Decision 033/2005 – Paul Hutcheon, The Sunday Herald and the Scottish Parliamentary Corporate Body
David McLetchie MSP’s travelling claims since 1999 – information provided but destination points of taxi journeys withheld – whether information withheld is exempt under section 38(1)(b) and section 39(1) of the Freedom of Information (Scotland) Act 2002.
David McLetchie MSP’s travelling claims since 1999 – taxi journey destinations
Applicant: Paul Hutcheon, The Sunday Herald
Authority: The Scottish Parliamentary Corporate Body
Case No: 200501974
Decision Date: 6 October 2005
Scottish Information Commissioner
Paul Hutcheon, a journalist with The Sunday Herald, asked the Scottish Parliamentary Corporate Body (the SPCB) for a copy of David McLetchie MSP’s travel claims supporting mileage, air travel, car hire and taxis since 1999. Copies of the travel claims were provided to Mr Hutcheon, but information, including the taxi destinations, was redacted. Mr Hutcheon asked the SPCB to review its decision to redact the destination in the taxi invoices. The SPCB subsequently carried out a review, but upheld its original decision, advising Mr Hutcheon that releasing the information would contravene the Data Protection Act 1998. Mr Hutcheon subsequently applied to the Commissioner for a decision on whether the SPCB was correct not to provide the taxi destinations to him.
The Commissioner found that the SPCB had breached Part 1 of FOISA in failing to release the destination points of taxi journeys undertaken by Mr McLetchie. Although the information was personal data, the release of the data would not breach any of the data protection principles. Accordingly, the information was not exempt under section 38(1)(b) of the Freedom of Information (Scotland) Act 2002 (FOISA).
In addition, the Commissioner was not satisfied that the release of the information would endanger the safety of Mr McLetchie and, accordingly, held that the information was not exempt under section 39(1) of FOISA.
The Commissioner ordered the release of the information which had been withheld from Mr Hutcheon, but stressed that each case has to be treated on its own merits and that he will not order release of this information in future cases should the release of the information put a person at risk.
The Commissioner also found that the SPCB had breached Part 1 of FOISA in failing to comply with various technical aspects of FOISA in responding to Mr Hutcheon’s requests.
Should either Mr Hutcheon or the SPCB wish to appeal against the Commissioner’s decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.
1. On 10 February 2005, Mr Hutcheon asked the SPCB to provide him with a copy of Mr McLetchie’s travel claims supporting mileage, air travel, car hire and taxis for the last three financial years.
2. The SPCB responded to Mr Hutcheon’s request on 21 April 2005. The letter from the SPCB stated that the information requested by Mr Hutcheon was supplied with the letter. However, some of the information contained in the travel claims had been redacted by the SPCB.
3. On 22 April 2005, Mr Hutcheon asked the SPCB to review its decision to redact the “destination” in the taxi invoices.
4. The SPCB carried out a review on 18 May 2005 and advised Mr Hutcheon of the outcome of the review on 19 May 2005. At review, the SPCB decided to uphold its original decision. The reason given to Mr Hutcheon was that, in applying the requirements of the Data Protection Act 1998 (DPA), the SPCB considered that it would not be fair to disclose the destinations of taxi journeys because in so doing it could reveal details that could compromise the safety and security of public figures.
5. On 9 June 2005, Mr Hutcheon sought a decision from me as to whether the SPCB had been correct to redact the taxi destinations. He was unhappy that the information had been withheld as a large motivation for the initial request was about accessing this information.
6. Mr Hutcheon also made a separate, but connected, request to the SPCB on 3 May 2005. In that request, Mr Hutcheon also asked for Mr McLetchie’s travel claims, but this time for 1999-2000 and 2000-2001.
7. The SPCB provided Mr Hutcheon with this information on 12 May 2005, but again redacted the taxi destinations along with other information.
8. Mr Hutcheon asked the SPCB to review its decision to redact this information on 16 May 2005. The SPCB subsequently carried out a review on 1 June 2005 and advised Mr Hutcheon of the outcome of the review on 6 June 2005. Again, the SPCB refused to supply the information to Mr Hutcheon on the basis that disclosure would breach the DPA.
9. On 27 June 2005, Mr Hutcheon sought a decision from me as to whether the SPCB had been correct to redact this information. Mr Hutcheon again stated that he did not believe that the taxi destinations should have been redacted and stated that he would like the taxi destinations disclosed in addition to the points of departure.
10. These cases were allocated to an investigating officer within my Office.
11. The applications from Mr Hutcheon were validated by establishing that he had made valid requests to a Scottish public authority (i.e. the SPCB) and that he had appealed to me only after requesting that the authority review its decision.
