Decision 052/2021: Course applications: BA in Photography
Public authority: City of Glasgow College
Case Ref: 202001354
Summary
The College was asked about applications received for its BA in Photography course for the academic year beginning 2020. The College supplied some information, but withheld the numbers of students from Ayrshire College who had received an unconditional place, a reserve place or no place. This information was, in the view of the College, personal data and, in this case, exempt from disclosure.
The Commissioner investigated. He found that the numbers were personal data and exempt from disclosure.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2A)(a), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 7 September 2020, the Applicant made a request for information to the City of Glasgow College (the College). The Applicant asked:
- how many applications were received for the BA in Photography at the College for the academic year beginning 2020 (part 1)
- how many applications for the BA in Photography at the College, beginning 2020, were received from students who had completed the HND in Photography at Ayrshire College (part 2)
- of the applicants from the HND Photography course at Ayrshire College, how many were offered unconditional places, reserve places or neither an unconditional or reserve place (part 3)
2. The College responded on 5 October 2020. It supplied the numbers for parts 1 and 2 of the request. The College refused to disclose any information for part 3 as it considered the information to be personal data which, in this case, was exempt from disclosure under section 38(1)(b) of FOISA.
3. The Applicant wrote to the College on 9 October 2020, requesting a review of its decision. He disagreed that the information was exempt from disclosure and explained why.
4. The College notified the Applicant of the outcome of its review on 3 November 2020. It confirmed its original response, but explained in more detail why it considered the exemption applied.
5. On 13 November 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant stated he was dissatisfied with the outcome of the College's review. He did not think the exemption applied as he could not see how individuals could be identified. He also referred to, and provided details on, an alleged wrongdoing he believed had occurred and why the requested information was relevant to addressing that alleged wrongdoing.
Investigation
6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
7. On 23 November 2020, the College was notified in writing that the Applicant had made a valid application. The College was asked to send the Commissioner the information withheld from the Applicant. The College provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The College was invited to comment on this application and to answer specific questions. These related to whether the information withheld was personal data and why it had been withheld.
Commissioner's analysis and findings
9. In coming to a decision on this matter, the Commissioner considered all the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the College. He is satisfied that no matter of relevance has been overlooked.
Section 38(1)(b) - Personal information
10. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
11. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
12. To rely on the exemption in section 38(1)(b) of FOISA, the College must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Article 5(1) of the UK GDPR.
Is the withheld information personal data?
13. The first question the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 - see Appendix 1. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR, also set out in Appendix 1.)
14. In part 3 of his request, the Applicant sought a breakdown of the number of applicants from Ayrshire College who had applied to a specific photography course. He asked for three numbers, i.e. how many applicants had been offered unconditional, reserve, or neither an unconditional or reserve place. The College had disclosed the total in response to part 2 of the Applicant's request, so the Applicant knows that the three numbers total seven. In his submissions to the Commissioner, the Applicant argued that the numbers were not personal data as individuals were not identifiable.
15. In the case of Breyer v Bundesrepublik Deutschland[1] the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified. When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is insignificant, the information will not be personal data.
16. The College was asked to explain why there was a realistic prospect that individuals could be identified as a result of disclosure and to provide examples of this. The College submitted that, given that the numbers relate to a very small population of students, there is a realistic prospect of someone being identified. The College also commented that, in the circumstances of this case, the Applicant may be very likely to know the other individuals. The College gave an example of how a person could, by asking other students, work out who had received certain offers. From the numbers involved, this could allow the Applicant to determine which (if any) offer others had received. The College believed there was a causal chain that could lead to the identification of a person or persons, and there was a significant risk of this occurring if the numbers were disclosed.
17. The College also referred to "current practice in the public sector when disclosing data which included reference to small numbers of individuals" and gave two examples of other named Scottish public authorities that had withheld a number less than five.
18. The Commissioner must consider whether, if the numbers were disclosed into the public domain, third parties (including the Applicant) would be able to identify persons from the numbers and from other information in the public domain. In his decision, the Commissioner must be careful not to disclose the withheld information in his reasoning. This restriction limits the level of detail he can give to justify his conclusion. (This factor has been acknowledged by the courts. In the case of Scottish Ministers v Scottish Information Commissioner (William Alexander's Application) [2007] CSIH 8[2], the Court of Session commented that, in giving reasons, the Commissioner is necessarily restrained by the need to avoid disclosing information which ought not to be disclosed.)
19. The Commissioner acknowledges the point made by the College that the information relates to small numbers, but small numbers in and of themselves do not automatically equate to personal data and each case has to be considered separately.
20. In this case, there are a number of factors which further stratify the small population. It is a single course, at a named college, in a specified year, and for particular persons who previously studied another specific course, at another named college with candidates possibly known to each other. There are therefore three relatively small and identifiable populations: those accepted to the course at the College in the particular year; those accepted to the course at the College in the particular year who had studied at Ayrshire College; and those who had studied a relevant course at Ayrshire College.
21. Where the number of persons is relatively small, this increases the potential for third parties, such as other fellow students, tutors, college staff, friends, family members, etc to know what an individual has studied and thereby increase the likelihood of identification. Given the size of the population, the timespan and the specific circumstances of this case, the Commissioner is satisfied that there is a realistic possibility of individuals being identified from disclosure of the information in question.
