Decision 106/2012 Dr Nick McKerrell and Glasgow Caledonian University

Payment made for marking of exam scripts

Reference No: 201102331
Decision Date: 29 June 2012

Summary

Dr Nick McKerrell requested from Glasgow Caledonian University (the University) the value of a payment made to a third party for the marking of exam scripts. The University withheld the information under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA), on the basis that the information was personal data, disclosure of which would breach the first data protection principle. Following a review, Dr McKerrell remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the University had dealt with Dr McKerrell's request for information in accordance with Part 1 of FOISA, by correctly applying section 38(1)(b) to the withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal Information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions ? definition of "personal data") and Schedules 1 (The data protection principles ? the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data ? conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 31 March 2011, Dr McKerrell wrote to the University requesting the following information (along with other information that is not under consideration in this decision):

a.Details of any payment made by a particular academic department for marking of exam scripts in a named subject to an external figure in January/February 2011.

b.Instructions made to payroll by the academic department regarding the payment of this money to the external figure.

2.The University responded on18 April 2011.It refused to supply the information detailed in paragraph 1 on the basis that it was exempt from disclosure under section 38(1)(b) of FOISA.The University explained that it considered this information to be personal data relating to the external figure, and that disclosure would breach both the first and second data protection principles.

3.On 26 May 2011, Dr McKerrell wrote to the University requesting a review of its decision.Dr McKerrell accepted that disclosure would show that a payment was made to an individual, but considered that, if their identity was withheld, they would remain anonymous and so there were no data protection issues.

4.The University notified Dr McKerrell of the outcome of its review on 14 June 2011. The University upheld it decision to withhold the information set out in paragraph 1.

5.On 13 December 2011, Dr McKerrell wrote to the Commissioner, stating that he was dissatisfied with the outcome of the University's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. Dr McKerrell reiterated his view that the disclosure of the requested information would not identify the individual who received the payment and so he did not agree with the University's application of section 38(1)(b) of FOISA to that information.

6.The application was validated by establishing that Dr McKerrell had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 12 January 2012, the University was notified in writing that an application had been received from Dr McKerrell and was asked to provide the Commissioner with the information that had been withheld from him. The University responded with the information requested and the case was then allocated to an investigating officer.

8.In this case, the University has disclosed information drawn from a series of communications relating to the arrangements for marking work being undertaken by an external individual, and sanctioning payment.What has not been disclosed is the sum paid to the individual (and instructed to payroll to be paid).It is this sum which is the information under consideration in this decision.

9.The investigating officer subsequently contacted the University, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the University was asked to justify its reliance on any provisions of FOISA it considered applicable to the withheld information.

10.Dr McKerrell was also asked to provide the investigating officer with his submissions on any legitimate interests he may have in the disclosure of the amount of the payment made.

11.The relevant submissions received from both the University and Dr McKerrell will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

12.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to her by both Dr McKerrell and the University and is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) of FOISA

13.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) (or, where appropriate, 38(2)(b)) exempts information from disclosure if it is "personal data", as defined by section 1(1) of the DPA and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA.

14.The University submitted that the information requested by Dr McKerrell was personal data, the release of which would contravene the first and second data protection principles.

Is the information personal data?

15.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).

16.Dr McKerrell took the view that the sum paid to the external individual was not the personal data of that individual.He stated that disclosure of the figure may show that payment was made to one individual, butif their identity was withheld, there would be no way that the individual could be identified.

17.The University submitted that the individual was not anonymous, because some members of its staff could identify them as the exam marker. Therefore, providing Dr McKerrell with the details would be tantamount to releasing the information into the public domain, which would make it possible for those who know who the individual is to then know what payment was made.

18.Although the identity of the individual may not be widely known in the public domain, the Commissioner must take account of the fact that certain members of University staff and possibly students are aware of the identity of the external individual.

19.In this case, the Commissioner is satisfied that the withheld information clearly relates to a living individual (i.e. the person who undertook the marking and received the payment) who can be identified from that information. She is therefore satisfied that this information is the individual's own personal data.

Would disclosure breach the first data protection principle?

20.The University has argued that the release of the information would breach the first data protection principle. The first data protection principle requires that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met. The processing under consideration in this case is disclosure of the sum in response to Dr McKerrell's information request.

21.The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and is satisfied that the personal data in this case does not fall into any of the relevant categories. It is therefore not necessary to consider the conditions in Schedule 3 in this case.

22.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

23.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of this personal data would be fair and lawful.

Can any of the conditions in Schedule 2 to the DPA be met?

24.The University was asked whether consent to disclosure of the information had been sought or received from the data subject, since such consent would mean that condition 1 could be met.

25.In its response, the University advised the Commissioner that it had asked the individual for their consent to disclosure and that the individual had categorically refused to give their consent. Since consent to disclosure was not given, condition 1 is not applicable in this case.

26.In the circumstances, condition 6 would appear to be the only condition which would permit disclosure to Dr McKerrell. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individuals to whom the payment was made).