12. Given that the two applications made by Mr Hutcheon related to the same information but different time periods, the applications were conjoined. As a result, this decision covers both applications.
13. At the start of the investigation, it was necessary to clarify the scope of the information, both in relation to the information which had been redacted and the time periods in respect of which Mr Hutcheon wanted the information.
14. In his application to me of 9 June 2005, Mr Hutcheon made it clear that he wished me to consider whether the SPCB was correct to redact the taxi destination information. In his application to me of 27 June 2005, Mr Hutcheon asked me to consider whether the SPCB had been correct to redact the taxi departure information as well as the taxi destination information. However, Mr Hutcheon had not asked the SPCB to review its redaction of taxi departure information. As a result, I am unable to consider taxi departure information in this decision and, in line with Mr Hutcheon’s requests for review to the SPCB, will only consider the decision by the SPCB to redact the destination in the taxi invoices. However, if this investigation had involved taxi departure information, I would have approached the release of that information in the same way as the taxi destination information.
15. In his first request to the SPCB, Mr Hutcheon asked for Mr McLetchie’s travel claims for the last three financial years. In his second request, Mr Hutcheon asked for Mr McLetchie’s travel claims for 1999-2000 and 2000-2001 (subsequently referred to as 1999-2001 is his application to me). It was unclear to me whether Mr Hutcheon’s requests related to calendar or financial years. In correspondence with Mr Hutcheon and the SPCB, it was agreed that Mr Hutcheon’s applications covered the following dates:
- May 1999 to March 2000
- April 2000 to March 2001
- April 2001 to March 2002
- April 2002 to March 2003 and
- April 2003 to March 2004
16. The investigating officer wrote to the SPCB on 21 June 2005 to advise that an investigation was underway in relation to the first application by Mr Hutcheon and invited the SPCB to comment on the case under section 49(3) of FOISA. In the letter, the SPCB was asked to explain which exemption had been used to withhold the taxi destination information from Mr Hutcheon and why that exemption had been used. The SPCB was also asked to provide my Office with a sample of the invoices which had been provided to Mr Hutcheon. Two copies of each of the invoices in the sample were requested, one unedited and one redacted to show what information had been released to Mr Hutcheon. The SPCB was also subsequently invited to comment on the second application by Mr Hutcheon.
17. The SPCB supplied copy invoices to my Office in line with the request. However, it quickly became clear that the sample was too small to allow me to come to a decision. As a result, I asked the SPCB to provide me with two copies of all of the invoices covered by Mr Hutcheon’s two requests, one a full copy and one a redacted copy. The SPCB subsequently provided me with copies of the invoices as requested.
The SPCB’s submissions
18. The SPCB responded to my invitation for comments on 12 July 2005 and confirmed, for the first time, that it had relied on the exemption in section 38(1)(b) of FOISA to withhold the taxi destination information from Mr Hutcheon. (Section 38(1)(b), read in conjunction with section 38(2)(a)(i) of FOISA, exempts from release third party information where the information is personal data, as defined by the Data Protection Act 1998 (DPA), and the release of the data would breach any of the data protection principles contained in the DPA.)
19. In this case, the SPCB considered the information to be personal data and that its release would breach the first data protection principle. (The first data protection principle requires that personal data shall be processed fairly and lawfully and that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met.) The SPCB considered that the condition in Schedule 2 which was most relevant is the condition set out at paragraph 6(1) of the Schedule. This condition states that:
“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”
20. While the SPCB was of the opinion that disclosure of the redacted information in response to a freedom of information request would amount to processing for the purposes of legitimate interests pursued by a third party, it considered that in this case processing would be unwarranted because it would prejudice the rights and freedoms or legitimate interests of the data subject, i.e. Mr McLetchie, by exposing him to an unnecessary risk to his personal safety.
21. For the same reason, the SPCB considered that disclosure of the redacted information would not meet the fairness test set out in the first data protection principle.
22. The SPCB was concerned that disclosure of the redacted information would reveal personal data relating to addresses with which Mr McLetchie is associated and that this information could be used to establish a pattern of behaviour, allowing Mr McLetchie’s movements to be predicted and potentially putting his security at risk. In addition, the redacted information could be used along with other information already in the public domain to establish a pattern of behaviour which could put Mr McLetchie at risk.
23. The SPCB also referred to guidance published by the Information Commissioner (Freedom of Information Act Awareness Guidance No.1), which can be read at http://www.informationcommissioner.gov.uk/cms/DocumentUploads/AG%201%20personal%20info.pdf.
