Home Decisions

Decision 045/2022

Decision 045/2022: Settlement Agreements

Public authority: Glasgow Housing Association Limited
Case Ref: 202000105

Summary

GHA was asked for the number and value of compromise/settlements agreements between 2009 and 2019. GHA provided some information, but stated that it did not hold pre-2014 information. GHA also withheld two settlement amounts on the basis that they comprised personal data which, in this case was exempt from disclosure.

The Commissioner investigated and found that GHA largely complied with FOISA in responding to the request: by the end of the investigation, GHA had correctly identified all the information falling within the request and the two settlement amounts (2014 onwards) were exempt from disclosure. However, the Commissioner also concluded that additional (pre-2014) information was held by GHA and required GHA to issue another review response in respect of this information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (4) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 3(1)(a)(ii), (2)(b) (Scottish public authorities); 21(4)(b) (Review by Scottish public authority); 17 (Notice that information is not held); 38(1)(b), (2A)(a), (5) (definitions of “the data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR”) and (5A) (Personal information)

The Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019 (the 2019 Order)

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 14 November 2019, the Applicant made a request for information to the Glasgow Housing Association Ltd (GHA) The Applicant requested:

the overall financial value of non-disclosure agreements between 2009 and 2019 and the overall number of such agreements during this period;
the overall financial value of these agreements for each of the years covered throughout this period and the number for each year.

2. GHA is part of the Wheatley Group. The Wheatley Group responded on behalf of GHA on 11 December 2019. (Further references to correspondence with GHA in this decision is a reference to correspondence with the Wheatley Group on GHA’s behalf.) GHA interpreted “non-disclosure agreements” to mean “a specific and separate contract between [it] and [its] employees or former employees that prohibits the sharing of confidential information that has been revealed to them.” GHA said it did not hold this information, as it did not put in place specific non-disclosure agreements with staff or former staff, and section 17 of FOISA therefore applied to the Applicant’s request. To assist the Applicant, GHA advised that all staff were bound by the Wheatley Group’s Data Protection Policy and provided a link.

3. The following day, the Applicant wrote to GHA requesting a review of its decision on the basis that the purpose of his request was “to get the total financial value and number of all Non-Disclosure Agreements (so-called Compromise Agreements) between 2009 and 2019” and the value and the total number of such agreements for each of these years. The Applicant believed that GHA must have copies of these non-disclosure agreements and “at the very least …will have accounts records relating to non disclosure records for the years involved”.

4. GHA notified the Applicant of the outcome of its review on 15 January 2020. The review noted that the Applicant had clarified in his requirement for review that his request was for information on compromise agreements. Therefore, GHA had now interpreted the request to be for information about the financial value of compromise/settlement agreements.

5. GHA explained that compromise agreements (also called “settlement agreements”) differ from non-disclosure agreements: the purpose of compromise agreements is to “regulate the terms of a mutually agreed departure of an employee”. GHA supplied some information to the Applicant on the value of settlement agreements. It also notified the Applicant that it did not hold any information from 2009-13, and that section 17 of FOISA therefore applied as such information would be deleted after five years in accordance with the Wheatley Group’s Employee Relations Retention Schedule .

6. GHA withheld some information that it considered to be personal data and exempt from disclosure in terms of section 38(1)(b) of FOISA. The information withheld was any single payment in the time period, namely the payment made to any GHA housing employee in a year where the person was the only individual to receive a payment under a settlement/compromise agreement. GHA explained why it considered disclosure of such information would breach the data protection principles.

7. On 17 January 2020, the Applicant wrote to the Commissioner. The Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA. The Applicant stated that he was dissatisfied with the outcome of GHA’s review because he was not seeking personal data. He said that he understood that non-disclosure agreements are the same as compromise/settlement agreements, but that GHA said they are different and gave very limited information on so-called compromise agreements. He also alleged that the number and financial values given to him by GHA were inaccurate.

8. On 21 January 2020, the Applicant clarified his grounds of dissatisfaction. He did not believe that GHA did not have copies of non-disclosure agreements on file between 2009 and 2019. He also commented that “non-disclosure/compromise agreements are understood by everyone to be the same material” and GHA “differentiate between them unnecessarily”. He also believed that GHA had given the value of only a small number of non-disclosure/compromise agreements in the years 2009 to 2019 when there were “a lot more on record”. Finally, he said that he had asked for the total financial value of these agreements between 2009 and 2019 and the financial value for each financial year and he believed that information was not personal data.

Is GHA subject to FOISA in this case?

9. The Commissioner firstly considered whether GHA was a Scottish public authority for the purposes of FOISA.

10. Section 5(1) of FOISA provides that the Scottish Ministers (the Ministers) may by order designate certain persons as a Scottish public authority for the purposes of FOISA.

11. Under the 2019 Order (which came into force on 11 November 2019 and is set out in full in the Appendix), the Minsters extended the coverage of FOISA to:

registered social landlords (RSLs) as defined in section 165 of the Housing (Scotland) Act 2010 (the 2010 Act) and
connected bodies under section 164(c) of the 2010 Act

in relation to certain specified functions.

