FOI - The Scottish Information Commissioner in action
Robert Henderson
for data on Chris Brand
Chris Brand is a psychologist who held a tenured position at Edinburgh
University (EU) until 1997 when his tenure was put aside and he was
dismissed from his post.
In 2008 I made a request to EU for all data they had relating to Mr
Brand and asked that particular attention should be given to data
relating to his dismissal.
EU supplied a small amount of material, some of which had names and
other identifying data redacted. I went through their internal review
system appealing against the redacted material and asking them to
recheck their records because it seemed inconceivable that what they had
supplied could be all that remained of a case which involved a quasi
legal process and attracted a good deal of public attention. I got a
small amount of additional material but no movement on the redaction.
I then appealed to the Scottish Information Commissioner (SIC) asking
for the redacted material to be released to me and to test EU's claim
that they had supplied all of the data relating to Mr Brand. The SIC
has refused the appeal - see his Decision Notice below this note.
The prime document which was redacted was a public petition got up in
and around the EU calling for Mr Brand's dismissal. The names of those
on the petition probably included members of EU staff, people who may
have been directly involved in the quasi-legal process which resulted in
Mr Brand's dismissal or whose position within the university was such
that their influence might be reasonably assumed to have had an effect
on the process. In addition, it is possible that the petition contained
(1) the names of those who have publicly portrayed themselves as
defenders of academic freedom and (2) politicians. Such people would be
embarrassed by disclosure and in the case of politicians, might well
have influenced the path the university took.
The case has a general interest for FOIA users because the redacted
material was removed because of claims that it would breach the Data
Protection Act (DPA). Conflict between the DPA and the FOIA is arguably
the most fraught technical issue met with by FOI requesters, so the
comments and reasoning on this issue of the SCI are of general interest
in this case.
Although the SCI has rejected the appeal, he has struggled desperately
to find grounds for doing so on both the issues at stake: the redaction
of names and the paucity of the material supplied.
With regard to the redaction, he allows that there is a strong public
interest and is reduced to arguing that because the data was created
before the FOIA existed, there could have been no expectation by those
whose names and addresses have been withheld that the data would have
been made public, viz:
Para 38 "Whatever expectations might be in respect of the submission of
such a petition today, it appears clear to the Commissioner that in 1996
or 1997, well before Freedom of Information legislation was even in
contemplation, the petitioners and correspondent(s) involved in this
matter would have had no reasonable expectation that their personal
data, as contained in the petition and correspondence under
consideration here, would be disclosed into the public domain.
Consequently, the Commissioner would regard disclosure in response to Mr
Henderson's request as wholly contrary to their legitimate interests and
expectations."
This strikes me as a pernicious argument for withholding data because it
would potentially cover the vast majority of data which might be asked
for under the FOIA.
I also find the idea that a public petition should not be available for
scrutiny by the public to check its validity absurd. Of what use is such
a petition if it cannot be verified by public examination?
As for the paucity of material supplied, the SCI has simply accepted the
word of the university. It beggars belief that data relating to a
quasi-legal case would simply have been destroyed routinely. The fact
that the university's word has been accepted without question shows a
very great weakness in the way the FOIA is administered in Scotland, for
any data holder can potentially get rid of an awkward request by saying
data was destroyed. Robert Henderson
Scottish Information
Our Ref 200801777/JW
Commissioner
Your Ref
RECORDED DELIVERY
Mr Robert Henderson
156 Levita House
Chalton Street
London
NW1 1HR
4 June 2009
Dear Mr Henderson
SCOTTISH INFORMATION COMMISSIONER DECISION 06412009
PUBLIC AUTHORITY: UNIVERSITY OF EDINBURGH
I refer to your previous correspondence with Jill Walker in connection
with your application to me for a decision regarding the way in which
the University of Edinburgh dealt with your request for information
relating to the termination of a named individual’s tenure by the
University. I am writing to let you know that I have decided that the
University of Edinburgh complied fully with Part I of the Freedom of
Information (Scotland) Act 2002 (FOISA) in dealing with your request for
information.
A copy of my Decision Notice is enclosed with this letter, but in
summary I found that the University of Edinburgh was correct to withhold
the information in respect of the names, addresses and matriculation
numbers of students who signed a petition as well as information which
was redacted from handwritten letters and a typewritten note. I was
satisfied that the University of Edinburgh was correct in its
application of the exemption in section 38(1)(b) (read in conjunction
with section 38(2)(b)) of FOISA for withholding this information from
you.