24. That guidance observes:
“Information which is about the home or family life of an individual … is likely to deserve protection. By contrast, information which is about someone acting in an official or work capacity should normally be provided on request unless there is some risk to the individual concerned.”
25. The SPCB stated that, in addition, it took the view that the exemption in section 39(1) would apply to the information which had been redacted. Section 39(1) exempts information if its release would, or would be likely to, endanger the physical or mental health or the safety of an individual. The exemption is subject to the public interest test, which means that even if the release of the information would endanger an individual, the information should be released unless the public interest is better served by the information being withheld than by the information being released. The SPCB is of the view that the public interest would weigh in favour of non-disclosure.
26. The SPCB ended its submissions by saying that its paramount requirement must be the safety of MSPs, who are easily recognisable and who have already been targeted by individuals who seek to pursue particular causes. According to the SPCB, individual Members have already experienced such safety issues and the release of information about the start and end points of journeys to and from private addresses, including the very detailed information provided by taxi receipts, would expose the pattern of regular journeys by public figures and compromise their safety.
27. The SPCB urged me to take a cautious approach where any doubt exists as to whether a person’s security could be compromised, as the possible consequences of not taking such an approach would fall heavily on any authority which had knowingly taken a risk with another person’s safety. The SPCB also commented that my decision would have significant implications for all MSPs and the people with whom they deal in the course of fulfilling their Parliamentary duties.
28. The SPCB also commented that it had chosen to release to Mr Hutcheon the starting point and destination of Mr McLetchie’s journeys where the journeys were to or from the Parliament complex, i.e. the place where the Parliament or any of its committees or sub-committees meets from time to time.
Mr Hutcheon’s submissions
29. Mr Hutcheon was given an opportunity to comment on the submissions made to me by the SPCB.
30. Mr Hutcheon commented that, in recent months, the travel expenses of Gordon Jackson MSP were published by the SPCB and that, in Mr Jackson’s case, taxi destinations and points of departure were made public, even when a pattern emerged in his travel claims.
31. He also commented that by arguing that a pattern of behaviour could put Mr McLetchie’s safety at risk, the SPCB appear to be saying that all non-patterned information should be disclosed, when it was in fact redacted.
32. Mr Hutcheon also commented that Mr McLetchie’s home address is already publicly available by virtue of it appearing in the telephone book and he disagreed that disclosing Mr McLetchie’s patterned journeys to or from, e.g., his constituency office to his house would be compromised as his constituents would know when his surgeries were likely to take place.
33. Mr Hutcheon also commented on the fact that Mr McLetchie had resigned from the law firm, Tods Murray, so that even if a pattern existed of Mr McLetchie travelling to Tods Murray, there would be no risk to Mr McLetchie’s personal safety.
34. In response to the comment from the SPCB that my decision in this case would have significant implications for all MSPs, Mr Hutcheon commented that each case should be treated individually. He suggested that a Minister of the Scottish Executive was likely to have more reason to be concerned about personal security than a List MSP and said he recognised that it would be difficult to justify full disclosure of travel in every instance.
35. Finally, Mr Hutcheon made the point that members of the public have a right to know that their taxes are being spent properly.
The Commissioner’s Analysis and Findings
36. Under the Parliament’s Members’ Allowances Scheme (the Scheme), MSPs are eligible for the reimbursement of travelling expenses, at the rates or level specified in the Scheme, necessarily incurred by that member within Scotland in performing his or her Parliamentary duties. This includes the reimbursement of the cost to the MSP of taxis where the use of such a service is required for reasons of urgency or where it is not reasonably practicable for MSPs to use other forms of public transport.
37. The phrase “Parliamentary duties” is defined widely in the Scheme and includes, but is not limited to, attending a meeting of the Parliament or of a committee or sub-committee of the Parliament; undertaking research or administrative functions which relate directly to the business of the Parliament; attending meetings for the purpose of representing electors; attending Parliamentary group meetings or official functions which relate directly to, or in connection with, the business of the Parliament.
38. Claims made by MSPs under the Scheme are audited both internally by the SPCB and externally on behalf of the SPCB and I wish to make it clear that my remit does not extend to considering whether the travel claims made by Mr McLetchie were made correctly. My investigation is limited to the question of whether details about Mr McLetchie’s journeys should have been released to Mr Hutcheon.
39. As mentioned above, the SPCB sought to rely on two separate exemptions in withholding the information from Mr Hutcheon.
The section 38(1)(b) exemption
40. The first exemption relied on was the exemption in section 38(1)(b) of FOISA. This exempts third party personal data if the release of the information would breach any of the data protection principles. In this case, the SPCB withheld the information on the basis that it would breach the first data protection principle, which requires that personal data be processed fairly and lawfully.
