Decision 034/2023: Portrait of Bonnie Prince Charlie
Authority: The Board of Trustees for the National Galleries of Scotland
Case Ref: 202100935 and 202201004
Summary
The Applicant asked the Authority for information relating to the portrait of Bonnie Prince Charlie, claimed to have been painted by Allan Ramsay.
The Authority disclosed some information, initially withholding the remainder on the grounds that it either comprised personal data, or that its disclosure would prejudice the effective conduct of public affairs.
The Commissioner investigated and found that the Authority had partially breached FOISA in responding to the request. While the Commissioner found that the Authority had correctly withheld some information, he found that it had failed to identify all relevant information and that it had wrongly withheld some information under the exemptions claimed.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1) and 2(e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of ”personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing);
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 10 December 2020, the Applicant made a request for information to the Authority. She asked for any information that related to the portrait of Prince Charles Edward Stuart by Allan Ramsay, generated or received by the Authority between 1 September and 10 December 2020.
2. The Authority responded on 13 April 2021. It apologised for the delay in responding and provided the Applicant with redacted copies of information that fell within the scope of the request. The Authority notified the Applicant that it was withholding information under sections 30(b) and (c) and 38(1)(b) of FOISA.
3. On 19 April 2021, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that she was dissatisfied with the decision because she was not satisfied that the Authority had identified all of the information it held and which fell within the scope of her request. Furthermore, the Applicant did not agree that the exemptions applied to the withheld information and argued that the Authority had not properly considered the public interest test.
4. The Authority notified the Applicant of the outcome of its review on 18 May 2021. It upheld the application of section 38(1)(b) of FOISA, but it withdrew its previous reliance on section 30(b)(i) and 30(c) of FOISA. The Authority advised the applicant that it was still relying on section 30(b)(ii) of FOISA to withhold some information, also withheld under section 38(1)(b) of FOISA. The Authority provided the Applicant with a new set of documents, reflecting its change of view.
5. On 1 August 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated she was dissatisfied with the outcome of the Authority’s review because she did not agree that the exemptions applied and she considered that the public interest test favoured disclosure. On 11 September 2022, the Applicant wrote to the Commissioner again, with a further application. This time the Applicant questioned whether the Authority had identified all of the information captured by her request and asked the Commissioner to investigate if further information was held (while reiterating her arguments in relation to the information withheld).
Investigation
6. The Commissioner determined that the applications of 1 August 2021 and 11 September 2022 both complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 30 August 2021, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer. The Authority was notified about the Applicant’s second application on 12 September 2022, and that case was allocated to the same investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to its decision to apply exemptions to some of the information it disclosed, as well as its interpretation of the scope of the request and the searches it had conducted.
Commissioner’s analysis and findings
9. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
10. As noted above, in this case the Applicant made two applications to the Commissioner; the first application focused on the withheld information, and the second application focused on the searches carried out by the Authority, and whether it had identified all of the information held and falling within the scope of the request.
11. As both applications relate to the same information request, the outcome of both investigations will be covered in this decision notice.
Information held by the Authority
12. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which are not applicable in this case.
13. The information to be given is that held by the authority at the time the request is received, as defined in section 1(4). This is not necessarily to be equated with the information an applicant believes an authority should hold. If no relevant information is held by the authority, section 17(1) of FOISA requires the authority to give the applicant notice to that effect.
14. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner’s role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
15. In its original response to the Applicant, the Authority identified 50 documents falling within the scope of her request.
16. The Applicant noted that some of the emails she had obtained, as part of these 50 documents, made reference to, or clearly followed on from, other correspondence that had not been provided. She argued that further information must be held, and she asked the Commissioner to investigate this point.
17. The Commissioner contacted the Authority and raised questions about its interpretation of scope of the request and the searches it had undertaken. In particular, the Commissioner noted that the Applicant had asked for information that relates “in any way” to the portrait, and he indicated that some information that the Authority had indicated to be out of scope of the request was arguably within scope. The Commissioner asked the Authority to carry out further searches, broadening the search terms used and expanding the scope of the request to include correspondence that made oblique or implied references to the portrait.
18. The Authority was also asked to reconsider some of the information it had withheld under section 38(1)(b) of FOISA. It was noted that this information included the names of the Trustees, as well as journalists with public profiles.
