the Ministers suggests an interest of such substance that it should qualify automatically as a legitimate interest: while the term is not defined, it must be more than something about which the applicant is merely curious. Ms Pringle has provided nothing to assist the Commissioner on this point and, as indicated above, there is no presumption in favour of the disclosure of personal data under FOISA. In all the circumstances, the Commissioner does not believe she is entitled to conclude that Ms Pringle has a legitimate interest in the withheld personal data for the purposes of condition 6.
33. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the withheld personal data. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure would breach the first data protection principle and that the information is therefore exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA.
Technical issue
34. In her application to the Commissioner, Mrs Pringle stated she was dissatisfied that the Ministers had ignored her email of 11 July 2013 and failed to respond to her request for information within the timescale allowed.
35. Section 10(1) of FOISA gives Scottish public authorities a maximum of 20 working days after receipt of the request to comply with a request for information. This is subject to certain qualifications which are not relevant in this case.
36. Whilst noting that the Ministers apologised for the delay in responding, the Commissioner must find that they failed to respond to Ms Pringle's request within the required 20 working days and therefore failed to comply with section 10(1) of FOISA.
DECISION
The Commissioner finds that the Scottish Ministers (the Ministers) generally complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in dealing with Ms Pringle's request for information, in particular by withholding information under section 38(1)(b) of FOISA.
However, the Commissioner finds that, in not responding to Ms Pringle's request within the required 20 working days, the Ministers failed to comply with section 10(1) of FOISA. She also finds that they failed to notify Ms Pringle that they did not hold certain of the required information, as required by section 17(1) of FOISA. Having considered all relevant submissions, she does not require the Ministers to take any action in respect of these failures, in response to Ms Pringle's application.
Appeal
Should either Ms Pringle or the Scottish Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
6 December 2013
Appendix Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
...
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
?
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
10 Time for compliance
(1) Subject to subsections (2) and (3), a Scottish public authority receiving a request which requires it to comply with section 1(1) must comply promptly; and in any event by not later than the twentieth working day after-
(a) ? the receipt by the authority of the request; or
?
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
?
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
?
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