41. I must therefore consider whether the information which has been withheld from Mr Hutcheon is personal data. Personal data is defined in section 1 of the DPA as:
“data which relate to a living individual who can be identified--
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller …”
42. The information which has been withheld tells us about Mr McLetchie’s movements over a number of years. It tells us the destinations of the taxi journeys Mr McLetchie has taken both on Parliamentary business and as party leader to and from work. I am satisfied that the information is personal data.
43. I must now go on to consider whether the release of the information would breach any of the data protection principles. In its submissions, the SPCB referred to guidance from the Information Commissioner which suggests when personal information should and should not be provided.
44. I view the information in question as information about Mr McLetchie acting in an official or work capacity. According to guidance from the Information Commissioner, this information should normally be provided on request unless there is some risk to Mr McLetchie. I will go on to consider the question of risk below.
45. In order for processing to be considered to be fair and lawful, the processing must be carried out in accordance with one of the conditions in Schedule 2 to the DPA. As mentioned above, the SPCB considers that the condition in Schedule 2 which is most relevant is the condition set out at paragraph 6(1), which allows data to be processed if the processing is necessary for the legitimate interests pursued by Mr Hutcheon, unless the processing would prejudice the rights and freedoms or legitimate interests of Mr McLetchie. I agree with the SPCB that this particular condition is relevant in this case and note that, again, the question comes down to whether there would be any risk to Mr McLetchie in the release of the information. Again, I will consider the question of risk below.
The section 39(1) exemption
46. Section 39(1) of FOISA exempts information if its release would, or would be likely to, endanger the physical or mental health or the safety of an individual. Yet again, in deciding whether the information should be released to Mr Hutcheon, I must consider whether there would be any risk to Mr McLetchie if the information were to be released.
The possibility of risk to Mr McLetchie
47. In considering whether there would be any risk to Mr McLetchie, I have considered the following questions:
- Whether, in examining the information, a pattern could emerge of Mr McLetchie’s movements which might put him in danger by allowing others to predict his movements
- Whether the information could be used in conjunction with other information to put Mr McLetchie at risk
- Whether there is evidence to suggest that there was already some danger to Mr McLetchie which the release of the information could increase and
- The expectations of Mr McLetchie in the release of the information.
48. My main task is to consider whether by releasing the information a pattern could emerge of Mr McLetchie’s movements which could put him in danger. The SPCB sent me copies of information relating to Mr McLetchie’s taxi use on Parliamentary business since May 1999. In all, the SPCB sent me information relating to almost 800 taxi journeys. The investigating officer extracted the date and destination of each taxi journey from the information provided and moved the information into an Excel spreadsheet, which could be manipulated to check whether in fact there were any patterns.
49. It is important to remember that information has already been provided to Mr Hutcheon showing dates of taxi journeys taken by Mr McLetchie. The start point and destination points have been withheld from Mr Hutcheon, but only the destination points are at dispute here.
50. Having looked at the spreadsheet, I am satisfied that no pattern emerges from the information which could endanger Mr McLetchie. Much of the information is old, dating back to 1999, and Mr McLetchie’s personal circumstances (as referred to in the submissions from Mr Hutcheon) have altered since the information was first collected by the SPCB.
51. It is also important to note what is lacking from the information held by the SPCB: the information does not include the time at which the taxi journeys were taken; over half of the taxi journeys undertaken contain no reference to a destination address and no date is given for around 90 of the journeys. Even if there were a pattern in Mr McLetchie’s movements, the lack of these details would make it very difficult for a third party to ascertain any pattern.
52. I also considered whether the information could be used in conjunction with other information which was already publicly available. The number of taxi journeys taken by Mr McLetchie has already been released under FOISA, but in the circumstances, given that no pattern of regular travel emerges from the information, I am not persuaded that the information could be used in conjunction with other information to endanger Mr McLetchie.
53. I have no doubt that part of the concern of the SPCB stems from Mr McLetchie’s journeys to his home address being available. Mr McLetchie’s address (or its environs) is the destination for roughly one in ten of the taxi journeys and I have confirmed the statement made by Mr Hutcheon that Mr McLetchie’s home address is freely available. However, given what is missing in the information which has been withheld (e.g. time of arrival home) and given that no pattern emerges from the information, I do not believe that the availability of a home address increases the risk to Mr McLetchie.
