Home Decisions

Decision 024/2005

Decision 024/2005 - Mr Burchell and East Lothian Council

Request for a copy of the North Berwick harbour waiting list ? withheld on the basis of section 38(1)(b) ? failure of East Lothian Council to deal with request fully in terms of section 1(1) of the Freedom of Information (Scotland) Act 2002.

Request for a copy of the North Berwick Harbour waiting list

Applicant: Mr Kenneth Burchell
Authority: East Lothian Council
Case No: 200501153
Issue Date: 23 August 2005

Kevin Dunion
Scottish Information Commissioner

Facts

Mr Burchell requested a copy of the North Berwick harbour waiting list from East Lothian Council (the Council). The Council refused this request, citing section 38 of the Freedom of Information (Scotland) Act (FOISA). The Council claimed in its refusal that the information on the list constituted personal data, under the terms of the Data Protection Act 1998 (DPA).

Outcome

The Commissioner found that the Council failed to act fully in accordance with Part 1 of FOISA in deciding to withhold the information requested by Mr Burchell in its entirety. The Commissioner required the Council to release all non-personal information contained within the North Berwick Harbour waiting list.

The Commissioner also found that the Council failed to comply fully with sections 16(1) and 21(1) of FOISA in responding to Mr Burchell's information request.

Appeal

Should either the Council or Mr Burchell wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.

Background

1. Mr Burchell submitted a request for information to East Lothian Council (the Council) on 8 January 2005. In his request, Mr Burchell sought a copy of the current waiting list for moorings at North Berwick Harbour (the harbour).

2. On 21 January the Council responded to Mr Burchell's information request. In its response, the Council refused to disclose the waiting list, citing section 38 of the Freedom of Information (Scotland) Act 2002 (FOISA).

3. On 27 January Mr Burchell wrote to the Council requesting that it review its decision. In this request for review, Mr Burchell provided a number of reasons why he believed he was entitled to the information. These included the fact that Mr Burchell is currently a berth holder in the harbour, and that he is a resident of North Berwick.

4. The Council responded to this request for review on 8 March. The Council upheld its original decision that the requested information was exempt under section 38 of FOISA, while also informing Mr Burchell that the reasons provided by him in his correspondence of 27 January would not override the provisions of FOISA.

5. Mr Burchell submitted an application for decision to my Office on 22 March and the case was allocated to an Investigating Officer.

The Investigation

6. Mr Burchell's appeal was validated by establishing that he had made a valid information request under FOISA and had appealed to me only after asking the public authority to review its response to his request.

7. In his application, Mr Burchell stated that he was dissatisfied with the Council's response for a number of reasons. These included his belief that aspects of the waiting list could be released to him with personal information removed, and the fact that the Council had failed to respond to his request for review within 20 working days.

8. My Office then contacted the Council for their comments and further information in relation to this case. The Council responded to this correspondence on 26 April, providing:

  • A copy of the harbour waiting list
  • Copies of all correspondence and communications held relating to the case
  • A copy of the harbour mooring application form
  • Comments on the timeliness of the Council?s response and the decision making process in relation to this case.

9. The Council reiterated its view that the information contained in the waiting list was personal data and that release of the information would breach the first and second data protection principles.
 

The Commissioner?s Analysis and Findings

10. One of Mr Burchell's dissatisfactions with the way in which his request was handled, stemmed from the Council's failure to respond to his request for review within the 20 working day timescale provided by FOISA. Mr Burchell's request for review was received by the Council on 31 January 2005, but the Council did not respond until 8 March, 26 working days after his request for review was received.

11. The Council has stated that the reason for this delay was due to an internal administrative error, which led to 7 February, the date on which the Council's Records Manager received the request, being recorded as the date of receipt. The Council has acknowledged in their correspondence that it was at fault in this aspect of its handling of Mr Burchell's request and has assured my Office that it intends to introduce measures to prevent a reoccurrence in future.

12. In this instance however, the Council clearly failed in its duty under section 21(1) of FOISA by failing to respond to Mr Burchell's request for review within 20 working days.

13. I also note that the Council failed in its duty under section 16(1) of FOISA in its failure to identify which of the specific exemptions under section 38 of FOISA applied to the information requested. This was eventually clarified following correspondence with my office.

14. The Council stated in this correspondence that Mr Burchell's information request was refused on the basis of section 38(1)(b) of FOISA. Section 38(1)(b) absolutely exempts information if that information constitutes personal data, and its release would breach one of the data protection principles. I will now consider whether the Council was correct in its application of this exemption to the information requested by Mr Burchell.

Is the information personal data?
15. The DPA defines personal data in section 1(1) as:

"data which relate to a living individual who can be identified:

  • from those data, or
  • from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller."

In considering whether the release of the harbour waiting list to Mr Burchell would be a breach of section 38(1)(b), I first considered whether the information contained in the list was, in fact, personal data under the terms of the DPA.

