Decision 288/2024: Salary of the Chair of Carmont Rolling Stock Recommendations Steering Group

Authority: Scottish Rail Holdings Ltd 
Case Ref: 202301457

Summary

The Applicant asked the Authority for the salary of the Chair of Carmont Rolling Stock Recommendations Steering

Group (the Steering Group). The Authority withheld the information requested because it considered it was third

party personal data. The Commissioner investigated and found that the Authority was entitled to withhold the

information requested.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and

(2)(e)(ii) (Effect of exemptions); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data

subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2)

(Application for decision by Commissioner)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data”)

(Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10), (14)(a), (c) and (d) (Terms

relating to the processing of personal data)

Background

1. The Authority’s website states that the Steering Group was “created to inform and review the response in

Scotland to the specific, train-based, recommendations identified in the Rail Accident Investigation Branch’s

report into the accident at Carmont on 12 August 2020”.

2. On 8 August 2023, the Applicant made a request for information to the Authority. He asked for information

relating to the Steering Group, including, among other things, “the total administrative costs and the

payments/expenses made to each separate member including the Chair”.

3. The Authority responded on 5 September 2023. The Authority provided some information, but withheld information

on the salary of the Chair under section 38(1)(b) of FOISA, on the basis that it was personal data and disclosure

would breach data protection principles.

4. On 13 October 2023, the Applicant wrote to the Authority requesting a review of its decision. The Applicant

stated that he was dissatisfied with the decision to withhold the salary of the Chair under section 38(1)(b) of

FOISA as it was a “public position”, paid by “public money” and it was important that the use of public funds was

“transparent and open”.

5. The Authority notified the Applicant of the outcome of its review on 9 November 2023, which fully upheld its

original decision.

6. On 17 November 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1)

of FOISA. The Applicant stated he was dissatisfied with the outcome of the Authority’s review for the reasons set

out in his requirement for review.

Investigation

7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power

to carry out an investigation.

8. On 12 January 2024, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in

writing of the application and invited its comments.

9. The Authority was also asked to send the Commissioner the information withheld from the Applicant. The

Authority provided the information, and the case was subsequently allocated to an investigating officer.

Commissioner’s analysis and findings

10. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Section 38(1)(b) – Personal information

11. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from

disclosure if it is “personal data“ (as defined in section 3(2) of the DPA 2018) and its disclosure would

contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.

12. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an

absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of

FOISA.

Is the information personal data?

13. The first question the Commissioner must address is whether the information is personal data for the purposes

of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual.

“Identified living individual” is defined in section 3(3) of the DPA 2018. (This definition reflects the

definition of personal data in Article 4(1) of the UK GDPR.)

14. Information will "relate to" a person if it is about them, is linked to them, has biographical significance

for them, is used to inform decisions affecting them, or has them as its main focus.

15. The Commissioner is satisfied that the information being withheld under section 38(1)(b) of FOISA is personal

data: the information identifies a living individual (the Chair) and clearly relates to that individual (it is

their salary).

Would disclosure contravene one of the data protection principles?

16. The Authority argued that disclosure would breach the data protection principle in Article 5(1)(a) of the UK

GDPR. Article 5(1)(a) states that personal data shall be processed “lawfully, fairly and in a transparent manner

in relation to the data subject”.

17. "Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d))

disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore

covers disclosing information into the public domain in response to a FOISA request.

18. The Commissioner must consider whether disclosure of the personal data would be lawful. In considering

lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be

disclosed.

19. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially

apply in the circumstances of this case.

Condition (f): legitimate interests

20. Condition (f) states that processing shall be lawful if it:
“is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except

where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which

require protection of personal data ...”

21. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in

performance of its tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)

(f) when responding to requests under FOISA.

22. The tests which must be met before Article 6(1)(f) can be met are as follows:

(i) Would the Applicant have a legitimate interest in obtaining personal data?

(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by

the interests or fundamental rights and freedoms of the data subject?

Does the Applicant have a legitimate interest in obtaining the personal data?

23. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner

takes the view that the term indicates that matters in which an individual properly has an interest should be

distinguished from matters about which he or she is simply inquisitive. His published guidance on section 38(1)(b)

of FOISA states:

“In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the

information in order to bring legal proceedings. With most requests, however, there are likely to be wider

legitimate interests, such as the scrutiny of the actions of public bodies or public safety.”

24. The Applicant submitted that he had a legitimate interest in the disclosure of the salary paid to the Chair as

it was a “public position”, paid by “public money” and it was important that the use of public funds was

“transparent and open”.

25. The Authority accepted that the Applicant had a legitimate interest in obtaining the personal data. The

Commissioner agrees.

Would disclosure of the personal data be necessary?

26. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must

consider whether disclosure would be necessary to achieve the legitimate interest in the information.

27. Here, “necessary” means “reasonably” rather than “absolutely” or “strictly” necessary. When considering

whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as

a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interest could

reasonably be met by means which interfered less with the privacy of the data subject.

28. To satisfy the legitimate interest in its use of public funds, the Authority explained that it publishes the

names, job titles and salary details of its senior management team. However, it submitted that the level of

remuneration received by the Chair was “in no way” comparable to these individuals. While it accepted that the

Chair performs a public role paid for by public funds, it stated that the Steering Group is not a policy or

decision-making body and instead performs an advisory role only. It submitted that the Chair would not have a

reasonable expectation that her salary would be published.

29. The Authority noted that the sums involved were “very low” in the context of its overall spending and in the

context of what might generally be perceived as “high” pay deserving of enhanced public scrutiny. It also

submitted that there was no suggestion of “impropriety” in relation to the Chair’s salary (or the process by which

it was determined) that might justify an enhanced level of public scrutiny.