19. The Authority carried out new searches and identified a further 69 documents, six of which it deemed to be entirely out of scope of the request. Of the remaining 63 documents, the vast majority were disclosed to the Applicant with limited redactions. The Authority redacted information that was out of scope of the request, along with personal data which it withheld under section 38(1)(b) of FOISA. The Authority also redacted information from document 17 under section 30(c) of FOISA.
20. The Authority also reconsidered some of the information it had previously withheld under section 38(1)(b) of FOISA, such as the names of the Trustees, and it disclosed this information to the Applicant.
21. The Authority provided the Commissioner with details of the searches it carried out, along with the search terms used and copies of the information that was identified.
Commissioner’s findings
22. On the basis of information disclosed, and all relevant submissions and the terms of the request, the Commissioner is satisfied that, by the end of the investigation, the Authority had taken adequate, proportionate steps in the circumstances to establish whether it held any further information that fell within the scope of the request.
23. However, it is apparent from the significant amount of information identified and disclosed during the investigation that it did not achieve this in dealing with the Applicant’s request or requirement for review. Furthermore, the Commissioner notes that the Authority wrongly applied the exemption contained in section 38(1)(b) of FOISA to information which was later disclosed.
24. Given this, the Commissioner must find that the Authority failed to comply with section 1(1) of FOISA, in responding to the request, as it failed to identify all of the information captured by the information request, and it also withheld information that it later disclosed.
25. The Commissioner is satisfied that the second set of searches described by the Authority would have been capable of identifying any further information relevant to the request. The Commissioner is therefore satisfied, on the balance of probabilities, that the Authority does not (and did not, on receipt of the request) hold any further information falling within the scope of the request.
Information to be considered in this decision
26. As indicated above, in its review outcome, the Authority provided the Applicant with a set of 50 documents on 2 August 2021 (the August documents). On 19 December 2022, it identified a further 69 documents (two of these documents were withheld in their entirety under section 38(1)(b) of FOISA, and six documents were wholly withheld as being completely out of scope of the request) and disclosed 61 of these documents to the Applicant. These will be referred to as the December documents.
27. The Authority has withheld information from the Applicant on the grounds that it is either exempt from disclosure under section 30(b)(ii), 30(c) or 38(1)(b) of FOISA, or does not fall within the scope of the Applicant’s information request.
28. The Applicant was asked to specify any areas of outstanding dissatisfaction with the August and December documents disclosed by the Authority. In response, the Applicant asked the Commissioner to reconsider the redactions that the Authority had made to documents 3, 4, 5, 7, 10, 24, 25, 26, 31, 32, 34, 35, 36 and 37 of the August documents, with a view to determining if the withheld information could be disclosed.
29. She also asked the Commissioner to reconsider the redactions made to documents 17, 39, 40, 50, 51, 52, 58 and 59 of the December documents, with a view to determining if any of that information could be disclosed.
30. The documents listed above in paragraphs 28 and 29, are the only documents that the Applicant has asked the Commissioner to examine, and therefore the redactions to these documents comprise the only information that he will consider in this decision.
Out of scope information
31. The Authority has made redactions to some of the August documents (24, 25, 26, 31, 32 and 37) and some of the December documents (40, 52, 58 and 59) on the grounds that the information is out of scope of the information request.
32. The Commissioner has reconsidered the redactions in the August and December documents, along with the terms of the Applicant’s information request, and he is satisfied that all of the information redacted from the August documents as being outwith the scope of the request, has been correctly withheld.
33. He notes that much of the information withheld in these documents does not relate to the portrait at all, but discusses a forthcoming exhibition on a completely different artist. Other information contains routine pleasantries and personal comments on issues not related to the portrait. The Commissioner is satisfied that none of this information falls within the scope of the Applicant’s request.
34. The Commissioner will now go on to consider the information that the Authority is withholding under section 38(1)(b) and 30(c) of FOISA.
Section 30(c) of FOISA – Prejudice to effective conduct of public affairs
35. The Authority is withholding the entirety of document 17 (December documents) under section 30(c) of FOISA.
36. Section 30(c) of FOISA provides that information is exempt information if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs. This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
37. The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b). This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
38. There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers the harm in question would require to be of real and demonstrable significance. An authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur: therefore, an authority needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.