Description

12. GHA is an RSL as defined by section 165 of the 2010 Act (and was at the time of the Applicant’s request). The first part of the definition is therefore fulfilled.

Function

13. In the present application, the Applicant sought information on non-disclosure, or settlement agreements in respect of GHA. In the following, the Commissioner will, for ease, refer to “settlement agreements” – which have a purpose, as described by GHA in its review, to “regulate the terms of a mutually agreed departure of an employee”. Such agreements may contain terms of confidentiality on the parties involved. For example, they may require that neither party to the agreement discloses certain information contained in the agreement.

14. As noted above, the 2019 Order extended the coverage of FOISA to RSLs in relation to certain specified functions. These are:

any activity in relation to the prevention and alleviation of homelessness
any activity in relation to the management of social housing accommodation (i.e. where an RSL has granted a Scottish secure tenancy or short Scottish secure tenancy)
any activity in relation to the provision and management of sites for gypsies and travellers
supplying information to the Scottish Housing Regulator (SHR) in relation to its financial well-being and standards of governance

15. GHA’s review had specified that it held some of the information requested, specifically in relation to the financial value of the compromise/settlement agreements relating to GHA staff fulfilling functions which fall within the scope of the 2019 Order between 2009 and 2019. GHA’s submission to the Commissioner stated that it regarded information pertaining to staff who carry out functions directly relating “to the management of social housing accommodation” for GHA was in scope of the 2019 Order and this formed the basis of the list it provided to the Applicant for the years 2014-19.

16. GHA commented that

…having examined the [2019] Order, the guidance on the Commissioner’s website and from discussions with the Commissioner and his team we regard that information pertaining to staff who carry out functions directly relating “to the management of social housing accommodation” for GHA is in scope of the [2019] Order and this forms the basis of the list we provided to [the Applicant] for the years 2014-9.

17. The Commissioner notes that it follows that the information being withheld would also fall within the terms of the 2019 Order, as that information too would pertain to staff who carry out functions directly relating ‘”to the management of social housing accommodation” for GHA.

18. GHA was asked to explain if it held any recorded information that would fall within the terms of the Applicant’s request but not within the functions designated by the 2019 Order. GHA responded that it did and that it had considered such information:

There were other staff over the period 1 January 2014 to 14th November 2019 (the date of the original request) who received payments under Compromise or Settlement Agreements but we can confirm that their functions were outwith the scope of activity defined in the [2019] Order.

19. The Applicant clearly believes that more information was held than had been disclosed to him. The Commissioner therefore asked GHA for more information about the payments considered to be outwith the scope of the 2019 Order to establish if GHA had correctly identified the relevant information.

20. GHA replied that, in identifying all staff who fell under the designation function, it reviewed everyone across the Group who received such payments, taking account of those whose functions related to GHA, as requested by the Applicant. In particular, it assessed - based on their job titles and role profiles - whether these staff carried out any of the functions in line with the 2019 Order. None carried out activities related to the first, third or fourth factors and only staff involved in “management of social housing accommodation” for GHA were included in the list provided to the Applicant.

21. As noted above, information held by an RSL in relation to the supply of information to the SHR in relation to its financial well-being and standards of governance is also subject to the 2019 Order. GHA was asked if it had considered whether this aspect of the 2019 Order was relevant to the information requested by the Applicant.

22. GHA responded on 18 December 2020. It confirmed that, in its view. the information would not be seen to fall within this category in the 2019 Order.

23. GHA set out its understanding of when settlement agreements were first introduced into SHR guidance as an example of potential notifiable event in June 2019. The SHR guidance requires any such agreement to be notified if they:

seriously affect the interests and safety of tenants, people who are homeless or other service users
threaten the stability, efficient running or viability of service delivery arrangements
put at risk the good governance and financial health of the organisation
bring the RSL into disrepute, or raise public or stakeholder concern about the RSL or the social housing sector

24. The guidance also requires a notifiable event to be “material”, “significant” or “exceptional” and states that what fulfils these criteria will depend on the nature of the event and the particular RSL. The guidance states that “whether an event is ‘material’ or ‘significant’ may depend on factors such as the size or complexity of the RSL; so, each RSL should consider the risk and potential impact on the organisation when deciding whether an issue is a notifiable event.” Notwithstanding the timing of the introduction of this guidance in 2019, GHA submitted that none of the settlement agreements were material, significant or exceptional in the context of the RSL, and explained in more detail its assessment of this with reference to its own organisational structure.

25. As stated above, GHA told the Commissioner that all of the payments across the Wheatley Group had been reviewed, taking account of those whose functions related to GHA, as requested by the Applicant. GHA had assessed the job titles and role profiles to decide if these staff carried out any of the functions in line with the 2019 Order. The staff involved in “management of social housing accommodation” for GHA were included in the list provided to the Applicant.

