Decision 290/2013 Mr John Keogh and Inverclyde Council
Number of days a named employee was at work over a specific time period
Reference No: 201301755
Decision Date: 16 December 2013
Summary
On 9 May 2013, Mr Keogh asked Inverclyde Council (the Council) for the number of days a named employee had been at work over a specific time period. The Council refused to disclose this information as it considered it to be the employee's personal data, disclosure of which would breach the first data protection principle (and therefore it was exempt under section 38(1)(b) of FOISA). Following an investigation, the Commissioner accepted this.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of the "data protection principles", "data subject" and "personal data") (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part 1 - the principles) (the first data protection principle); Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 9 May 2013, Mr Keogh asked the Council how many days a named employee was at work between 22 November 2011 and 21 February 2012.
2. The Council responded on 19 June 2013, withholding information which would answer Mr Keogh's request. The Council considered this information to be personal data, disclosure of which would contravene the data protection principles (and therefore applied section 38(1)(b) of FOISA).
3. On 19 June 2013, Mr Keogh asked the Council to carry out a review of its decision to refuse his request.
4. The Council notified Mr Keogh of the outcome of its review on 11 July 2013, upholding its decision to withhold the information without modification.
5. On 29 July 2013, Mr Keogh wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.
6. The application was validated by establishing that Mr Keogh made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.
Investigation
7. On 15 August 2013, the Council was notified in writing that an application had been received from Mr Keogh and was invited to provide comments on the application (as required by section 49(3)(a) of FOISA). In particular, it was asked to justify its reliance on section 38(1)(b) of FOISA.
8. A response was received from the Council on 27 September 2013.
9. Further submissions were sought and received from both the Council and Mr Keogh during the investigation.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to her by both Mr Keogh and the Council. She is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal information
11. The Council applied the exemption in section 38(1)(b) to information which would fulfil Mr Keogh's request. The Council argued that disclosure of this information would breach the first data protection principle.
12. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or, as appropriate, 38(2)(b), exempts information from disclosure if it is "personal data" (as defined in section 1(1) of the DPA) and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.
13. In order to rely on this exemption, the Council must therefore show that the information being withheld is personal data for the purposes of the DPA and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA.
Is the information personal data
14. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
15. The Commissioner is satisfied that the withheld information is personal data, in line with the definition in part a) of section 1(1) of the DPA. A living individual, i.e. the named employee, can be identified from this information. The information clearly relates to the named employee, as it can be considered to be biographical about, and to focus on, them.
Would disclosure breach the first data protection principle?
16. As noted above, the Council argued that making this information available would breach the first data protection principle. This states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The processing in this case would be making the information available in response to Mr Keogh's request.
17. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and she is satisfied that the personal data under consideration in this case do not fall into any of the categories set out in that definition. Therefore, it is not necessary to consider the conditions in Schedule 3 in this case.
18. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that disclosure would also be fair and lawful.
19. The Commissioner must now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. Where a Schedule 2 condition can be met, she will then go on to consider whether disclosure of the personal data would otherwise be fair and lawful.
20. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.
Can any schedule 2 condition be met?
21. The Council explained (with reference to discussions with the named employee) that the employee had not consented to disclosure of the withheld information. As a consequence, the Commissioner has concluded that the first condition in Schedule 2 cannot be met by disclosure.
22. The Commissioner considers that the only Schedule 2 condition which might be met to permit disclosure of the requested information is condition 6, which is set out in full in the Appendix.
23. As explained in the Commissioner's guidance on this exemption,[2] there are a number of different tests which must be satisfied before condition 6 can be met. These are:
? Is Mr Keogh pursuing a legitimate interest or interests?
? If yes, is the processing necessary for Mr Keogh's legitimate interests? In other words, is the processing proportionate as a means and fairly balanced to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the employee?
? Even if processing is necessary for Mr Keogh's legitimate interests, is it unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the employee?
24. There is no presumption in favour of disclosure of the personal data under the general obligation laid down by FOISA. Accordingly, the legitimate interests of Mr Keogh must outweigh the rights and freedoms or legitimate interests of the employee before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Keogh.
Is Mr Keogh pursuing a legitimate interest or interests?
25. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on personal information states:
In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.
26. Mr Keogh explained he was in the process of making a formal complaint to Inverclyde Community Health and Care Partnership (CHCP) (of which the Council is a partner with NHS Greater Glasgow and Clyde). This formal complaint related to the entire process relating to decisions taken concerning his children's welfare. Mr Keogh submitted that the named employee's work attendance was very important to him in pursuing his parental rights and related actions of the Council.
27. The Commissioner has considered these comments carefully, noting that the Council accept that Mr Keogh is pursuing a legitimate interest. In the circumstances, she accepts that Mr Keogh and the general public have a legitimate interest in understanding whether Inverclyde Council, as part of Inverclyde CHCP, followed relevant processes and policies in taking actions affecting Mr Keogh and his children.
Is the processing necessary for the purpose of these interests?
28. When considering this, the Commissioner must consider whether the interests she has identified might reasonably be met by any alternative means, which would interfere less with the privacy of the individual whose personal data has been withheld.