39. The Authority explained that document 17 is being withheld in full as it is a draft email that was drawn up by an employee as a potential reply to articles in the Sunday Times. The Authority notes that the employee did not share this email with colleagues for comments, he simply emailed the draft to himself. The Authority submitted that this draft email represented the personal and frank views of an employee, which were not shared publicly, and they did not reflect the views or thinking of the Authority itself.
40. The Authority noted that, at that time, it had agreed not to comment publicly on the Sunday Times articles and this draft email was not representative of the Authority’s views. Given this, the Authority argued that disclosure of this email would prejudice the effective conduct of public affairs as it would inhibit staff from putting their ideas down in writing for fear they may be made public, when they are still in draft form. The Authority argued that employees were already being more reticent about recording their views for fear they may be disclosed under FOISA, and it believed the disclosure of document 17 would increase their fears. The Authority argued that, if employees routinely failed to record useful or important information, it would impact on its ability to carry out its functions, which would, or would be likely to, prejudice the effective conduct of public affairs.
41. The Applicant referred to previous submissions she had made in which she challenged the withholding of information. She maintained that the Authority was not entitled to withhold the email that the employee had sent to himself. The Applicant questioned the actions of the employee who had drafted the email, alleging improper conduct on their behalf, and reiterating her interest in the contents of the email.
The Commissioner's view on section 30(c)
42. Having considered the nature and content of the withheld information, together with the Authority’s submissions and the comments made by the Applicant, the Commissioner accepts that disclosure of the withheld information would, or would be likely to, cause substantial prejudice to the effective conduct of public affairs. He is satisfied that the Authority’s official approach to the Sunday Times articles was to remain silent, and disclosure of this draft email, which had not been circulated internally for discussion, might reasonably be expected to cause reputational harm to the Authority, by linking it with the employee’s personal views.
43. The Commissioner acknowledges that the email was drafted by an Authority employee as part of their day to day duties, but the significant factor is that the email remained in draft form and was not circulated to anybody else. The Authority subsequently took the view that there was no need for an official rebuttal to the claims in the Sunday Times articles and the draft email remained unsent, in its original form.
44. The Authority has argued, and the Commissioner accepts, that if it was minded to publish a response to the newspaper articles, it would have reviewed and amended the draft email in-house before issuing a formal response. Document 17 cannot be viewed as a finalised document that represents the official views of the Authority; it remains a draft email containing the personal views of the employee, which was not intended for public consumption in that form. The Commissioner acknowledges that employees must be able to draft documents without fear that unfinished, partially complete documents, containing untested or unapproved views, will be disclosed into the public domain.
45. Authorities and their employees must generally be entitled to some form of private space to develop and assess views and policy positions, without unformed early ideas being exposed to public scrutiny. In this case, the Commissioner is of the view that disclosure of document 17 would, or would be likely to, stifle internal discussion and debate and this would be detrimental to the Authority’s ability to respond to arising issues and develop informed policy positions.
46. The Commissioner is satisfied that the document 17 does not represent the finalised views of the Authority, nor does it set out the Authority’s official arguments or policy positions. It is clearly an individual’s initial attempt to draft a response to the issues raised by the newspaper articles, but this email was never circulated, nor was it utilised by the Authority in any way. Given this, the Commissioner is satisfied that disclosure of the information would, or would be likely to, prejudice the effective conduct of public affairs and that the Authority is entitled to apply the exemption in section 30(c) of FOISA to this information.
Public interest test - section 30(c)
47. As mentioned above, the exemption in section 30(c) is subject to the public interest test in section 2(1)(b) of FOISA. The Commissioner must therefore go on to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by that in maintaining the exemption.
48. The public interest is not defined in FOISA, but has been described in previous decisions as "something which is of serious concern and benefit to the public", not merely something of individual interest. It has also been held that the public interest does not mean "of interest to the public" but "in the interests of the public", i.e. disclosure must serve the interests of the public.
Submissions from the Authority
49. The Authority reiterated that it was in the public interest for staff to have space to think through how they might respond to controversial topics which were playing out in public, without the possibility of their initial ideas being made public when they had not been fully considered.