22. However, information that could identify individuals will only be personal data if it relates to those individuals. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus. In this case, the Commissioner is satisfied that the information does relate to the data subjects - the personal data would confirm that the individuals had each completed an HND in Photography at Ayrshire College and, in 2020, had each applied to study for a BA in Photography at the (City of Glasgow) College.
23. The Commissioner is therefore satisfied that the withheld information is personal data as defined in section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
24. The College has argued that disclosure of this data would breach Article 5(1)(a) of the UK GDPR, which requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject".
25. The definition of "processing" is wide and includes "disclosure by transmission, dissemination or otherwise making available" (section 3(4)(d) of the DPA 2018). In the case of FOISA, personal data are processed when disclosed in response to a request: disclosure under FOISA is deemed to be disclosure into the public domain and not only to the Applicant.
26. Personal data can only be processed if disclosure would be both lawful (i.e. if it would meet one or more of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
27. The Commissioner will first consider whether any of the conditions in Article 6(1) can be met. Generally, when considering whether personal data can lawfully be disclosed under FOISA, only condition (f) (legitimate interests) is likely to be relevant.
Condition (f): legitimate interests
28. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data …"
29. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
30. The tests which must be met before Article 6(1)(f) can be met are as follows:
- Does the Applicant have a legitimate interest in obtaining the personal data?
- If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
- Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
31. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of the Applicant must outweigh the rights and freedoms or legitimate interests of the data subjects before condition (f) will permit the data to be disclosed. If the two are evenly balanced, the Commissioner must find that the College was correct to refuse to disclose the personal data to the Applicant.
32. The Commissioner will first consider whether the Applicant has a legitimate interest in obtaining the answers to part 3 of his request.
33. The Applicant has voiced concerns about aspects of the processing of his application for this course. However, the College submitted that the Applicant did not have a legitimate interest in the disclosure of the third parties' personal data. The College commented that the Applicant's concerns were based on speculation and supposition without any evidence or substance.
34. Having considered the background to the request, the Commissioner finds that the Applicant does have a legitimate interest in the data about candidates from the HND Photography course at Ayrshire College and a breakdown of the places offered, or not. While his interest may be personal, the concerns raised by the Applicant relate to the selection to the course, a matter likely to be of interest to others more generally (for example, potential students). While the Commissioner cannot and will not comment on whether the Applicant's concerns are merited or evidenced, he is satisfied that there is a legitimate interest in the disclosure of the information.
35. Having accepted that the Applicant has a legitimate interest, the Commissioner must consider whether disclosure of the personal data is necessary to meet those legitimate interests.
36. Here, "necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the legitimate interests can be met by means which interfere less with the privacy of the data subjects.
37. The Commissioner must therefore consider whether the Applicant's legitimate interests might be reasonably be met by any alternative means and in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 551[3]. In this case, the Supreme Court stated (at paragraph 27):
A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.
38. The Commissioner asked the College to explain the options an unsuccessful candidate had to challenge the outcome of their application to a course, and to the BA course in particular. The College was also asked about the selection criteria for this course and, in particular, whether this selection criteria was known to the candidates.
39. The College told the Commissioner that, if a candidate is unsuccessful but considers they have valid grounds for appealing against the outcome of a selection decision, they can write to the College explaining fully the reasons for the appeal. An offer may be reviewed by the College in light of additional information, which was not available at the time of selection. The College explained in detail the circumstances as they related to the Applicant, and the Commissioner sees no need to repeat these here - except to note that the Applicant appears to have been aware of this and related rights.
40. For the selection criteria for the course, the College explained that successful completion of an HND Photography course (level 8) and presentation of a portfolio for interview is required. The College elaborated on the requirements and the process for selecting from the candidates. It noted, for example, that Portfolio guidelines are provided online[4] to support applicants in putting together a portfolio for interview
41. A person can use such a process without access to the information the Applicant has requested.
42. The Commissioner cannot see why the information which the Applicant has requested would be necessary to progress his concern about his application for a place in this course: it is clear that the appeal process can be used without the information the Applicant asked for in part 3 of his request.
43. The specific information at issue does not, as far as the Commissioner can discern, add to or subtract from (or indeed have relevance to) the Applicant's concern. The legitimate interests of the Applicant are largely satisfied by the appeal procedures that are in place (which do not require him to know the numbers). Condition (f) in Article 6(1) of the UK GDPR cannot, therefore, be met in relation to the withheld personal data.
44. Consequently, the Commissioner does not consider it necessary for the third personal data to be disclosed in order to satisfy the legitimate interests identified.
45. The Commissioner must therefore conclude that condition (f) in Article 6(1) of the UK GDPR cannot be met in relation to the withheld personal data. In the absence of any other conditions allowing disclosure, disclosure would therefore be unlawful.
Fairness and transparency
46. Given the Commissioner's finding that processing would be unlawful, he is not required to go on to consider separately whether disclosure of the personal data would otherwise be fair or transparent in relation to the data subjects.
47. The Commissioner finds that disclosure of the information covered by part 3 of the request would contravene Article 5(1)(a) of the UK GDPR. The information is therefore exempt from disclosure under section 38(1)(b) of FOISA.
Decision
The Commissioner finds that the City of Glasgow College complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or the College wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
22 April 2021
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -
(a) the provision does not confer absolute exemption; and
…
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -
…
(e) in subsection (1) of section 38 -
…
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.
38 Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);
…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles, or
…
(5) In this section-
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
…
"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);
"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).
(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
UK General Data Protection Regulation
4 Definitions
For the purposes of this Regulation:
(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
…
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency");
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.
(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