26. For completeness, the Commissioner asked GHA (on 26 October 2021) to supply him with the number and amounts of any (stated) non-housing services settlement agreements between 20 June 2019 and 14 November 2019. GHA did so.

27. During the investigation, the Commissioner contacted the SHR to obtain its view on this function of the 2019 Order and on the information specifically related to such agreements that the SHR would regard as information supplied to it by an RSL in relation to its financial well-being and standards of governance. In particular, the Commissioner queried whether an RSL is obliged to notify the SHR of any such agreement with any staff member of the registered social landlords, whether notification of such agreements is subject to qualifying criteria and, if so, what these were.

28. The SHR provided a detailed response about the extent of the obligation on RSLs to notify it of severance payments and settlement agreements with staff between 2009 and 2020.

29. The SHR explained that, between 2009 to 2020, the legislation and SHR’s guidance in relation to notifiable events had changed. In 2009, SHR’s Notifiable Events Guidance did not make specific reference to settlement agreements: it only stated that RSLs should notify the SHR about any Employment Tribunal occurrences and outcomes. At that time, the legislation and regulatory requirements under Schedule 7 to the Housing (Scotland) Act 2001 required registered social landlords to have policies and procedures in place to regulate and monitor the Payments & Benefits outlined in the legislation. This included severance agreements (what is now referred to as settlement agreements). There was, however, no requirement to advise the SHR of these.

30. However, the 2010 Housing Scotland Act repealed the Schedule 7 requirements and, thereafter, it was the responsibility of each RSL to put in place policies and procedures to make sure it acted with transparency, honesty and propriety and avoid any public perception of improper conduct. The SHR reviewed its Notifiable Events Guidance in 2012 and 2015, but this did not make specific reference to settlement agreements but did ask that RSLs notify the SHR of employment tribunals and staff restructuring exercises that result in compulsory redundancies. The guidance was again reviewed in 2019 and it was then that it first highlighted settlement or severance agreements as events that RSLs should notify the SHR about. While the SHR stated that, as highlighted in all the versions of the guidance since 2009, the example lists are illustrative not exclusive, it is in the Commissioner’s view a material consideration that such agreements were not included in earlier guidance.

31. While the Commissioner notes that the SHR may now expect a notifiable event to be submitted if a settlement agreement was entered into involving an employee of the RSL, (potentially even one not directly involved in providing a housing service), he is not satisfied that any such information would be covered by the Order prior to the issuing of the 2019 guidance on 20 June 2019. In respect of information following the issuing of that guidance, the Commissioner is satisfied that GHA has sufficiently explained why no additional settlement agreements fall within the scope of the Order.

32. The Commissioner accepts that the information identified by the Wheatley Group/GHA as falling within the terms of the Order does correctly fall within the Order. Having considered the submissions and the SHA guidance in place over the time scales covered by the request for information, the Commissioner accepts that the information identified by GHA is information that relates to the management of social housing accommodation (i.e. where an RSL has granted a Scottish secure tenancy or short Scottish secure tenancy), and in this case is not information that would fall within the provision described as supplying information to the Scottish Housing Regulator (SHR) in relation to its financial well-being and standards of governance. The Commissioner is also satisfied that no information relating to employees of GHA who are not engaged in the provision of Housing Services falls within the scope of the Order in relation to the present application.

33. In all the circumstances, the Commissioner is satisfied (subject to the provisos above) that the information requested by the Applicant falls within the functions specified in the 2019 Order. GHA is, therefore, subject to FOISA in this case.

Validation

34. The application was accepted as valid: the Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

35. On 31 January 2020, GHA was notified in writing that the Applicant had made a valid application. GHA was asked to send the Commissioner the information withheld from the Applicant. GHA provided the information and the case was allocated to an investigating officer.

36. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. GHA was invited to comment on this application and to answer specific questions.

37. Both GHA and the Applicant provided submissions and comments to the Commissioner.

Commissioner’s analysis and findings

38. In coming to a decision on this matter, the Commissioner considered all the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and GHA. He is satisfied that no matter of relevance has been overlooked.

Was all the information falling within the request located?

39. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received, subject to certain qualifications which are not applicable in this case. Under section 17(1) of FOISA, where an authority receives a request for information it does not hold, it must give an applicant notice in writing to that effect.

40. The Applicant’s dissatisfaction, as specified in his application to the Commissioner, was that he believed more information was held by the GHA – and fell within his request – than had been provided to him. The Applicant’s request had described information he had believed was held and that suggested to him that the information he had received was not all the information held by the GHA.

41. There are two points to note here. An applicant may feel that they have not received all the information if some information falling within their request does not fall within the 2019 Order. The applicant themselves may not be aware of this. That point was addressed above. The second point is one more usually encountered in FOISA: the information falls within the request and the authority says it holds no further information but the applicant believes it has not identified all of the information falling within scope. This latter point is covered in the following paragraphs.

