The Scottish Information Commissioner - It's Public Knowledge
Tweet this page:
Text Size Icon

- Text Size Up | Down

Decision 254/2013 Mr Peter Mortimer and Glasgow City Council

Expenses claimed

Reference No: 201301871
Decision Date: 14 November 2013

Summary

On 25 February 2013, Mr Mortimer asked Glasgow City Council (the Council) for the expenses claimed by the Chair of the Glasgow Children's Panel for the past two years. The Council informed Mr Mortimer that the expenses were personal data, the disclosure of which was exempt under section 38(1)(b) of FOISA. Following an investigation, the Commissioner accepted this and found that the Council had dealt correctly with the request.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedules 1 (The data protection principles, Part I - the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1. On 25 February 2013, Mr Mortimer asked the Council for the expenses claimed for the past two years by the Chair of the Glasgow Children's Panel.

2. The Council responded on 13 March 2013. It stated that the requested information was exempt under section 38(1)(b) of FOISA as it was personal data as defined by the DPA, and disclosure would breach the data protection principles.

3. On 18 April 2013, Mr Mortimer wrote to the Council requesting a review of its decision, as he considered that disclosure of the information was in the public interest.

4. The Council notified Mr Mortimer of the outcome of its review on 15 May 2013. It upheld its previous decision without amendment, while explaining that it was not required to consider the public interest in relation to the disclosure of personal data.

5. On 12 August 2013, Mr Mortimer wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6. The application was validated by establishing that Mr Mortimer made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request. The case was then allocated to an investigating officer.

Investigation

7. The investigating officer contacted the Council on 4 September 2013, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA), and asking it to respond to specific questions. The Council was asked to provide a copy of the requested expense claims and to explain why it considered the information to be exempt under section 38(1)(b).

8. The Council provided its submissions on 26 September 2013. It confirmed that it was withholding information about the expense claims under section 38(1)(b) of FOISA, on the basis that disclosure would breach the first data protection principle. On 7 October 2013, the Council disclosed to Mr Mortimer a summary of the total expenses claimed by the Children's Panel over the last two years.

9. Mr Mortimer provided submissions explaining why he believed the withheld information should be disclosed.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Mortimer and the Council. She is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) - personal data

11. As noted above, the Council applied the exemption in section 38(1)(b) to the withheld information, arguing that disclosure of this information would breach the first data protection principle.

12. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (b) (as appropriate), exempts personal data from release if its disclosure to a member of the public, otherwise than under FOISA, would contravene any of the data protection principles.

13. In considering the application of this exemption, the Commissioner will therefore first consider whether the information in question is personal data as defined in section 1(1) of the DPA. If it is, she will go on to consider whether disclosure of the information would breach the first data protection principle. The Commissioner will also consider whether any of the information is sensitive personal data as defined in section 2 of the DPA: if it is, she will consider the implications of that status for the application of the first data protection principle.

14. It must be borne in mind that this particular exemption is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

Is the information personal data?

15. Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

16. The Council has applied the exemption in section 38(1)(b) to information contained in the expenses claims forms for the Chair of the Children's Panel.

17. The Commissioner is satisfied that the information in the claim forms is the personal data of the individual in question. The individual is named on the claim forms, which also contain details of his home address, vehicle, and the meetings he attended during the period in question. The Commissioner is satisfied that the withheld information relates to an identifiable individual and is his personal data.

18. Having concluded that the withheld information is personal data as defined in section 1(1) of the DPA, the Commissioner must now go on to consider whether disclosure of this information would contravene any of the data protection principles cited by the Council.

Would disclosure of the information breach the first data protection principle?

19. As noted above, the Council argued that disclosure of the information would breach the first data protection principle. The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed (in this case, disclosed into the public domain in response to Mr Mortimer's request) unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data (as defined by section 2 of the DPA), at least one of the conditions in Schedule 3 to the DPA is also met. (The Commissioner is satisfied that the personal data in question is not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for the Commissioner to consider the conditions in Schedule 3.)

20. When considering the conditions, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1] (the CSA case) that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject (i.e. the named individual to which the data relates).

21. Condition 1 of Schedule 2 permits personal data to be processed if the data subject consents to the data being processed. In its submissions, the Council confirmed that the data subject had not given consent for disclosure of the information. The Commissioner has therefore concluded that condition 1 in Schedule 2 cannot be met in this case.

22. The Commissioner considers that the only other condition in Schedule 2 to the DPA which might apply in this case is condition 6. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

23. There are, therefore, a number of tests which must be met before condition 6(1) can apply. These are:

· Does Mr Mortimer have a legitimate interest in obtaining these personal data?

· If so, is the disclosure necessary to achieve those legitimate interests? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?

· Even if making the information available is necessary for the legitimate purposes of Mr Mortimer, would it nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject? This will involve a balancing exercise between the legitimate interests of Mr Mortimer and those of the data subject. Only if (or to the extent that) the legitimate interests of Mr Mortimer outweigh those of the data subject can the personal data be made available.

Does Mr Mortimer have a legitimate interest?

24. Mr Mortimer argued that, as the individual concerned was the most senior member of the Glasgow Children's Panel during the period covered by his request, the expenses claimed from the public purse by that individual should be in the public domain. Mr Mortimer considered that his request was "wholesome", and did not prejudice the data subject unfairly, as "any expenses claimed relate to his conduct and integrity as a public figure, which should be transparent to the Glasgow community". He noted that the expenses of MSPs representing Glasgow had been published.

25. The Council noted that, in his request, Mr Mortimer did not provide any comments as to his legitimate interest in the information, but had stated in his request for review that he believed that disclosure of this personal data was in the public interest. The Council had therefore interpreted Mr Mortimer's interest to be in the wider sense, in this case the scrutiny of the actions of public bodies, as opposed to an interest which is personal to the applicant.