I was also satisfied that the University of Edinburgh carried out
thorough and adequate searches to determine whether it held any other
relevant information in relation to your request, other than that which
had been located and provided to you, and that it was correct to provide
you with a notice under section 17(1) of FOISA. As a result I do not
require the University of Edinburgh to take any action or provide you
with the information that was withheld from you under section 38(1)(b).
Whilst this outcome may be disappointing for you, I hope you will see
from my Decision Notice that your application has been considered
carefully. If you want to contest my findings, you have a right to
appeal to the Court of Session on a point of law only. Any such appeal
must be made within 42 days of the date of intimation (i.e. date of
posting) of this letter.
A copy of the enclosed Decision Notice will be made available on my
website after 5 working days. Please contact Pauline Keith, Validation
Officer on 01334 464610 to acknowledge receipt of the decision notice.
Yours sincerely
Kevin Dunion
Scottish Information Commissioner
Kevin Dunion OBE, Scottish information Commissioner
Kinburn Castle, Doubledykes Road, St Andrews KY I 6 9DS
T: 0 I 334 464610 F: 01334 4646 I I
E: enquiries©itspubiicknowledge.info
W: itspubhcknowIedge.nfo Home > Applications and Decisions > Decisions
> 2009 > Decision 064/2009
Decision 064/2009 Mr Robert Henderson and the University of Edinburgh
Termination of an individual's tenure
Reference No: 200801777
Decision Date: 3 June 2009
Summary
Mr Henderson requested from the University of Edinburgh (the University)
information relating to the termination of a named individual's tenure
by the University. The University provided Mr Henderson with certain
information and with explanations of certain matters.It also relied on
the exemption in section 38(1)(b) of FOISA for withholding other
information from him. Following a review, Mr Henderson remained
dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the University
of Edinburgh had dealt with Mr Henderson's request for information in
accordance with Part 1 of FOISA by relying on section 38(1)(b) for
withholding certain information He was satisfied that the University had
provided Mr Henderson with all the information it held in response to
his request.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and 6
(General entitlement); 2 (Effect of exemptions); 17 (Notice that
information is not held); 38(1)(b) and 2 (b) (Personal information).
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative
provisions); section 33A(1); Schedules 1 (The data protection
principles: the first principle) and 2 (Conditions relevant for purposes
of the first principle: processing of any personal data - condition 6).
The full text of each of the statutory provisions cited above is
reproduced in the Appendix to this decision. The Appendix forms part of
this decision.
Background
1.On 3 September 2008, Mr Henderson wrote to the University seeking
information relating to the termination of the tenure of a specified
lecturer in 1997.The University provided him with information in
response, some of it subject to redaction.On 4 October 2008, Mr
Henderson wrote to the University again, asking for clarification as to
why an Anti Nazi League petition was kept by the University among the
information considered to fall within the scope of his request. In
addition to a number of other questions on this point, he asked on what
grounds the petition signatories' details had been deleted, and also on
what grounds details of the senders of specified hand written letters to
Professor Sutherland and a typewritten message had been deleted.
2.The University responded on 13 October 2008.In its response, the
University provided comments on certain points Mr Henderson had
raised.It also explained that it was relying on the exemption in section
38(1)(b) of FOISA for withholding the petition signatories' details, and
those of the senders of the letters and typewritten message he had
identified. The University explained to Mr Henderson that it was of the
view that release of this information in response to his request would
breach the first data protection principle.It apologised for not
providing its explanation of its use of the exemption in its initial
response to his request.
3.Mr Henderson wrote to the University on 20 October 2008 requesting a
review of its decision. In particular, Mr Henderson drew the
University's attention to his view that the Data Protection Act could
not protect the details of the signatories to the petition, arguing that
a petition which is raised publicly is by definition not confidential.