42. GHA located information for the period 2014-2019, some of which it disclosed and some it withheld, and notified the Applicant, under section 17 of FOISA, that it did not hold the information requested for 2009-2013. On the basis of the Applicant’s information and dissatisfaction, GHA was asked to explain how it had established what information it held that was covered by the Applicant’s request.

43. GHA told the Commissioner that compromise and settlement agreements are prepared by, and held on its behalf, by its external solicitors. In line with its retention policy for leavers, the solicitors retain file copies of such agreements for five years. GHA searched its Human Resources (HR) network folders, but no information falling within the scope of the request was identified; this was as expected as GHA could access the information from its solicitors. The information in respect of the period 2014-2019 was therefore obtained by GHA from its external solicitors.

44. GHA explained that, to check whether any other information was held, Wheatley Group’s Director of Finance and Director of Financial Reporting were consulted verbally. Finance working files and records are held in line with for six years and therefore there would be no files before 2013/14. Since the data for (calendar) years 2014 to 2019 had already been identified by HR enquiries of GHA’s external solicitors, there was nothing further that could be provided by the Finance Department in relation to 2009-2013. The Director of Financial Reporting verbally explained that, in respect specifically of the period of the 2013/14 financial year covering 1 April 2013 to 31 December 2013 (noting that the request covered calendar years), the information held in the finance system folders did not allow individual payments to be identified.

45. GHA explained that it had carried out further electronic searches on 2 July 2020 using keywords “redundancy” and “ER/VR” (Early Retirement/Voluntary Redundancy) which again demonstrated no data was held for 2009-2013 which could assist with the request beyond that already identified by its HR department. GHA also commented that its HR department operates strict procedures that sensitive personal data relating to payments included in contracts of settlement must not be recorded in diaries, notebooks or mobile applications. Breaching of this is a potential disciplinary offence. The HR staff involved in the request and search exercise confirmed this to be the case in relation to the specific information.

46. In respect of emails, since October 2019, GHA’s email retention period has been six months. No email related data, for example correspondence with the external law firm relating to the information, was available relating to the period before this. Accordingly, no information in relation to agreements from 2009-13 would be available from email searches.

GHA was unable to identify the specific date(s) when any other copies, if these were ever held, were deleted from any other systems.

47. GHA explained that it has always had access to copies of compromise and settlement agreements for the period required by its retention policies, as these are held on its behalf by its solicitors. (Under section 3(2)(b) of FOISA, information is held by an authority for the purposes of FOISA if it is held by a person other than the authority, on behalf the authority.) The data sharing protocol in its legal contract with these solicitors implies they must comply with GHA’s retention policies for each area of work they undertake; whether they have not done this and retained the information beyond five years in this case is a matter for them. If it has not been destroyed, then GHA would in theory still have access to it. However, after five years, the information is no longer held on GHA’s behalf, since it does not require this under its retention policies and contract with the law firm; rather it is held by the law firm for its own purposes.

48. GHA commented that it was aware of no particular legal duty to hold the information, nor was there any internal or external guidance of which GHA was aware on this specific point. Also, the constituent/underlying working papers and supporting data for GHA’s financial accounts more than six years old is destroyed in accordance with its retention policies. Searches of GHA data folders on the network drives confirmed this.

49. GHA was specifically asked by the Commissioner on 26 October 2021 about any recorded information that could be regarded to fall within the request and was held by GHA’s solicitors. The Commissioner referred GHA to The Law Society of Scotland’s guidance on the ownership and destruction of files, which states that documents produced by the solicitor for the client are ordinarily owned by the client. From the types of documents which appear in that guidance, agreements of the type considered in the request would appear to come under that definition. GHA was therefore asked - with reference to the Law Society guidance - to find out from its solicitors whether any pre-2014 agreements still existed.

50. GHA submitted that the guidance issued by the Law Society of Scotland is not prescriptive hence the use of “material ordinarily held by” throughout the document. Each case should therefore be examined with reference to its own individual circumstances. GHA confirmed that external solicitors do retain copies of the settlement/compromise agreements prior to 2014, but do not do so on GHA’s instructions.

51. GHA would submit that the information sought is not held by GHA or by GHA’s solicitors on GHA’s behalf. GHA explained that, as outlined in the Law Society of Scotland guidance, solicitors are data controllers in their own right in respect of the personal data they hold for their clients. In this instance, GHA submitted that there was no requirement for GHA to retain the settlement agreements for its purposes. It did not hold the information in terms of its retention schedules and it no longer required the information for its business use. GHA clarified that its solicitors hold this information for their legitimate purposes to defend themselves against any complaint or legal action against them. Its solicitors also have the option to follow the retention periods outlined in the Law Society of Scotland guidance and make decisions regarding retention of personal data as data controllers in their own right. Consequently, the solicitors, both now and at the time of the initial request for information, do not
hold this information on GHA’s behalf but for their own purposes.

The Commissioner’s view

52. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining this, the Commissioner will consider the scope, quality, thoroughness and results of the searches carried out by the public authority. He will also consider, where appropriate, any reason offered by the public authority to explain why the information is not held.