27.The Commissioner accepts that none of the other conditions in Schedule 2 would allow processing by disclosure in this case. In its submissions, the University asserted that condition 6 could not be met in this case. The Commissioner next considered whether this was the case.

28.There are a number of different tests which must be satisfied before condition 6 can be met. These are:

Does Dr McKerrell have a legitimate interest in obtaining the personal data?

If yes, is the disclosure necessary to achieve these legitimate aims? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject?

Even if the processing is necessary for Dr McKerrell's legitimate purposes, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject?

29.There is no presumption in favour of the release of personal data under the general obligation laid down by FOISA. Accordingly, the legitimate interests of Dr McKerrell must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the University was correct to refuse to disclose the personal data to Dr McKerrell.

Does the applicant have a legitimate interest?

30.By refusing to provide him with the information when he made his request, Dr McKerrell submitted, the University was withholding a key piece of evidence from a particular University staff member who was also a trade union member, and whom he (Dr McKerrell) was representing in a disciplinary action at the time of his information request.

31.It was Dr McKerrell's view that the union member's right to a fair hearing had been undermined by the University's refusal to disclose the information.He stated that the public (and he himself as a trade union representative) have a legitimate interest in ensuring that proper and fair processes are held within public authorities where punitive measures can be taken against union members.

32.Dr McKerrell asserted that disclosure of the information could aid the union member in bringing a complaint against the University for unfair treatment and victimisation and could resolve the union member's feeling of victimisation and discrimination.

33.Furthermore, Dr McKerrell argued that releasing the information would give an indication of how public funds are spent by public institutions for services that could potentially be provided by existing members of staff.He submitted that disclosure of the information would meet the legitimate interest of satisfying the public that tax-payers' money is spent in an open and transparent way, particularly when it may be the case that money may not require to be paid to external individuals for marking of exam papers when existing members of University staff may have undertaken the task.

34.In its submissions, the University stated that, at the time of his request and requirement for review, Dr McKerrell did not indicate his interest in requesting this information, and it had considered that condition 6 could not be met. The University submitted that its belief was that under FOISA a public authority should not ask a requester why they want the information; therefore, it was not in a position to judge whether or not Dr McKerrell had a legitimate interest.

35.However, the University noted that Dr McKerrell had stated in his application to the Commissioner that "These requests emerged from a disciplinary procedure against a trade union member for refusing to carry out a reasonable request?." With this additional information, the University submitted that it had ascertained (and this was confirmed by Dr McKerrell) that the outcome date of the disciplinary panel hearing in question was just before Dr McKerrell had made his information request, but that no appeal had been forthcoming within the 10 day appeal period after the panel hearing. The University stated that the record of an individual is cleared six months after a disciplinary panel hearing, and that Dr McKerrell's application to the Commissioner was submitted outwith that six month period.

36.The University explained that normally if a request for information relates to a disciplinary appeal (or if such an appeal is intimated) then this is taken into account by the University to ensure the information is provided prior to any such appeal. In this particular case, the University stated, it was not informed of any relationship between the possibility of an appeal and the request for information under FOISA, and that no appeal was in fact submitted.

37.However, the University reiterated that, because Dr McKerrell had not indicated his interest in requesting this information at the time of his request and requirement for review, it considered that condition 6 could not be fulfilled in any case.

38.In the light of the University's submissions on the legitimate interest and condition 6, the Commissioner must make clear her view that, in determining whether or not a requester has a legitimate interest, a public authority should not assume that a requester has no legitimate interest (and therefore condition 6 cannot be fulfilled) simply because that requester did not indicate their interest at the time of making their request.

39.The Commissioner would stress that those who request information cannot be expected to understand the complexities of the relationship between FOISA and the DPA in depth, and indeed many requesters may not even be aware that the information they have asked for is personal data.

40.Therefore, she would highlight that, if a requester does not set out any legitimate interests within an information request or a requirement for review, in a case where the public authority might need to consider such interest, the authority should not take this simply to mean that condition 6 cannot be met.It is the Commissioner's view that, if it is not clear from the request itself what the legitimate interests are, then a public authority can, and indeed should, fulfill their duty under section 15 of FOISA (duty to provide reasonable advice and assistance) to ask the applicant what their legitimate interests are, and advise them of the relevance of this request to the consideration of the exemption in section 38(1)(b) of FOISA.

41.While there is no obligation for an applicant to reveal their reasons for requesting information, this does not prevent a public authority from requesting information about their interest in the information where this would inform its consideration of the tests required by FOISA.

42.The Commissioner would also refer the University to her published guidance on section 38 of FOISA[1] which states:

"There is no definition within the DPA of the term 'legitimate interest'. When assessing whether an applicant has a legitimate interest, the Commissioner considers that it will be good practice for public authorities to ask the applicant why they want the information (unless it is already clear from the information request or from previous correspondence) Authorities should remember, however, that applicants are not required to explain why they want the information if they do not wish to do so."