Mr Henderson also indicated that as the Information Commissioner had
ruled that any senior public servant should be identified in response to
requests where the information was relevant to the request (as he
believed to be the case here), he did not agree that the individual's
details which were redacted from the letters and typewritten message
should be exempt.Within his request for a review, Mr Henderson also
highlighted his surprise at the quantity of information which had been
supplied to him, as had expected more information would have been found
relating to certain specified events and individuals. He sought an
explanation for the absence of such information, requesting in respect
of any further relevant information held by the University that it
either be provided to him or that he be notified of the exemption(s)
under which it was being withheld. .
4.The University notified Mr Henderson of the outcome of its review on
17 November 2008. The University upheld its decision to rely on section
38(1)(b) of FOISA for withholding the details of the signatories to the
petition, together with those of the senders of the letters and
typewritten note.In responding to Mr Henderson's query regarding the
apparent lack of information provided, the University advised that it
had undertaken a further search of its record holdings, including files
that had already been checked and areas Mr Henderson had mentioned in
his review request, including areas not directly related to the
specified lecturer or his case.It identified and provided further
relevant information, some of it subject to redaction under sections
38(1)(b) and 39(1) of FOISA.
5.On 2 December 2008, Mr Henderson wrote to the Commissioner's Office,
stating that he was dissatisfied with the outcome of the University's
review and applying to the Commissioner for a decision in terms of
section 47(1) of FOISA.
6.The application was validated by establishing that Mr Henderson had
made a request for information to a Scottish public authority and had
applied to the Commissioner for a decision only after asking the
authority to review its response to that request.
Investigation
7.On 8 January 2009, the University was notified in writing that an
application had been received from Mr Henderson and asked to provide the
Commissioner with any information withheld from the applicant. The
University responded with the information requested and the case was
then allocated to an investigating officer.
8.The investigating officer subsequently contacted the University, on 28
January 2009, giving it an opportunity to provide comments on the
application (as required by section 49(3)(a) of FOISA) and asking it to
respond to specific questions. In particular, the University was asked
to justify its reliance on any provisions of FOISA it considered
applicable to the information requested, with particular reference to
section 38(1)(b).The University was also asked to comment on Mr
Henderson's concern that further relevant information should be held by
it.
9.A full response was received from the University on 18 February
2009.Further correspondence followed in respect of the information
falling within the scope of Mr Henderson's request and the searches
conducted to locate it.Submissions were also obtained from Mr
Henderson.The arguments of both parties will be considered in the
Commissioner's analysis and findings below.
Commissioner's analysis and findings
10.In coming to a decision on this matter, the Commissioner has
considered all of the withheld information and the submissions made to
him by both Mr Henderson and the University and is satisfied that no
matter of relevance has been overlooked.
Section 38(1)(b) – Personal information
11.As mentioned above, the University has relied on the exemption in
section 38(1)(b) of FOISA, read in conjunction with section 38(2)(b),
for withholding the information redacted from the petition, letters and
typewritten note.The information to which the University had applied
section 39(1) of FOISA did not fall within the scope of Mr Henderson's
application.In making its submissions to the Commissioner, the
University has provided combined submissions for its reliance on section
38(1)(b) for the redacted information in all of these documents. The
Commissioner will therefore consider all of this information together.
12.The exemption in section 38(1)(b) (read with section 38(2)(a)(i) or,
as appropriate, section 38(2)(b)) of FOISA exempts personal data from
disclosure, if the disclosure of the information otherwise than under
FOISA would contravene any of the data protection principles contained
in the Data Protection Act 1998 (the DPA). This particular exemption is
an absolute exemption in that it is not subject to the public interest
test set down in section 2(1)(b) of FOISA.
13.In order to rely on this exemption, therefore, the University must
show firstly that the information being withheld is personal data for
the purposes of the DPA, and secondly that disclosure of the information
into the public domain (which is the effect of a disclosure under FOISA)
would contravene one or more of the data protection principles to be
found in Schedule 1 to the DPA.
14.In considering the application of the exemption, the Commissioner
will therefore first consider whether the information which has been
withheld is personal data as defined in section 1(1) of the DPA.
Is the information personal data?
15.Section 1(1) of the DPA defines personal data as data which relate to
a living individual who can be identified (a) from those data or (b)
from those data and other information which is in the possession of, or
likely to come into the possession of, the data controller (the full
definition is set out in the Appendix).
16.Firstly, the applicant has raised a point which requires the
Commissioner to consider whether the withheld information can be
considered "data" for the purposes of the DPA. He has indicated that he
believes the DPA to require that data be held in a "qualifying filing
system", and questioned whether any of the withheld information was held
in such a system.