53. Having considered all the relevant submissions, Commissioner is satisfied that, by the end of the investigation, GHA had taken adequate and proportionate steps to locate the information which fell within the scope of the Applicant’s request. In reaching this conclusion, the Commissioner has taken into account the following:

the information falling within the request is held by GHA in a way that is specific, identifiable and searchable.
the actual searches undertaken by GHA to assess the information it held seem to be reasonable and proportionate and likely to identify relevant information
GHA’s searches also took account of the person (external solicitors) who held relevant information on GHA’s behalf.
staff involved in searching for the information had experience and knowledge of the subject, reducing the likelihood of searches being faulty or relevant information being overlooked
there is a degree of sensitivity in the information requested and there would be likelihood that such information would be confined to certain areas of the organisation (for example solicitors or HR departments).
the retention protocols evidenced by GHA indicated that there was no requirement to retain some of the information requested beyond a certain timescale.
GHA also identified relevant information falling within the request showing that their methodology was capable of locating the requested information. The searches carried out by GHA successfully located information which fell within this request, showing that the searches were capable of locating and retrieving relevant information.

54. As noted above, GHA also confirmed, during the investigation, that pre-2014 information still existed. GHA argued that it did not hold this information for the purposes of FOISA.

55. The Commissioner is not convinced by the arguments provided by GHA that its solicitors hold the information on their own behalf and not on behalf of GHA. Whilst it may be accepted that the solicitors will hold such information for data protection purposes (and as data controllers) and also for their own purposes, that does not mean the information cannot also be held on behalf of GHA.

56. The Commissioner does not consider that GHA has evidenced or sufficiently explained why the information would be regarded as held solely by the solicitors on their own behalf, rather as stipulated within section 3(2)(b) of FOISA, as information which is held by a person (i.e. the solicitors) other than the authority (i.e. GHA), on behalf of the authority.

57. The Law Society guidance on who (i.e. client/solicitor) owns files suggests that such information could be said to be held by the client.

58. As the Court of Session made clear in the case of Graham v Scottish Information Commissioner , the words and expressions used in FOISA should, so far as possible, be given their ordinary and natural meaning: there should be no scope for the introduction of technicalities or unnecessary legal concepts calculated to over-complicate matters which would have the effect of restricting the disclosure of information. That is as true of the words “holds” and “held” in sections 1 and 3 of FOISA as it is of other expressions in FOISA.

59. The Court of Session made it clear in Graham that, provided an authority had a material interest in the information, the information would be held by the authority. Given the type of information involved (a settlement agreement entered into by GHA), it cannot be said that GHA does not have an interest in the information. Even if the solicitors have a direct interest in this information, that would not alter the position. GHA would still have its own interest, since the agreements relate to GHA. There have been no arguments or evidence supplied that would deprive GHA of all interest in holding the relevant information.

60. In this case, it is also relevant to consider the general principles of the solicitor-client relationship. Should the client (GHA) wish the information for its own purposes, it would be difficult to imagine that its solicitors would refuse to supply that information to the client.

61. The Commissioner is therefore satisfied, on the balance of probabilities, that GHA identified all the information which falls within the scope of the Applicant’s request. He cannot accept, however, that GHA was correct to notify the Applicant, with respect to information held dating prior to 2014, that it did not hold the information.

62. As GHA has not had an opportunity to consider whether this information can be disclosed, the Commissioner requires GHA to issue a revised review response to the Applicant (other than in terms of section 17 of FOISA) in respect of this information in line with section 21(4)(b) of FOISA.

Section 38(1)(b) - Personal information

63. The Commissioner will consider whether the post-2014 agreements are exempt from disclosure under section 38(1)(b) of FOISA.

64. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.

65. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

66. To rely on the exemption in section 38(1)(b) of FOISA, GHA must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Article 5(1) of the UK GDPR.

67. GHA’s submission to the Commissioner showed that it had withheld information pertaining to staff who carry out functions directly relating ‘to the management of social housing accommodation’ for GHA in the form of sums in the list it provided to the Applicant for the years 2014-19.

Is the withheld information personal data?

68. The first question the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 - see Appendix 1. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR, also set out in Appendix 1.)

69. In his submissions to the Commissioner, the Applicant argued that the information withheld was not personal data.

70. In the case of Breyer v Bundesrepublik Deutschland the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified. When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is insignificant, the information will not be personal data.

71. GHA was asked to explain why there was a realistic prospect that individuals could be identified as a result of disclosure and to provide examples of this.

72. GHA withheld the amount paid to an individual under an agreement where the individual was the only person in that year to have received such a payment. Two sums were withheld. GHA believed the amounts paid in a particular year would identify an individual. GHA believed that the data subjects can be identified from the information withheld as if the Applicant (or indeed any other person) knew of an individual who had signed a settlement/compromise agreement in that financial year or had left the organisation, and then this put together with the withheld information, and would identify the sum of money paid to the data subject.