30. The Authority stated that normal processes were followed in the process of negotiating the Chair’s salary,

including the application of appropriate internal and external financial controls

to ensure the proper scrutiny and allocation of public funds, and that its accounts were published and audited in

line with ordinary procedures. 31. In summary, while the Authority acknowledged the Applicant’s legitimate

interest in holding it accountable for its use of public funds, it argued that disclosure of the salary of the

Chair was not “reasonably necessary” to meet that interest.

32. The Applicant submitted that disclosure of the Chair’s salary was necessary to meet his legitimate interest to

ensure that the Scottish taxpayer was getting “value for money” and that pay rates are fair and reasonable, in the

same way that is expected of other parts of the Scottish rail industry.

33. Having fully considered the submissions provided, the Commissioner can identify no viable means of fully

meeting the Applicant's legitimate interest which would interfere less with the privacy of the data subject than

disclosing the withheld information. In all the circumstances, therefore, he is satisfied that disclosure of the

information is necessary for the purposes of the Applicant's legitimate interest.

34. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the withheld

information outweighs the rights and freedoms of the data subject.

The data subject’s interests or fundamental rights and freedoms (and balancing exercise)

35. The Commissioner has concluded that the disclosure of the information would be necessary to achieve the

Applicant’s legitimate interests. However, this must be balanced against the fundamental rights and freedoms of

the data subjects. Only if the legitimate interests of the Applicant outweighed those of the data subject could

the information be disclosed without breaching the first data protection principle.

36. The Commissioner's guidance on section 38 of FOISA notes factors that should be taken into account in

balancing the interests of parties. He notes that Recital (47) of the General Data Protection Regulation states

that much will depend on the reasonable expectations of the data subjects. These are some of the factors public

authorities should consider:

(i) whether the information relates to the individual’s public life (i.e. their work as a public official or

employee) or their private life (i.e. their home, family, social life or finances)

(ii) whether the individual objected to the disclosure

(iii) the potential harm or distress that may be caused by disclosure.

37. The Commissioner acknowledges that the withheld information relates to the data subject’s public life, in that

it identifies her as the Chair of the Steering Group (and relates to the salary she receives for that role). He

also acknowledges that, by association, the information relates to the Chair’s private life.

38. In the circumstances, the Commissioner concludes that the withheld information relates to both the private and

public life of the data subject.

39. The Authority consulted the Chair and was provided with detailed reasoning why she strongly objected to her

personal data being disclosed. The Commissioner cannot include all the specific comments made by the Chair but he

has taken all relevant ones into account.

40. The Commissioner has also considered the harm or distress that might be caused by disclosure of the

information. Disclosure, under FOISA, is a public disclosure. He has taken this into account when reaching his

decision.

41. The Authority explained that the Chair strongly considered her salary was both personal and confidential

information. She further submitted that her salary had been determined through negotiation and that disclosure

would therefore disadvantage her position in salary negotiations for future rules as her salary would be

interpreted by others as her standard rate for such work.

42. The Commissioner recognises that employees of public authorities should be open to scrutiny and accountability

because their jobs are funded by the public purse. He also recognises that not all staff should be subject to such

a level of scrutiny and draws a distinction between what information should be released about senior staff

compared to what should be disclosed about less senior staff.

43. The Commissioner recognises that the data subject in this case might reasonably be viewed as occupying a

senior position, being Chair of the Steering Group. However, he accepts that the Steering Group performs an

advisory role only and that the data subject’s position as Chair is therefore distinguishable from senior

positions on other bodies that have decision-making functions.

44. The Commissioner therefore considers that the data subject would have no realistic expectation that her salary

as Chair of the Steering Group would be disclosed, under FOISA, to the world at large (unlike, for example,

members of the Authority’s senior management team whose names, job titles and salary details are all published).

45. The Commissioner also recognises the Authority’s argument that the Chair’s salary was “very low” in the

context of its overall spending and that there was no suggestion of “impropriety” in relation to her salary,

meaning there was no justification for an enhanced level of public scrutiny.

46. In this respect, the Commissioner considers that this case can be distinguished from his finding in Decision

048/2023, where he required disclosure of the monies paid to the Chair of Edinburgh Trams Inquiry that had been

withheld under section 38(1)(b) of FOISA.

47. In that case, the Commissioner found that the legitimate interest in the use of public funds would not be

outweighed by any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of

the data subject.

48. The Commissioner considers that there is a material difference in the monies paid to the Chair of the Inquiry

in that case and the salary of the Chair of the Steering Group in this case. Despite sharing the same title, the

positions of Chair of Edinburgh Trams Inquiry and Chair of the Steering Group are materially different in almost

all respects, particularly in terms of seniority, responsibility and expectations in relation to public scrutiny

and information that might be publicly disclosed to satisfy that scrutiny.

49. After carefully balancing the legitimate interest of the Applicant against the interests or fundamental rights

or freedoms of the data subject, the Commissioner finds that the legitimate interest served by disclosure of any

information held would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or

legitimate interests of the data subject.

50. Having found that the legitimate interest served by disclosure of the personal data are outweighed by the

unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subject,

the Commissioner finds that condition (f) in Article 3 6(1) of the GDPR cannot be met and that disclosure of the information in question would be unlawful.

51. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is

not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent

in relation to the data subject.

52. The Commissioner is satisfied, in the absence of a condition in Article 6 of the UK GDPR which would allow the

data to be disclosed, that disclosure would be unlawful. The personal data is therefore exempt from disclosure

under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that the Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002

in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal

to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of

intimation of this decision.

Euan McCulloch
Head of Enforcement

9 December 2024