50. The Authority noted that, while the information contained in document 17 did not constitute the provision of advice or an exchange of views as per the exemptions at s30(b)(i) and (ii) of FOISA, it considered disclosure of this information would lead to even greater inhibition and would, in turn, have an even more substantially prejudicial effect on its ability to operate as effectively as possible. The Authority contended that this could not be in the public interest, even if it would be of interest to the public.
Submissions from the Applicant
51. The Applicant provided a lot of background information regarding the circumstances under which the Authority purchased the portrait. The Applicant also noted that, in 2009, the Authority conceded that a portrait it had purchased as a likeness of Prince Charles Edward in 1994 was, in fact, of his brother. The Applicant submitted that the expert who upheld the Authority’s view in relation to that portrait purchased in 1994 had also questioned the provenance of the portrait of Prince Charles Edward in this case. She noted that the current portrait cost the taxpayer £2,000,000.
52. The Applicant explained that she made her FOI request following publication of the Sunday Times articles, which cast doubt on the provenance of the painting, as an attempt to establish how the Authority dealt internally with the new opinions and evidence presented in the articles, and whether it had consulted any Ramsay experts following the articles.
53. The Applicant noted that the matter had received wide press coverage and she argued that disclosure was likely to contribute to a debate on a matter of public interest.
54. The Applicant also argued that disclosure may also contribute to ensuring effective oversight of expenditure of public funds and public obtaining value for money.
Commissioner’s consideration of the public interest test
55. The Commissioner notes the Applicant’s motivation in seeking to understand the steps that the Authority took to confirm provenance of the portrait, obtained at great public expense. There is undoubtedly a public interest in the provenance of the portrait, and there are clearly differing opinions as to who was the artist responsible. These opinions have been set out in the media and, given the public funds used to purchase the portrait, the issue itself is clearly one of significant public interest.
56. However, the public interest in the disclosure of the withheld information (the draft email) must be balanced against the public interest in withholding it. The Commissioner has reviewed the text of document 17, and he is not satisfied that there is anything in the content of that email that would meet the public interest set out by the Applicant. As explained above, the email is a draft response to the Sunday Times articles, which was never circulated or discussed internally and was never published. It does not reflect the views of the Authority and it was clearly never intended to be disclosed in its current form. The Commissioner accepts that the employee who drafted the email would have expected their draft to be amended and annotated internally before a final version would be published. Document 17 is in no way a finalised document which sets out the Authority’s official view, and he cannot see the public interest in its disclosure.
57. On balance, therefore, the Commissioner is of the view that the public interest in withholding the information (and maintaining the exemption) outweighs the public interest in disclosing it.
58. The Commissioner therefore finds that the authority was entitled to withhold the information under section 30(c) of FOISA.
59. As the Commissioner has deemed all of the information in document 17 to have been correctly withheld under section 30(c) of FOISA, he will not go on to consider the application of section 38(1)(b) to this same information.
Section 38(1)(b) – Personal information
60. Section 38(1)(b), read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data”, as defined in section 3(2) of the DPA 2018 and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the GDPR.
61. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
62. In order to rely on this exemption, the Authority must show that the information being withheld is personal data for the purposes of the DPA 2018 and that its disclosure into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the GDPR.
63. In this case, the Applicant is challenging the Authority’s reliance on section 38(1)(b) of FOISA to withhold personal data. In particular, she has asked the Commissioner to investigate the Authority’s decision to withhold information contained in documents 3, 4, 5, 7, 10, 34, 35 and 36 of the August documents, and 39, 50, 51, 52 and 59 of the December documents, under section 38(1)(b) of FOISA. During the investigation, the Applicant stated that she was not seeking third party contact details and so these will not form part of the Commissioner’s consideration.
Is the withheld information personal data?
64. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018. (The definition of “personal data” is set out in full in Appendix 1.)
65. The two main elements of personal data are that:
(i) the information must “relate to” a living person; and
(ii) the living individual must be identifiable.
66. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
67. An “identifiable living individual” is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).
68. The Commissioner is satisfied that the information being withheld under section 38(1)(b) is personal data: it comprises the names and/or personal opinions or descriptions of living individuals and, as such, it is information that clearly relates to those individuals.
Would disclosure contravene one of the data protection principles?