73. GHA submitted that

…there is a very realistic causal chain to identify the data subjects in such circumstances. Housing is a specialised area and made up of a small professional community. Employees in this area would be aware that a member of staff had left the organisation and potentially the existence of a settlement/compromise agreement. There is a realistic prospect that they could identify the amount paid as a result of settlement/compromise agreement.

74. The Commissioner must consider whether, if the sums were disclosed into the public domain, which is the effect of a disclosure under FOISA, third parties (including the Applicant) would be able to identify persons from the numbers and from other information in the public domain.

75. The Commissioner acknowledges that the information relates to small numbers – one data subject in a specified year - but small numbers in and of themselves do not automatically equate to personal data and each case has to be considered separately.

76. In this case, there are a number of factors which further stratify the small population. Each instance is in a single specified year. It relates to persons who have been employed by the relevant organisation and who then – for whatever reason – ceased their employment with that organisation, again within a narrow timeframe. As detailed above, the employment role is further stratified by the scope of the 2019 Order – only if an individual has a specific role within the organisation would the information fall within the scope of this request. There is therefore a relatively small and identifiable population. The Commissioner therefore agrees with GHA that there would be a realistic causal chain which would lead to the identification of the data subjects.

77. Where the number of persons is relatively small, this increases the potential for third parties, such as other fellow employees, friends, family members, other employers, contractors, etc to know where an individual has been employed and when they have ceased that employment. Given the size of the population, the timespan and the specific circumstances of this case, the Commissioner is satisfied that there is a realistic possibility of individuals being identified from disclosure of the information in question.

78. However, information that could identify individuals will only be personal data if it relates to those individuals. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

79. In this case, the Commissioner is satisfied that the information does relate to the data subjects – the personal data would confirm that the individuals had received a specific sum of money by settlement agreement.

80. The Commissioner is therefore satisfied that the withheld information is personal data as defined in section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles?

81. GHA has argued that disclosure of this data would breach Article 5(1)(a) of the UK GDPR, which requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject".

82. The definition of "processing" is wide and includes "disclosure by transmission, dissemination or otherwise making available" (section 3(4)(d) of the DPA 2018). In the case of FOISA, personal data are processed when disclosed in response to a request: as noted above, disclosure under FOISA is deemed to be disclosure into the public domain and not only to the Applicant.

83. Personal data can only be processed if disclosure would be both lawful (i.e. if it would meet one or more of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.

84. The Commissioner will first consider whether any of the conditions in Article 6(1) can be met. Generally, when considering whether personal data can lawfully be disclosed under FOISA, only condition (f) (legitimate interests) is likely to be relevant.

Condition (f): legitimate interests

85. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data …"

86. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

87. The tests which must be met before Article 6(1)(f) can be met are as follows:

Does the Applicant have a legitimate interest in obtaining the personal data?
If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

88. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of the Applicant must outweigh the rights and freedoms or legitimate interests of the data subjects before condition (f) will permit the data to be disclosed. If the two are evenly balanced, the Commissioner must find that GHA was correct to refuse to disclose the personal data to the Applicant.

89. The Commissioner will first consider whether the Applicant has a legitimate interest in obtaining the personal data.

90. GHA acknowledged that the Applicant had a legitimate interest in the information.

91. The Commissioner understands that the Applicant believes that there is an important public interest in scrutiny of the amounts paid in such agreements. Disclosure of the figures would allow him, and the public, to assess the value of such agreements. The Applicant has alleged that certain amounts were the subject of agreements. He also alleged that such agreements had the purpose of preventing allegations being voiced and preventing wrongdoing being exposed. It must be noted that GHA strongly refutes these allegations.

92. Having considered the background to the request, the Commissioner finds that the Applicant does have a legitimate interest in the personal data about settlement agreements. The Commissioner acknowledges that the Applicant, and the wider public, has a legitimate interest in scrutiny of the number and amounts in such agreements. In the circumstances, the Commissioner is satisfied that the Applicant has (and the wider public would have) a legitimate interest in obtaining the personal data. While the Commissioner cannot and will not comment on whether the Applicant's concerns are merited or evidenced, he is satisfied that there is a legitimate interest in the disclosure of the information.

93. Having accepted that the Applicant has a legitimate interest, the Commissioner must consider whether disclosure of the personal data is necessary to meet those legitimate interests.

94. Here, "necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the legitimate interests can be met by means which interfere less with the privacy of the data subjects.

95. The Commissioner must therefore consider whether the Applicant's legitimate interests might be reasonably be met by any alternative means and in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 551 . In this case, the Supreme Court stated (at paragraph 27):

A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.

96. GHA submitted that, in accordance with its review finding, the Applicant’s legitimate interest can be met by means which interfere less with the privacy of the data subjects, namely by way of the release of the overall number of GHA housing staff who have received settlement/compromise agreements between 2014 and 2019. GHA disclosed a total sum to the Applicant; GHA also disclosed the yearly total values of the agreements where there was more than one individual; GHA also told the Applicant the number of agreements in the 2014-19 period. The Commissioner recognises that this goes some way towards satisfying the Applicant's legitimate interests.