16. The harbour waiting list comprises 20 fields of information. These 20 fields can be broadly described within 3 categories. These are:

  • Applicant data - specific information relating to the applicant. Includes name, address and telephone number of each applicant.
  • Vessel data - information relating to the boat for which a berth is sought. Includes name, type and dimensions of the boat. This also includes, where relevant, details of any shareholders in the vessel. (Although the term 'shareholder' is used, this relates to the percentage of ownership by individuals of each boat. None of the boats appear to be owned by companies.)
  • Application data - information relating to the process of the application. Includes the applicant's position in the waiting list, application date and notes on the application.

17. In relation to the first of these, the 'applicant data', the information on the harbour waiting list clearly constitutes personal information under the definition provided in the DPA.

18. With regard to the second, the 'vessel data', the issue was less clear cut. While details of a particular vessel's individual 'shareholders' will clearly constitute personal data, will details of the name, type and/or dimensions of a particular vessel? Would the release of this information result in the identification of an individual?

19. The Information Commissioner, who is responsible for enforcing DPA throughout the UK , has stated that there will be many circumstances where information relating to a material possession, such as a house or a car, will constitute personal data, because that information will be directly linked to an individual.

20. In addition, section 8(7) of the DPA provides that, when considering requests for third party information the following should be considered:

". another individual can be identified from the information being disclosed if he can be identified from that information, or from that and any other information which, in the reasonable belief of the data controller, is likely to be in or come into, the possession of the data subject making the request."

The Information Commissioner's Office has advised that, while section 8(7) of the DPA was drafted to apply to requests for data under the DPA, it should also be taken into account when considering whether an individual can be identified from data released under FOISA.

21. As a result of the application of section 8(7) of the DPA, I have not only considered whether individuals can be identified from the data release alone, but also whether an individual can be identified from that data and any other information which, in the reasonable belief of the data controller, is likely to be in, or come into, the possession of a member of the public.

22. In relation to the name of the vessel, I am of the opinion that this information will clearly constitute personal information under the terms of the DPA. In general, vessel names will be unique to that vessel, and an individual may be easily identified from the release of that name into the public domain.

23. With regard to the type of the vessel, I am also of the opinion that this information should be considered to be personal information. From a review of the information recorded in this field it is clear that, in general, each vessel on the list is of a distinct 'type', with this information frequently relating to the make and model of the vessel in question. There is little or no repetition of vessel types in the waiting list. It is my opinion therefore that the release of this information into the public domain would also be likely to lead to the identification of individuals on the waiting list.

24. With regard to the dimensions of each boat, this is listed in terms of both the length and beam of the vessel. While there are a number of cases of duplication of particular measurements throughout the list, there are also several cases where I consider that the release of this information in its current format may also lead to the identification of individuals. This is particularly the case in relation to the more isolated occurrences of atypically large or small vessels. I therefore consider that this information, in its current format, should also be considered to be personal information under the DPA.

25. Finally, the fields categorised under 'application data' contain information relating specifically to the process of the application. It is my opinion that this information will not generally constitute personal information, given that it relates solely to the applicant's journey through the waiting list process, and its release would not generally result in the identification of any particular individual. I am also of the opinion that the release of much of the information falling under this category, such as details of the applicant's position on the waiting list and the date of his or her application, will also serve to reassure the public that process of allocating berths to those on the harbour waiting list is transparent and accountable.

26. I note however that there are some fields falling under this category, such as the 'Notes' fields, which occasionally contain information which identifies individuals. In these cases such information should be redacted by the Council before release.

Would disclosure contravene the data protection principles?
27. In its submissions to my Office, the Council indicated that disclosure would breach both the first and second data protection principles.

28. The first principle relates to fair and lawful processing. The Council has stated that, while the application forms do not contain an explicit privacy statement, the individuals who submit their details have an expectation that the information will remain confidential. The Council also stated that the information contained on the waiting list is not released to anyone except the North Berwick Harbour Mooring Panel, which considers the list when a berth becomes available. The Council acknowledges that, prior to the DPA coming into force in 2000, the waiting list was distributed amongst those individuals on the list. However, the Council also states that from 2000 this practice was stopped, and those on the list at that time were made aware of the Council's new privacy policy, in line with the DPA.

29. The ICO's guidance on the consideration of the data protection principles provides examples of the issues which authorities should consider when assessing whether the release of personal data to a third party would amount to 'fair' processing. These include:

  • Would the data subject expect that his or her information might be disclosed to others?
  • Has the person been led to believe that his or her information would be kept secret?

30. In relation to this case, I find that the Council was right to consider that the release of the personal information contained in the harbour waiting list would breach the first data protection principle. While the Council has acknowledged that the waiting list was shared amongst those listed prior to 2000, once the DPA came into force all those on the list were contacted and made aware of the Council's new 'post-DPA' privacy policy. Of the 57 individuals currently on the list, 23 were on the list at the time of the introduction of this policy, and would therefore have received direct notification from the Council of this change. It can therefore be reasonably assumed that these individuals have both been led to believe that their information would be kept secret, and thus have no expectation that their personal information would be disclosed. For the remainder of those on the list, it can be assumed that, given the circumstances under which the list has been managed since 2000, there is again no expectation of disclosure.