17.The Commissioner acknowledges that information recorded in a relevant
filing system is one of the categories of information which qualifies as
"data" in terms of section 1(1) of the DPA, by virtue of paragraph (c)
of that definition.He also acknowledges that the definition of a
"relevant filing system" (also to be found in section 1(1)) is a
restrictive one, into which the withheld information would be unlikely
to fall under normal circumstances. Equally, it would be unlikely to
fall within any of the other categorise of data listed in paragraphs
(a), (b) or (d) of the definition.There is, however, a final category of
data, inserted by the Freedom of Information Act 2000 as paragraph (e)
("category 'e' data"). This is recorded information held by a public
authority and not falling within any of the other paragraphs. The
definition of "public authority" includes a Scottish public authority as
defined by FOISA.
18.Having considered the withheld information, the Commissioner is
satisfied that it is recorded information held by a Scottish public
authority (the University) and therefore that it qualifies as "data" for
the purposes of the DPA.
19.Ordinarily category 'e' data would not be covered by all of the eight
data protection principles, because of the terms of section 33A(1) of
the DPA.However, section 38(2)(b) of FOISA allows the exemptions in
section 33A(1) to be disregarded for the purposes of the section
38(1)(b) exemption, with the result that category 'e' data can be exempt
if it is personal data and its disclosure would contravene any of the
data protection principles.The Commissioner will now go on to consider
whether the withheld information is personal data.
20.In its submissions to the Commissioner, the University has argued
that the withheld information is sufficient to identify certain
individuals and that applying the criteria in the Information
Commissioner's Data Protection Technical Guidance Determining What is
Personal Data (the Technical Guidance)
(http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_
specialist_guides/personal_data_flowchart_v1_with_preface001.pdf, at
page 7 onwards), the information relates to those individuals.
21.The information redacted from the petition comprises the names,
addresses and matriculation numbers of the students who signed the
petition.The information redacted from the handwritten letters comprises
the name, address and qualifications of the writer, while the name,
address and qualifications of the recipient (not the sender, as
indicated in correspondence between Mr Henderson and the University)
have been redacted from the typewritten note.
22.Having considered the information which has been withheld, the
Commissioner is satisfied that living individuals (i.e. those who signed
the petition, the writer of the letters and the recipient of the note)
can be identified from it.In reaching this conclusion, he has been
mindful of the reference in the Technical Guidance (at pages 6 and 7) to
Recital 26 of the European Data Protection Directive (Directive
95/46/EC, which the DPA implements in the United Kingdom), which states
that consideration of whether a person is identifiable from data should
take account of "all means likely reasonably to be used either by the
controller [in this case, the University] or by any other person to
identify the said person". In the Technical Guidance, the Information
Commissioner takes the view that this should lead to consideration not
just of "the means reasonably likely to be used by the ordinary man in
the street, but also the means that are likely to be used by a
determined person with a particular reason to want to identify
individuals". While noting that (as the University admits) more than 10
years have passed since the University received the information, the
Commissioner accepts the University's contention that it would still be
at least a starting point for locating the individuals concerned (who
are likely still to be living) and that it would not be beyond the
resources reasonably available to a determined person (the Information
Commissioner gives as examples "investigative journalists, estranged
partners, stalkers, or industrial spies") to use the information
successfully for this purpose.
23.Having concluded that the individuals in question could be identified
from the withheld information, the Commissioner is also satisfied that
the information relates to those individuals and therefore is their
personal data as defined in section 1(1) of the DPA: It clearly focuses
on them and is biographical of them in a significant sense.
24.The fact that information is personal data is not enough, however, to
make it exempt from disclosure under section 38(1)(b) of FOISA. For the
exemption in section 38(1)(b) (read in conjunction with section
38(2)(b)) to apply, the Commissioner must be satisfied that disclosure
would breach one or more of the data protection principles contained in
the Data Protection Act.The University has argued that disclosure of the
information would breach the first data protection principle, by being
both unfair and unlawful.
Would disclosure breach the first data protection principle?