97. In the circumstances, the Commissioner accepts that disclosure of the remaining information is necessary to meet the Applicant's legitimate interests. The remaining information is of a type that has already been supplied to the Applicant. The information would provide the Applicant and the wider public with detail that the information already supplied would not.

98. The Commissioner can identify no viable means of meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subject than disclosing this withheld information.

99. The Commissioner will now consider whether the Applicant's legitimate interest in obtaining the remaining information outweighs the rights of the data subject to privacy.

The data subjects' interests or fundamental rights and freedoms

100. It is necessary to balance the legitimate interests in disclosure against the data subjects’ interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subject would not reasonably expect that the information would be disclosed to the public under FOISA in response to a request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override the legitimate interests in disclosure. Only if the legitimate interests of the Applicant outweigh those of the data subject/s can the information be disclosed without breaching the first data protection principle.

101. The Commissioner's guidance on section 38 of FOISA notes factors that should be taken into account in balancing the interests of parties. He notes that Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects. These are some of the factors public authorities should consider:

(i) Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?

(ii) Would the disclosure cause harm or distress?

(iii) Whether the individual has objected to the disclosure.

102. GHA submitted that the sum paid is of an economic nature which relates to the individual. There is an expectation of confidentiality expressly written into any agreement and the data subjects would have no expectation that the amount paid to them would be revealed publicly. GHA also added that disclosure of the personal data would be an unwarranted intrusion of the data subjects' privacy. Further to this, the information relates to the individuals' private life, namely a payment made in settlement of a private matter, and this deserves more protection than information about their public life. Disclosing information about the data subject's private life would cause them distress especially as they had no expectation that this type of information, contained within a confidential agreement, would be made available to the world at large.

103. In considering the balance between the legitimate interests and the rights and interests of the data subjects, it is important to take account of whether the proposed disclosure would be within the reasonable expectations of the individuals. In doing so, there are factors that assist determining the expectations of an individual in respect of their personal data. These include the distinction between private and public life; the nature of the information; how the personal data were obtained; whether any specific assurances were given to the individuals; Privacy notices; and any policy or standard practice of the authority.

Does the information relate to public or private life?

104. Disclosure under FOISA is public disclosure; information disclosed under FOISA is effectively placed into the public domain.

105. The Commissioner acknowledges that the withheld information in this case relates more to the individuals' private lives than public lives, in that it comprises information of settlement of their employment contract, albeit with an organisation that has public responsibilities. Although there are no absolute rules in this regard, generally, information which relates to an individual's private life (i.e. their home, family, social life or finances) will deserve greater protection than information about the individual acting in an official or work capacity (i.e. their public life).

Would disclosure cause harm or distress to the data subject and has the individual objected to the disclosure?

106. The Commissioner has also considered the harm or distress that might be caused by disclosure.

107. GHA is correct to say that the information is of an economic nature that relates to the individual and that there is an expectation of confidentiality of this information expressly written into a settlement/compromise agreement and the data subjects would have no expectation that the amount paid to them would be revealed to the world at large.

108. In the Commissioner's view, there was an existing expectation of non-disclosure of the specific sum given an individual would receive.

Balance of legitimate interests

109. After carefully balancing the legitimate interests of the data subjects (those receiving payments) against those of the Applicant (and the wider public), the Commissioner finds that the balance of legitimate interests falls in favour of the data subjects.

110. The Commissioner accepts, given the sum is part of a confidential agreement, that the individuals would have had no expectation that their personal data would be disclosed. The Commissioner concludes that, in these circumstances, disclosure would have a detrimental effect on the data subjects. The linking of a sum paid to a specific person, without any explanations, may result in detriment to that person.

111. The Commissioner has also considered the fact that the sum is part of a legal agreement between GHA and an individual employee. Those involved would not have an expectation that the personal data would be disclosed.

112. The Commissioner has balanced this with the Applicant’s legitimate interest in seeking accountability and transparency. The Commissioner notes that GHA has disclosed total sums and numbers. The Commissioner also notes that there appear to be sufficient procedures in place to ensure adequate scrutiny of the sums. He does not find that disclosure of the personal data in question would be required in order to be satisfied on this point. The Applicant’s interest in accountability for sums, and in particular to assess the amount paid and whether it is in the broadest sense reasonable, is a legitimate interest and weight must be given to that interest.

113. Having carefully balancing the legitimate interests of the individuals concerned against those of the Applicant (and the wider public), the Commissioner finds that the legitimate interests served by disclosure of the withheld personal data are outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subjects. Condition (f) in Article 6(1) of the GDPR cannot, therefore, be met in relation to the withheld personal data.