69. The Authority argued that disclosure would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Article 5(1)(a) states that personal data shall be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
70. "Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
71. The Commissioner must consider whether disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
72. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.
Condition (f) – legitimate interests
73. Condition (f) states that processing shall be lawful if it is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
74. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
75. The three tests which must be met before Article 6(1)(f) can be met are as follows:
(i) Does the Applicant have a legitimate interest in the personal data?
(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data?
76. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of the Applicant must outweigh the rights and freedoms or legitimate interests of the data subjects before condition (f) will permit the data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Authority was correct to refuse to disclose the personal data to the Applicant.
Does the Applicant have a legitimate interest?
77. The Authority argued that the Applicant did not have a legitimate interest in the personal data. It noted that the Applicant’s request was for information relating “in any way” to the portrait. Given this, the Authority explained that it considered that what was "necessary" for the Applicant’s purposes was information relating to the portrait itself.
78. The Authority submitted that it did not consider that the identities of the individuals asking about or discussing the portrait or candid personal opinions expressed about newspaper articles were necessary to allow the Applicant to understand what discussion took place. The Authority argued that the redacted personal information did not form part of its deliberations about the portrait.
79. In her submissions, the Applicant noted that she made her information request as an attempt to establish how the Authority dealt internally with new opinions and evidence about the provenance of the portrait, and whether it had consulted any Ramsay experts following the newspaper articles which cast doubt on whether Ramsay had painted the portrait. The Applicant argued that disclosure of the information could contribute to ensuring the effective oversight of expenditure of public funds. The Applicant commented that the matter has received wide press coverage and disclosure is also likely to contribute to a debate on a matter of public interest.
80. The Commissioner agrees that, in the circumstances, the Applicant has a legitimate interest in the personal data. The Commissioner notes that the portrait was purchased for a considerable sum of public money. He considers there is a wider interest in understanding the decision-making processes of the Authority, and any discussions it held internally and externally in relation to the provenance of the portrait.
Is disclosure necessary to achieve that legitimate interest?
81. The Commissioner will now consider whether disclosure of the personal data requested is necessary for the Applicant’s identified legitimate interest. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
82. The Commissioner has considered this carefully in light of the decision of the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.
83. Here, “necessary” means “reasonably” rather than absolutely or strictly necessary. The Commissioner must, therefore, consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the data subjects.
84. The Commissioner must bear in mind that, if the information the Applicant has requested is disclosed in response to a FOISA request, it is, in effect, disclosed into the public domain.
85. The Authority did not believe disclosure was necessary to achieve the Applicant’s legitimate interest. It did not accept that disclosure of the redacted information was necessary in order to enable the Applicant to understand what discussions took place concerning the portrait which was the subject matter of her request. The Authority submitted that disclosure was unlawful for the purposes of the UK GDPR, purely because it was unnecessary.
86. The Applicant noted that the Authority stated the information should be withheld because it comprised personal subjective opinions. However, she argued that all opinions, including professional ones, are, by definition, subjective and personal. The Applicant submitted that the Authority did not explain what constitutes a personal opinion, and that all the evidence indicated that the opinions were not personal data. She noted that the Authority accepted that the opinions were within scope of the request.
87. The Applicant commented that there is no dispute the opinions were expressed on a professional curatorial subject, by a curator and a fellow professional, made during working hours, and using an Authority business email account. She contended that none of the emails were marked personal or confidential.
88. The Commissioner notes the Applicant’s reasons for believing the Authority should disclose the information, and he accepts that the Applicant has a legitimate interest in understanding which individuals took part in discussions about the portrait, as well as knowing the nature of those discussions or comments. The Commissioner can identify no other viable means of meeting the Applicant’s legitimate interests than providing the withheld information. In all the circumstances, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of the Applicant’s legitimate interests.
Balancing the legitimate interests of the Applicant and the legitimate interests or fundamental rights and freedoms of the data subjects
89. Having found that disclosure is necessary for the purposes of the Applicant’s legitimate interests, the Commissioner must now balance the legitimate interests in disclosure against the individuals’ interests or fundamental rights and freedoms.
90. The Commissioner’s guidance on section 38 of FOISA lists certain factors that should be taken into account in balancing the interests of the parties. He makes it clear that, in line with Recital (47) of the General Data Protection Regulation, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
(i) Does the information relate to an individual’s public life (their work as a public official or employee) or their private life (their home, family, social life or finances)?