54. The next question I considered was whether there was any evidence to suggest that there was already some danger to Mr McLetchie which could be increased should the information be released. I note that, in its submissions, the SPCB commented that the security of individual MSPs has already been put at risk. Clearly, if the SPCB had raised with me particular issues about Mr McLetchie’s safety, then I would have taken that into account. However, no such issues were raised with me.
55. Finally, I considered Mr McLetchie’s expectations in the release of the information. I am not aware whether the SPCB approached Mr McLetchie to ask for his comments on whether the information should be released. In any event, I have not received any submissions directly from Mr McLetchie. As such, I must consider whether MSPs in general would expect this information to be released. While I have no doubt that MSPs would not want information to be released if it were to endanger them in any way, it is important to note that in this case the information held by the SPCB relates to claims for travelling expenses and journeys made at public expense by MSPs. All such journeys must be undertaken as part of MSPs’ Parliamentary duties. I recognise that the Scheme is audited both internally and externally, but FOISA has brought a further expectation that information involving public expenditure should be made publicly available.
56. Having considered these questions, I am not satisfied that the release of the information would endanger Mr McLetchie in any way. As a result, I find that the release of the information would not breach the first data protection principle and that the information is not exempt under section 38(1)(b) of FOISA.
57. In addition, I find that the information is not exempt under section 39(1) of FOISA. Since I have found that the exemption does not apply, I am not required to consider the public interest in relation to section 39(1).
Technical aspects of FOISA
58. I would like to take this opportunity to comment on some of the technical aspects of this case, as the SPCB failed to comply in full with FOISA in dealing with the requests from Mr Hutcheon.
59. As mentioned above, Mr Hutcheon made two separate requests to the SPCB, the first on 10 February 2005 and the second on 3 May 2005. The SPCB failed to respond to Mr Hutcheon’s first request within the 20 working days set down by section 10(1) of FOISA, although the second response was made well within the 20 working days.
60. I am concerned to note that in both of the responses to Mr Hutcheon, the SPCB stated, “the information you requested is supplied with this letter.” While it is true to say that the majority of the information requested by Mr Hutcheon was supplied to him, some of the information supplied was redacted. However, the SPCB did not explain to Mr Hutcheon what information had been withheld or why. In failing to do this, the SPCB failed to comply with section 16(1) of FOISA.
61. Given that information had been redacted, the SPCB should also have advised Mr Hutcheon of his right to ask it to review its decision and of his subsequent right to appeal to me. In failing to do this, the SPCB failed to comply with section 19 of FOISA.
62. However, Mr Hutcheon did ask the SPCB to review its decision in both cases and on both occasions the SPCB carried out a review within the time limits set down by section 21(1) of FOISA. However, I note that at the review stage the SPCB again failed to specify to Mr Hutcheon which exemption(s) it was relying on to redact the information and that it was not until the SPCB submitted comments to my Office that it specified these exemptions.
63. would like to stress that it is important that where information is being withheld from applicants, public authorities specify the exemption which is being relied on to withhold the information. Not only is this a requirement of FOISA, but it will help to increase the understanding of FOISA among applicants.
I note the comment made by the SPCB that my decision will have significant implications for all MSPs and the people with whom they deal in the course of fulfilling their Parliamentary duties.
I wish to underline the fact that in ordering the release of information, I have carefully considered the particular circumstances of this case. It is entirely possible, and indeed likely, that if another request were to be made in relation to an MSP for whom the SPCB demonstrated a specific reason to believe that they would be put at risk that I would find that the information should not be released. Each case must be considered on its own merits.
I find that the SPCB failed to comply with Mr Hutcheon’s requests for information in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA). In failing to release information to Mr Hutcheon, the SPCB has breached section 1(1) of FOISA. The reasons for my findings are fully detailed above.
In terms of section 49(6)(b) of FOISA, I require the SPCB to release to Mr Hutcheon the destination information in Mr McLetchie’s taxi invoices for the following periods:
- May 1999 to March 2000
- April 2000 to March 2001
- April 2001 to March 2002
- April 2002 to March 2003 and
- April 2003 to March 2004.
I cannot require the SPCB to release the information to Mr Hutcheon until the time allowed for an appeal to be made to the Court of Session has elapsed. I therefore require the SPCB to provide the information to Mr Hutcheon within two months of the date of receipt of this decision notice.
I also find that the SPCB failed to comply with the following sections of FOISA in dealing with Mr Hutcheon’s requests, as detailed above:
- Section 10(1)
- Section 16(1) and
- Section 19
However, I do not require the SPCB to take any remedial steps in connection with these technical breaches.
Scottish Information Commissioner
6 October 2005
Link to PDF file of decision 033/2005 (95.9 kb)