25.The first data protection principle requires personal data to be
processed fairly and lawfully.It also states that personal data shall
not be processed unless at least one of the conditions in Schedule 2 (of
the DPA) is met, and, in the case of sensitive personal data, at least
one of the conditions in Schedule 3 (again, of the DPA) is also met.
26.The conditions in Schedule 3 are very restrictive and it therefore
makes sense, before going on to consider whether the conditions in
Schedule 2 of the DPA would permit the information to be disclosed, to
look at whether the information falls into the definition of sensitive
personal data.The Commissioner has considered the categories of
sensitive personal data set out in section 2 of the DPA, but does not
consider the withheld information to fall into any of them.Therefore, he
is satisfied that it is not sensitive personal data.As a result, he need
only consider whether any of the conditions in Schedule 2 can be met,
along with (as required) any wider considerations of fairness and
lawfulness.
27.Part II of Schedule 1 to the DPA provides assistance in defining
"fairness" for the purposes of the first data protection principle.As
Lord Hope notes in the case of Common Services Agency v Scottish
Information Commissioner 2008 SLT 901 (the Collie judgement) "fairness"
is concerned essentially with the method by which data is obtained, and
in particular with whether the person from whom the data were obtained
was deceived or misled as to the purpose or purposes for which the data
are to be processed.
28.As Lord Hope also notes in the Collie judgement, the concept of
lawfulness cannot sensibly be addressed without considering the
conditions set out in Schedule 2 (and Schedule 3 also, where it is
applicable), because any disclosure which fails to meet at least one of
the necessary conditions would be contrary to section 4(4) of the DPA
(which provides that it shall be the duty of the data controller to
comply with the data protection principles). There may also be other
reasons as to why the disclosure of information is unlawful, for example
because disclosure of the information would be a breach of confidence,
or because there is a specific law forbidding disclosure. In this case
the University has not put forward any arguments as to why the
disclosure of the personal data would be unlawful, otherwise than as a
result of failing to meet condition 6 in Schedule 2.
29.When considering the conditions in Schedule 2, the Commissioner has
also noted Lord Hope's comment in the Collie judgement that the
conditions require careful treatment in the context of a request for
information under FOISA, given that they were not designed to facilitate
the release of information but rather to protect personal data from
being processed in a way that might prejudice the rights and freedoms or
legitimate interests of the data subject.
30.Having considered the conditions in Schedule 2 and taken account of
the University's submissions, the Commissioner has concluded that
condition 6 is the only one which might permit disclosure in this case.
Condition 6 permits personal data to be processed if the processing
(which in this case would be by disclosure in response to Mr Henderson's
information request) is necessary for the purposes of legitimate
interests pursued by the data controller or by the third party or
parties to whom the data are disclosed, except where the processing is
unwarranted in any particular case by reason of prejudice to the rights
and freedoms or legitimate interests of the data subject (the
individual(s) to whom the data relate).It is clear from the wording of
this condition that each case will turn on its own facts and
circumstances.
31.There are, therefore, a number of tests which must be considered
before condition 6 can be met. These are:
Does Mr Henderson have a legitimate interest in obtaining the withheld
personal data?
If yes, is disclosure necessary to achieve these legitimate aims? In
other words, is the disclosure proportionate as a means and fairly
balanced as to ends, or could these legitimate aims be achieved by means
which interfere less with the privacy of the individuals in question?
Even if the processing is necessary for Mr Henderson's legitimate
purposes, would the disclosure nevertheless cause unwarranted prejudice
to the rights and freedoms or the legitimate interests of the
signatories of the petition, the writer of the handwritten letters or
the person to whom the typewritten note was addressed? As noted by Lord
Hope in the Collie judgement, there is no presumption in favour of
release of personal data under the general obligation laid down in
FOISA.Accordingly, the legitimate interests of Mr Henderson must
outweigh the rights and freedoms or legitimate interests of those
individuals before condition 6(1) will permit the personal data to be
disclosed.If the two are evenly balanced, the Commissioner must find
that the University was correct to refuse to disclose the personal data
to Mr Henderson.
Does Mr Henderson have a legitimate interest?