(ii) Would disclosure cause harm or distress?
(iii) Whether the individual has objected to the disclosure.
91. As noted above, disclosure under FOISA is public disclosure; information disclosed under FOISA is effectively placed into the public domain.
92. The Commissioner acknowledges that the emails were sent or received by Authority employees and that they relate to the work of that Authority. On balance, then, the Commissioner is satisfied that the withheld information relates to the public lives of the employees, in that it identifies them as employees of the Authority discussing matters that are relevant to the work of that Authority. However, he notes that the information withheld under section 38(1)(b) of FOISA also comprises emails from or comments relating to third parties, who are not Authority employees, and whose interests are personal rather than work-related.
93. In the circumstances, the Commissioner concludes that the withheld information relates to both the private and public lives of the data subjects.
94. The Commissioner has also considered the harm or distress that might be caused by disclosure of the personal data.
95. The Authority has argued that there is generally accepted to be a power imbalance between employer and employee, and that it would not, therefore, be lawful to base disclosure of the personal opinions of employees on consent. With regard to whether the Authority otherwise had a basis for disclosure, it argued that it had a strong legitimate interest in protecting its employees from unintended consequences while acting in the interests of the Authority and the national collection, and it would be unfair to expose their private views publicly.
96. The Authority submitted that it does not have consent to disclose the frank opinions shared by third parties, and it considered, as with employees, it would be unfair to expose private views publicly in circumstances where they would not have any expectation of that happening.
97. The Commissioner accepts the Authority’s point that disclosure would cause some harm to the data subjects and that neither employees nor third parties would have had any reasonable expectation that their personal views would be made public in this way. He also considers the third parties would have no reasonable expectation of their names being disclosed in response to a request under FOISA.
98. In relation to document 39, the Authority submitted that it wrote to the author of this email (the data subject) to advise them that it now considered the email to fall within the scope of the request. In response, the data subject expressed concerns about the disclosure of this email and asked the Authority to withhold all of their emails in full. The Authority subsequently withheld document 39, but provided the Applicant with the dates and the name of the Authority recipient of the email.
99. The Commissioner notes that the data subject who wrote the email in document 39 is not an employee of the Authority, and therefore can bear no responsibility for the decision-making processes or actions of the Authority. The Commissioner also notes that their contact with the Authority was voluntary and not compelled. It is clear that the data subject has asked for their email not to be disclosed and the Commissioner must take that into account in considering that individual’s rights, freedoms or legitimate interests.
100. During the investigation, the Applicant provided the Commissioner with an email from one of the third party data subjects, giving consent to the processing of his personal data. However, this consent had not been given to the Authority at the time it received the information request, and so the Commissioner cannot take it into account when making his decision on the withheld information.
101. After carefully balancing the legitimate interests of all of the data subjects against those of the Applicant (and the wider public), the Commissioner finds that the balance of legitimate interests falls in favour of the data subjects.
102. Consequently, the Commissioner finds that the Authority has correctly withheld personal information in documents 3, 4, 5, 7, 10, 34, 35 and 36 of the August documents, and 39, 40, 50, 51, 52 and 59 of the December documents.
103. As the Commissioner has deemed all of the information in document 10 to have been correctly withheld under section 38(1)(b) of FOISA, he will not go on to consider the application of section 30(b)(ii) to this same information.
Decision
The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner finds that by correctly withholding information under section 38(1)(b) and 30(c) of FOISA, the Authority complied with Part 1.
However, by failing to identify all of the information falling within the scope of the request, and by wrongly withholding some information under section 38(1)(b) of FOISA, the Authority failed to comply with Part 1 (specifically section 1(1)).
Given that the Authority disclosed information to the Applicant during his investigation, the Commissioner does not require the Authority to take any action in respect of these failures in response to the Applicant’s application.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
26 April 2023
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –
…
(e) in subsection (1) of section 38 –
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
30 Prejudice to effective conduct of public affairs
Information is exempt information if its disclosure under this Act-
…
(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
…
(5) In this section-
"the data protection principles" means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
…
UK General Data Protection Regulation
Article 4 Definitions
For the purpose of this Regulation:
1 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
…
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
…