26. The Commissioner accepts that Mr Mortimer has a general legitimate interest in information which would demonstrate or create transparency and accountability in relation to the spending of public money. She accepts that this legitimate interest could encompass the expenses claimed by members of the Children's Panel, including those claimed by its Chair.

Is disclosure of the information necessary to achieve those legitimate interests?

27. The Commissioner must now consider whether disclosure is necessary for those legitimate interests, and in doing so she must consider whether these interests might reasonably be met by any alternative means.

28. The Council stated that, even if Mr Mortimer was deemed to have a legitimate interest in obtaining the personal data by virtue of the general public interest in the scrutiny of the actions of public bodies, it did not consider that this interest should be served through the disclosure of the expenses claims made by one individual sitting on a voluntary panel. The Council considered that disclosure of the requested personal data would be a disproportionate means by which to fulfil this interest. The Council submitted that the public interest in public bodies' expenditure can, in many instances, be met by means which do not require interference with the rights and freedoms or legitimate interests of data subjects.

29. The Council disclosed to Mr Mortimer a summary of the cumulative expenses claimed by members of the Children's Panel, and stated that provision of this information fulfilled the legitimate interest it had identified (described above). The Council concluded that disclosure of the personal data he had requested was not necessary to meet the identified legitimate interest.

30. In reaching her decision, the Commissioner has taken into account the disclosure of the summary of the Children's Panel expenses. The Commissioner considers that this disclosure goes some way towards satisfying Mr Mortimer's legitimate interest in information about public expenditure, but accepts that disclosure of the expenses claimed by the Chair of the Children's Panel would be required in order to meet Mr Mortimer's legitimate interest in full.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subjects?

31. The Commissioner must now consider whether disclosure of the personal data requested by Mr Mortimer would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Mr Mortimer and those of the data subject. Only if the legitimate interests of Mr Mortimer outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.

32. In the Commissioner's briefing on section 38 of FOISA[2], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

· whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

· the potential harm or distress that may be caused by disclosure

· whether the individual objected to the disclosure

· the reasonable expectations of the individuals as to whether the information should be disclosed.

33. The Council submitted that members of the Children's Panel are volunteers and do not have equivalent status to an employee of a public body or an elected member. Accordingly, the Council considered that the information related, to a greater extent, to the individual's private life than to their public role. The Council considered that such individuals would have no reasonable expectation that their personal data would be disclosed as part of their voluntary role.

34. The Council believed it was reasonably foreseeable that potential harm or distress may occur to the data subject from the disclosure of this information. The Council concluded that, due to the lack of any specific public interest in the expenses claimed by the named individual, there was a real risk that disclosure of personal data in this instance would lead to the harassment of the data subject and, possibly, other members of the Children's Panel. The Council considered that disclosure of the information would deter the members of the Children's Panel from giving up their personal time to volunteer for this organisation.

35. The Commissioner accepts that, to some degree, the personal data under consideration relates to the individual's private life, in that the individual incurred the expenses by undertaking public service in a voluntary capacity. Although there are no absolute rules in this regard, generally it will be the case that where information relates to an individual's private life (i.e. their home, family, social life or finances) it will deserve greater protection than information about them acting in an official or work capacity (i.e. their public life). However, the Commissioner also accepts that, even though the position of Chair of the Children's Panel is a voluntary one, it carries with it significant public responsibilities. The personal data in question therefore cannot be regarded as relating solely to the individual's private life.

36. The Commissioner has considered the request for expenses carefully and is cognisant of the fact that authorities should be accountable for their expenditure, and demonstrate that checks and balances are in place to ensure such expenditure is valid and justifiable. The Commissioner has not been given any reason to question whether there are sufficient procedures in place to ensure adequate scrutiny of the expenses of the Children's Panel members. She does not find that disclosure of the personal data in question would be required in order to be satisfied on this point.

37. The Commissioner has also considered the fact that the role performed by the named individual is a voluntary one, and that, accordingly, the individual may have had no expectation that their personal data would be disclosed. The Commissioner concludes that, in these circumstances, disclosure would have a severely detrimental effect on the organisation and could discourage other individuals from volunteering.

38. In conclusion, the Commissioner accepts that disclosure of the withheld information in response to this information request would be highly likely to cause distress to the named individual.

39. In all the circumstances, having considered the arguments made by both Mr Mortimer and the Council, and having weighed Mr Mortimer's legitimate interests against the legitimate interests, rights and freedoms of the named individual whose personal data it is, the Commissioner has concluded that the legitimate interests of the named individual outweigh those of Mr Mortimer. As a result, she has determined that disclosure would be unwarranted in this case.

40. Having drawn these conclusions, the Commissioner has concluded that condition 6 in Schedule 2 (to the DPA) is not met in this case in relation to the withheld personal data.

41. Having accepted that disclosure of the personal data would lead to unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject as described above, the Commissioner also concludes, for the same reasons, that disclosure of the withheld information would be unfair.

42. As disclosure of the personal data would be unfair and no schedule 2 conditions can be met, that personal data cannot be disclosed without contravening the first data protection principle. Consequently, disclosure would also be unlawful. The Commissioner therefore concludes that disclosure of the withheld information would breach the first data protection principle, and that this information was properly withheld on the grounds of the exemption in section 38(1)(b).

DECISION

The Commissioner finds that Glasgow City Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr Peter Mortimer.

Appeal

Should either Mr Mortimer or Glasgow City Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
14 November 2013

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

(e) in subsection (1) of section 38 -

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

[1] http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080709/comm-1.htm

[2] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.asp

PDF IconLink to PDF file of decision 254/2013 (104 kb)

Back to Top