43.The Commissioner acknowledges that, at the time of Dr McKerrell's requirement for review, it was too late for an appeal to be lodged in the disciplinary process in question and therefore disclosure of the information at that stage would not have affected the disciplinary process outcome.

44.However, she also accepts that disclosure of the information at that same stage in the proceedings would have contributed to informing the union member (and hence Dr McKerrell as his representative) in their deliberations as to whether or not to undertake proceedings against the University.

45.After consideration of the submissions made by both parties, the Commissioner concludes that Dr McKerrell does have a legitimate interest in seeking the information under consideration in the context of his interest in a related disciplinary action.She notes that there is also a more general legitimate interest shared with the wider public in ensuring transparency in the use of public funds.

Is disclosure of the information necessary to achieve those legitimate interests?

46.The Commissioner must now consider whether disclosure of the withheld information is necessary for those legitimate interests, and in doing so she must consider whether these interests might reasonably be met by any alternative means.

47.Having considered the content of the information sought, and the circumstances surrounding the request, the Commissioner can identify no viable means of meeting these legitimate interests which would interfere less with the privacy of the relevant data subject other than by obtaining the exact information requested through the FOISA process.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subject?

48.The Commissioner must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the data subject. As noted above, this involves a balancing exercise between the legitimate interests of Dr McKerrell and the external individual in question. Only if the legitimate interests of Dr McKerrell outweigh those of the individual can the information be disclosed without breaching the first data protection principle.

49.In considering the submissions from both parties carefully, the Commissioner has also taken into account the guidance on this point in her own briefing on the section 38 exemption (referred to in paragraph 42above), which identifies relevant factors as including:

whether the information relates to the individual's public or private life

the potential harm or distress that may be caused by disclosure

whether the individual has objected to disclosure

the reasonable expectations of the individual as to whether their information would be disclosed.

50.The Commissioner notes that the individual in question is not a public figure, a senior employee, or even a permanent employee of the University.Although the information relates to that individual's professional activities, it also relates to their finances, by revealing the payment made in relation to an ad hoc piece of work undertaken for the University.She recognises that disclosure of the withheld information in this case would cause a degree of intrusion, which would be unexpected and possibly distressing.

51.The Commissioner recognises that a person's salary or income is a type of information that is generally expected to be kept private, and in this case, the Commissioner gives some weight to the fact that the individual has clearly stated that they do not give their consent for the information to be disclosed.It is the Commissioner's view that this reflects a reasonable expectation, given the basis upon which the work was undertaken, and fact that the individual concerned was neither a formal employee of the University, nor undertaking work at a level of seniority.

52.The Commissioner accepts that Dr McKerrell has a legitimate interest in his capacity as a trade union representative and that disclosure of the information would assist with regard to the disciplinary process. In respect of the legitimate interest of the public at large, the Commissioner recognises that as a publicly funded body, there would be a public interest in knowing how the University spends public funds and whether it obtains best value for the public purse.

53.In previous decisions (e.g. Decision155/2010 Mr Y and the University of Glasgow) the Commissioner has expressed the view that employees of public authorities should be open to scrutiny and accountability because their jobs are funded by the public purse, while also recognising that not all staff should be subject to such a level of scrutiny, drawing a distinction between what information should be released about senior staff compared to what should be disclosed about less senior staff.However, she has given limited weight to these considerations, given the nature of the work concerned and the individual's status in this case.

54.Having balanced the legitimate interests of the data subject against those identified by Dr McKerrell, the Commissioner finds that any legitimate interests served by disclosure would not outweigh the unwarranted prejudice that would be caused in this case to the rights and freedoms or legitimate interests of the data subject. The Commissioner therefore concludes that condition 6 in Schedule 2 to the DPA cannot be met in this case.

55.Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject as described above, the Commissioner must also conclude that its disclosure would be unfair. As no condition in Schedule 2 to the DPA can be met, she would also regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information in the withheld personal data and that this information was properly withheld under section 38(1)(b) of FOISA.

56.Having found that the information under consideration is exempt under section 38(1)(b) on the basis that disclosure would breach the first data protection principle, the Commissioner is not required to consider whether disclosure would also breach the second data protection principle.

57.The Commissioner therefore finds that the University correctly applied the exemption in section 38(1)(b) to the withheld information, and so complied with Part 1 of FOISA when refusing to supply this information in response to Dr McKerrell's information request.

DECISION

In relation to the matters under consideration in this decision, the Commissioner finds that the Glasgow Caledonian University complied with Part 1 of the Freedom of Information (Scotland) Act 2002 when responding to the information request made by Dr Nick McKerrell.

Appeal

Should either Dr McKerrell or Glasgow Caledonian University wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Margaret Keyse
Head of Enforcement
29 June 2012

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

?

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

38 Personal information

(1) Information is exempt information if it constitutes-

...

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

1.The data subject has given his consent to the processing.

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

[1] http://www.itspublicknowledge.info/nmsruntime/saveasdialog.aspx?lID=661&sID=133

Link to PDF of Decision 106/2012 (114 KB)

Back to Top