Decision 026/2018: Mr Albert Cruickshank and Scottish Borders Council Staff names Reference No: 201701933 Decision Date: 6 March 2017 Summary The Council was asked for information relating to traffic calming measures and a list of all members of its Road Safety Team. The Council provided information relating to the traffic calming measures, but withheld the names of its Road Safety Team. After investigation, during which the Council disclosed one name (of a manager), the Commissioner accepted that the Council correctly withheld the remaining personal information.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a) and (c) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2) and (3)(a)(i) (Personal data)

Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 22 August 2017, Mr Cruickshank made a request for information to Scottish Borders Council (the Council). The information requested was:

a) a list of all housing estates in the Council's area protected by Traffic Calming Measures;

b) a list of all members of the Council's Road Safety Team (RST).

2. The Council responded on 6 September 2017, informing Mr Cruickshank that it did not hold any information falling within the scope of part a) of his request. In relation to part b), it advised that it could not provide the list he sought as it would contain third party personal information, which it was refusing to make available under regulation 11(2) of the EIRs.

3. On 8 September 2017, Mr Cruickshank wrote to the Council requesting a review of its decision. He did not accept that no information was held for part a) of his request. In relation to part b) he stated that he did not wish any personal data, only the names of the RST.

4. The Council notified Mr Cruickshank of the outcome of its review on 4 October 2017. In relation to part a) of the request, the Council provided Mr Cruickshank with the Council's traffic orders, confirming that it held no further information for this part. In relation to part b), the Council maintained that the list of names was excepted from disclosure in terms of regulation 11(2). It did, however, provide him with a list of the job titles of the individuals concerned.

5. On 2 December 2017, Mr Cruickshank wrote to the Commissioner's Office. He applied to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. In relation to part b) of his request, Mr Cruickshank stated that the Council refused to provide the names of the RST and that he had a right to know. He made no reference to part a), so that part will not be considered in this decision.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Cruickshank made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 7 December 2017, the Council was notified in writing that Mr Cruickshank had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr Cruickshank. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions, with specific reference to regulation 11(2) of the EIRs.

9. The Council responded, confirming that the request fell to be dealt with in terms of the EIRs and applying the exemption in section 39(2) of FOISA. The Council advised that having reconsidered its position, it had provided Mr Cruickshank with the name of the Network Manager in the RST, which it had previously withheld. It noted that Mr Cruickshank was already aware of this person's identity.

10. The Council maintained that the names withheld were the personal data of staff members in its RST and that disclosure would breach the first data protection principle.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Cruickshank and the Council. He is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

12. It is clear that any information falling within the scope of the request, which relates to Traffic Calming and Road Safety, is properly considered to be environmental information, as defined in regulation 2(1) of the EIRs (reproduced in Appendix 1 to this decision). Mr Cruickshank made no comment on the Council's application of the EIRs in this case and the Commissioner will consider the request in what follows solely in terms of the EIRs.

Regulation 5(1) of the EIRs

13. Regulation 5(1) of the EIRs (subject to the various qualifications contained in regulations 6 to 12) requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. It is important to bear in mind that this obligation relates to information actually held by an authority when it receives the request, as opposed to information an applicant believes the authority should hold, but which is not in fact held.

Regulation 11(2) of the EIRs - personal data of another person

14. The Council had initially withheld the names of all staff who were members of the RST under regulation 11(2) of the EIRs.

15. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in Schedule 1 to the DPA (regulation 11(3)(a)(i)). The Council argued that disclosure of certain information would breach the first data protection principle.

16. During this investigation, the Council gave Mr Cruickshank the name of the Network Manager responsible for the RST. The Council provided no submissions as to why this name should be withheld under regulation 11(2) of the EIRs. In the circumstances, the Commissioner finds that this information should have been disclosed in response to Mr Cruickshank's request and that, in failing to do this, the Council failed to comply with regulation 5(1) of the EIRs. The Commissioner need not consider this information further in this decision.

17. The Commissioner will now consider the withholding of the remaining names of staff members attached to the RST, still withheld by the Council under regulation 11(2).

Is the information under consideration personal data?

18. In his requirement for review and in his submissions to the Commissioner, Mr Cruickshank advised that he was not seeking personal data, merely the names of the members of the Council's Road Safety Team.

19. The definition of "personal data" is contained in section 1(1) of the DPA and is set out below in Appendix 1. The Commissioner is satisfied that a person's name is the most common way of identifying them. Given the context of the request, he is satisfied that this information relates to the individuals concerned. As such, it is their personal data.

The first data protection principle

20. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be making the information available in the public domain, in response to Mr Cruickshank's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (the full text of the principle is set out in Appendix 1). A condition in Schedule 3 to the DPA will also require to be met if the data are sensitive personal data, as defined in section 2 of the DPA: the Commissioner is satisfied that this is not the case here.

21. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

22. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be made available. If any of these conditions can be met, he must then consider whether making the information available would be fair and lawful.

Can any of the conditions in Schedule 2 be met?

23. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit making the information available to Mr Cruickshank. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

24. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

a. Is Mr Cruickshank pursuing a legitimate interest or interests?

b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

c. Even if the processing is necessary for Mr Cruickshank's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

25. There is no presumption in favour of making personal data available under the general obligation laid down by regulation 5(1) of the EIRs. Accordingly, the legitimate interests of Mr Cruickshank must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit making the personal data available. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to make the personal data available to Mr Cruickshank.

Is Mr Cruickshank pursuing a legitimate interest or interests?

26. The Council submitted that Mr Cruickshank had a legitimate interest in having a point of contact within the Council to express his concerns to the RST and to know who was ultimately responsible for the Council's Road Safety Policy. In the Council's view, the provision of the Network Manager's name would satisfy the legitimate interest it had identified. The Council further submitted that Mr Cruikshank's desire to know the names of the RST is not in itself a legitimate interest for the purposes of condition 6.

27. Mr Cruickshank submitted that the RST were charged with public road safety in the Borders. He stated that those who made decision affecting public safety should not be allowed to hide their identities. He advised the Commissioner that the members of the RST were ignoring concerns he had raised regarding road safety and he believed he had the right to have their identities revealed.

28. The Commissioner acknowledges that Mr Cruickshank has provided his personal reasons for wishing the information, in that he is dissatisfied with decision making process within the Council.

29. Having considered the information and all of the submissions received, the Commissioner accepts that disclosure might satisfy Mr Cruickshank's personal interest. However, any dissatisfaction he may have with the Council's road safety policies is a matter for the Council as a whole, not the individual members of the RST. In the circumstances, the Commissioner is not satisfied that any interest Mr Cruickshank might have in obtaining the personal data in question could be considered to amount to a legitimate interest in obtaining these personal data for the purposes of condition 6 in Schedule 2 to the DPA.

30. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit the personal data to be made available. In the absence of such a condition, it would be unlawful to make the personal data available. Consequently, the Commissioner finds that the Council would have breached the first data protection principle in making the data available, and so was entitled to withhold the data under regulation 11(2) of the EIRs.

Decision The Commissioner finds that Scottish Borders Council (the Council) partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by Mr Cruickshank. The Commissioner finds that by initially withholding the name of the Network Manager under regulation 11(2) of the EIRs, the Council failed to comply with the EIRs, in particular regulation 5(1). The Commissioner also finds that the Council complied with the EIRs, on the basis that it was entitled to withhold the remaining information in terms of regulation 11(2).

Appeal

Should either Mr Cruickshank or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

  Margaret Keyse
  Head of Enforcement 6

March 2018

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

…

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

…

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

10 Exceptions from duty to make environmental information available-

…

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

…

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998[6] that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.