29. The Council acknowledged that there was a legitimate interest in scrutinising the transparency and actions of public bodies, such as Inverclyde CHCP, when exercising their functions. However, it believed Mr Keogh's legitimate interests would more reasonably be met by other means than obtaining the requested information, that is by using Inverclyde CHCP's formal procedures and policies in connection with any complaint over its actions. The Council noted that Mr Keogh had chosen not to pursue a formal complaint, although he had been advised that this was the most appropriate route to take to resolve matters and had been given the opportunity to pursue such a formal complaint on a number of occasions.
30. As indicated above, Mr Keogh indicated that he was seeking to make a formal complaint to Inverclyde CHCP and needed the requested information to do that. He also detailed to the Commissioner previous attempts he had made to obtain the information he sought about the named employee's absence from work. Mr Keogh explained that the wording of the request aimed to extract the information in a form which would be less intrusive into the data subject's private life. Mr Keogh considered that he had exhausted all other means open to him for accessing this information.
31. The Commissioner acknowledges the Council's submissions, but notes Mr Keogh's insistence that he is seeking the information for the purpose of making a formal complaint. She acknowledges that this request might reasonably considered less intrusive than previous attempts to obtain the information. On balance, the Commissioner is not aware of any other viable means of meeting Mr Keogh's interests which would interfere less with the privacy of the employee than providing the information requested. For this reason, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of Mr Keogh's legitimate interests.
Would disclosure be unwarranted by reason of prejudice to the legitimate interests of the employee?
32. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr Keogh's legitimate interests, she must now consider whether disclosure would nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the employee. As noted above, this involves a balancing exercise between the legitimate interests of Mr Keogh and those of the employee. Only if the legitimate interests of Mr Keogh outweigh those of the employee can the information be disclosed without breaching the first data protection principle.
33. In the Commissioner's briefing on personal information[3], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
? the potential harm or distress that might be caused by disclosure
? whether the individual objected to the disclosure
? the reasonable expectations of the individual as to whether the information will be disclosed.
34. The Council explained that the employee would only expect information about the number of days they were at work to be accessible to those with line management responsibility for them, those with direct responsibility for collating such personal information and HR staff, and that it would only be shared at an appropriate level for payroll/pension purposes. They certainly would not expect the information to be released into the public domain, particularly as it related to their private life. This had been confirmed in discussions with the employee.
35. The Council also provided specific submissions to the Commissioner as to how release of the withheld would cause the employee distress. Given the nature of these submissions, the Commissioner does not consider it appropriate to summarise these here.
36. As indicated above, the Council explained (with reference to discussions with the employee) that the employee had not consented to disclosure of their personal data. While relevant to the overall balancing exercise, it does not necessarily follow from this that disclosure would be unwarranted. The Council also explained the context in which the employee had referred to a period of absence in communications with Mr Keogh.
37. Mr Keogh submitted that the employee surrendered their right to protection under the DPA in communications with him, by using their employment contract status in tandem with personal circumstances to justify their actions in a professional and official capacity. Mr Keogh also referred to information on the Commissioner's website which indicated that "by contrast, where an individual is acting in an official or work capacity, information relating to this part of a person's life should normally be provided".
38. Having considered these submissions carefully, the Commissioner finds that the withheld information relates to the employee's role as an employee of the Council. While she acknowledges that the employee did disclose to Mr Keogh that they were absent for a (unspecified) period of time, she can still accept that it would be beyond the reasonable expectation of the employee that information as to the number of days they were at work over a specific period would be disclosed to the public.
39. Having considered the submissions and supporting evidence received from the Council as to the harm and distress that might be caused to the data subject as a result of disclosure, the Commissioner also accepts that disclosure would be likely to cause the distress claimed.
40. In all the circumstances, having considered the arguments made by both Mr Keogh and the Council, and having weighed Mr Keogh's legitimate interests against the legitimate interests, rights and freedoms of the employee, the Commissioner has concluded in this case that those of the named employee outweigh those of Mr Keogh. As a result, she has determined that disclosure would be unwarranted in this case by reason of prejudice to those rights and freedoms or legitimate interests.
41. Having drawn these conclusions, the Commissioner finds that condition 6 cannot be met in this case. In the absence of a condition permitting disclosure, that disclosure would be unlawful.
42. As the Commissioner has accepted that disclosure of the withheld information would be unwarranted by reason of prejudice to the rights, freedoms or legitimate interests of the data subject, she must also conclude (for the same reasons) that disclosure would be unfair.
43. The Commissioner therefore concludes that disclosure of the withheld information would breach the first data protection principle, and so this information was properly withheld under the exemption in section 38(1)(b) of FOISA.
DECISION
The Commissioner finds that Inverclyde Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Keogh.
Appeal
Should either Mr Keogh or Inverclyde Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
16 December 2013
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
?
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
?
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
(e) in subsection (1) of section 38 -
?
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
38 Personal information
(1) Information is exempt information if it constitutes-
?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
?
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm
[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.asp
[3] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.asp