31. Given that I agree with the Council that the release of personal data will breach the first data protection principle, I will not consider the Council's argument that the second principle would also be breached.

Conclusion
32. I find that the Council failed to act in accordance with FOISA in its decision to withhold the harbour waiting list in its entirety.

33. While I agree with the Council that much of the information contained in the harbour waiting list constitutes personal data and its release would breach the data protection principles, I find that there is a significant amount of information on the list which does not fall under the definition of personal data and should, as a result, be released to Mr Burchell.

34. I therefore find that the Council should release the information contained in the following fields to Mr Burchell:

 

 Field Title  Field Description
 No.  Indicates applicant's position on list
 Date App Rec'd  Indicates the date on which the application was received.
 Larger Mooring  Indicates whether the application is from an existing berth holder seeking a larger mooring
 Refusal No.  Indicates whether a berth has been offered and subsequently refused and, if so, the number of times a refusal has taken place

35. In addition, I also find that the Council should release specific information from the following additional fields:

  • Notes 1-3
  • Address 2
  • Address 3
  • Length (M)
  • Beam

36. The Notes 1-3 fields consist of separate fields containing additional information relating to the process of the application. I consider that the majority of the information contained in these fields can be released to Mr Burchell. However, there are specific occurrences where these fields contain personal data. In these cases, the information should be redacted by the Council. Occurrences where information should be redacted are as follows:

  • ID No 13 ? Details of the modifications made to the boat should be redacted from Note 1; the boat?s length should be redacted from Note 2; the applicant?s name should be redacted from Note 3.
  • ID No 15 ? The name of the individual who currently uses the applicant?s preferred berth should be redacted from Note 3.

37. The ?Address 2? and ?Address 3? fields contain information relating to the applicant?s postal address. While much of this information constitutes personal data, I find that it would be reasonable for the Council to release the information from these fields which relates to the home town of the individual. I do not consider that the release of ?home town? information would significantly increase the risk of identification of any individual, while I also believe that it would help to ensure that the berth application process is as open and accountable as possible. This is particularly the case given that one of the criteria by which the Council prioritises berth allocation is whether the applicant is a resident of East Lothian. The information released should only be that information which relates to the home town of an individual however, and should not include any additional information contained in these fields, such as street name and/or postcode.

38. With regard to the fields of ?Length? and ?Beam?, I have stated my belief earlier that there may be some limited circumstances where the release of the exact dimensions of a particular vessel may facilitate the identification of an individual (see paragraph 24 above). With this in mind, I find that the Council should release details relating to the dimensions of vessels, but with this information aggregated into size bands, in order to reduce the likelihood of specific individuals being identified. I would suggest the following bands for use by the Council:

Length (Metres)

  • Band 1 Under 5 m
  • Band 2 5m - 5.99m
  • Band 3 6m - 6.99m
  • Band 4 7m - 7.99m
  • Band 5 8m - 8.99m
  • Band 6 9m and over

Beam (Metres)

  • Band 1 Under 2m
  • Band 2 2m - 2.49m
  • Band 3 2.5m - 2.88m
  • Band 4 3m and over


39. In coming to this decision, I have sought to strike a balance between ensuring that the identities of individuals on the list can be protected, while also striving to ensure that information which does not constitute personal data, and which would serve to reassure the public about the accountability of the waiting list process, can be released into the public domain.

40. When releasing the information to the applicant, the Council should supply the information in table format, with exempt information removed or redacted. An example of the format for information release is provided as an appendix to this decision.

Decision

I find that East Lothian Council failed to act fully in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in its decision to withhold the information requested by Mr Burchell in its entirety.

I find that the Council breached section 1(1) of FOISA in withholding from Mr Burchell the entire contents of the waiting list. However, I find that the Council was correct to withhold that information which constituted personal data under the definition provided by the Data Protection Act 1998.

I require the Council to provide Mr Burchell with information contained in certain fields of the North Berwick harbour waiting list, specifically that information described in paragraphs 35 to 38 above.

I am obliged to give the Council at least 42 days in which to supply Mr Burchell with this information. In this case, I require the Council to provide him with the information within two months.

I also find that the Council failed to comply with the following sections of FOISA:

  • Section 21(1) ? failure to respond to Mr Burchell?s request for review within 20 working days.
  • Section 16(1) ? failure to specify the exemption being relied on to withhold information.

However, I note that the Council has subsequently indicated that it has reviewed its procedures in relation to dealing with requests under FOISA. As a result, I do not require the Council to take any remedial steps in relation to these failures.
 

Kevin Dunion
Scottish Information Commissioner
23 August 2005

Kinburn Castle
Doubledykes Road
St Andrews
Fife
KY16 9DS

enquiries@itspublicknowledge.info
www.itspublicknowledge.info

tel: 01334 464610
fax: 01334 464611

APPENDIX - Please See PDF file for APPENDIX

PDF IconLink to PDF file of decision 024/2005 (101 kb)