114. In the absence of a condition in Article 6 of the GDPR allowing the personal data to be disclosed, the Commissioner has concluded that disclosing the information would be unlawful. Given the requirement for the processing to be both fair and lawful for the data protection principle if Article 5(1)(a) to be met, the Commissioner must find that the personal is exempt from disclosure under section 38(1)(b) of FOISA

Comments from the Commissioner (not part of the decision notice)

115. The Commissioner invited GHA to comment on whether a requester should be informed in any refusal notice of recorded information that is held by the RSL and which falls within the terms of the request, but that is not covered by a designation function and therefore does not fall within the terms of the 2019 Order.

116. GHA replied that in such cases it would be beneficial to advise requesters, who may not otherwise be aware of the technical details of the scope of the 2019 Order, of the functions it covers. Responses should make clear the information provided relates to these functions only. This will assist requesters to understand the exact scope of the information covered and may help to ensure any future requests take this into account.

117. GHA also said:

We have considered whether a further explanatory statement could be provided in cases where some or all of the information requested is held, but since it does not relate to the functions in the [2019] Order it has not been disclosed. Our view is that this would not add any significant benefit to either applicant or RSL, provided the scope of the information provided is made clear, i.e. explicit reference is made back to the functions set out in the [2019] Order.

118. The Commissioner agrees with GHA on this point. Cases will require to be studied on a case by case basis and there may be instances where it is not reasonable to require an RSL to explain to a requester exactly why information falls outside the 2019 Order. However, in a case like the above, it would likely assist a requester to be aware of this aspect of their request and the RSL’s response.

Decision

The Commissioner finds that the Glasgow Housing Association Ltd (GHA) largely complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.

He is satisfied that, by the end of the investigation, GHA correctly identified all of the information falling within the request and that the information from 2014 onwards is exempt from disclosure under section 38(1)(b) of FOISA.

However, the Commissioner does not agree that the pre-2014 information is not held by GHA for the purposes of FOISA. Accordingly, GHA was not entitled to notify the Applicant, under section 17(1) of FOISA, that it did not hold pre-2014 information. The Commissioner therefore requires GHA to issue a further review response to the Applicant in respect of the pre-2104 information other than in terms of section 17(1) of FOISA by 31 May 2022.

Appeal

Should either the Applicant or GHA wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If GHA fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that GHA has failed to comply. The Court has the right to inquire into the matter and may deal with GHA as if it had committed a contempt of court.

Daren Fitzhenry
Scottish Information Commissioner
14 April 2022

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(4) The information to be given by the authority is that held by it at the time the request is received, except that, subject to subsection (5), any amendment or deletion which would have been made, regardless of the receipt of the request, between that time and the time it gives the information may be made before the information is given.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –

…

(e) in subsection (1) of section 38 –

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

3 Scottish public authorities

(1) In this Act, “Scottish public authority” means-

(a) any body which, any other person who, or the holder of any office which-

…

(ii) is designated by order under section 5(1); or

…

(2) For the purposes of this Act but subject to subsection (4), information is held by an authority if it is held-

…

(b) by a person other than the authority, on behalf of the authority.

…

17 Notice that information is not held

(1) Where-

(a) a Scottish public authority receives a request which would require it either-

(i) to comply with section 1(1); or

(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),

if it held the information to which the request relates; but

(b) the authority does not hold that information,

it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.

…

21 Review by Scottish public authority

…

(4) The authority may, as respects the request for information to which the requirement relates -

…

(b) substitute for any such decision a different decision …

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

…

(5) In this section-

"the data protection principles" means the principles set out in –

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

…

“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

The Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019

1 Citation, commencement and interpretation

(1) This Order may be cited as the Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019 and comes into force on 11 November 2010.

(2) In this Order, “the 2010 Act” means the Housing (Scotland) Act 2010.

2 Extension of coverage of the Freedom of Information (Scotland) Act 2002

The persons described in column 1 of the table in the schedule of this Order are designated under section 5(2)(a) of the Freedom of Information (Scotland) Act 2002 as a Scottish public authority in relation to the functions specified in column 2 of that table.

Schedule

Description of persons

A registered social landlord as defined in section 165 of the 2010 Act and a connected body under section 164(c) of that Act.

Function

Any activity in relation to housing services as defined in section 154 of the 2010 Act, subject to the following –

(a) paragraph (b) is limited to the management of housing accommodation for which a registered social landlord has, under the Housing (Scotland) Act 2001, granted a Scottish secure tenancy as defined in section 11 or a short Scottish secure tenancy as defined in section 34 of that Act, and

(b) omit paragraph (c).

The supply of information to the Scottish Housing Regulator by a registered social landlord or a connected body in relation to its financial well-being and standards of governance.

UK General Data Protection Regulation

4 Definitions

For the purposes of this Regulation:

(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

…

5 Principles relating to processing of personal data

1 Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

…

6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –

…

(d) disclosure by transmission, dissemination or otherwise making available,

…

(5) “Data subject” means the identified or identifiable living individual to whom personal data relates.

(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).

…