32.In his submissions to the Commissioner, Mr Henderson has set out what
he considers to be his legitimate interests in receiving the withheld
information.He argues that there is a very strong public interest
involved in this case, as (in his words) "it is no small thing for a
tenured academic to be driven from his post". He believes there to be
clear evidence that the petition would have influenced (and arguably was
the prime driver in) the University's proceedings against the specified
lecturer, contending that there was a widespread movement within the
University to remove this individual simply because of his views. In his
opinion, the proceedings followed in the course of the individual's
removal were "tainted" either by undue influence from his opponents or
by an active desire to remove him.
33.In his support, Mr Henderson has referred to a decision of the
Information Commissioner, who is responsible for the enforcement of the
(United Kingdom) Freedom of Information Act 2000 (FOIA) and of the
DPA.While in his decision FS50086626 the Information Commissioner
accepted the withholding of similar details of the signatories of a
petition submitted to a public authority, Mr Henderson suggests that the
circumstances were different in that he does not understand there to
have been any evidence in that other case of the petition having
influenced the relevant decision of the public authority.
34.The University concedes that Mr Henderson might have a legitimate
interest in disclosure. Having considered the submissions of both
parties, the Commissioner accepts that Mr Henderson has a legitimate
interest (as indeed do the wider public) in being satisfied that the
decision-making processes of a public authority (in this case the
University) are open to scrutiny and influenced only by relevant
considerations. Without commenting on whether it had any bearing on the
decision in question, the Commissioner acknowledges that the withheld
information has at least some connection to the removal of the specified
lecturer and in the circumstances he accepts Mr Henderson's legitimate
interest in it.
Is disclosure necessary to achieve these legitimate aims?
35.In its submissions to the Commissioner, the University stated that it
had given Mr Henderson the text of the petition, letters and typewritten
note, the petition being redacted in such a way that Mr Henderson could
see how many people had signed it.The only withheld information was that
which might identify the authors of the documents. Having considered the
withheld information, the Commissioner acknowledges this to be the case.
36.Taking account of Mr Henderson's arguments as outlined above, in
particular those relating to influence on the removal process, the
Commissioner considers disclosure of the withheld information to be
necessary to achieve Mr Henderson's legitimate interests. While a
considerable amount of information on the matter has been released to Mr
Henderson already, the Commissioner understands the identities of the
individual signatories and correspondent(s) to be at least partly at the
root of his concerns as to undue influence, which he would require to
address if his legitimate interests are to be fulfilled. In the
circumstances, the Commissioner cannot identify a means of meeting these
legitimate interests which would be less intrusive than disclosure of
the withheld personal data.
Would disclosure of information cause unwarranted prejudice to the
rights and freedoms or legitimate interests of the signatories of the
petition, the writer of the handwritten letters or the person to whom
the typewritten note was addressed?
37.Mr Henderson has argued that the character of the petition in this
case differs from that considered by the Information Commissioner in
decision FS50086626, in being politically motivated: he does not believe
there to be a general expectation of privacy in relation to petitions
raised for a political end. The University, on the other hand,
highlights similarities to that other case, the petition having been
submitted against a person rather than in support of a general cause and
therefore being more likely to have been submitted in confidence. They
took the view that the circumstances of its submission suggested it was
intended for University officials only, arguing that the information had
been provided by the individuals in a private capacity and that they
would have had no expectation of its disclosure. Pointing out that the
individuals concerned might not wish to reopen an issue in which they
had taken an interest more than 10 years earlier, they argued that
disclosure would cause unwarranted prejudice to their rights, freedoms
and legitimate interests.
38.The Commissioner accepts and agrees with the submission made by the
University on this point. Whatever expectations might be in respect of
the submission of such a petition today, it appears clear to the
Commissioner that in 1996 or 1997, well before Freedom of Information
legislation was even in contemplation, the petitioners and
correspondent(s) involved in this matter would have had no reasonable
expectation that their personal data, as contained in the petition and
correspondence under consideration here, would be disclosed into the
public domain. Consequently, the Commissioner would regard disclosure in
response to Mr Henderson's request as wholly contrary to their
legitimate interests and expectations.
39.On balance, while the Commissioner accepts that disclosure of the
withheld information would be necessary to fulfil Mr Henderson's
legitimate interests (at least in part), he does not agree that this
outweighs the unwarranted prejudice that would be caused to the data
subjects' rights, freedoms and legitimate interests (which must be
viewed in the light of their reasonable expectations at a time well
before the introduction of Freedom of Information legislation). The
Commissioner is therefore satisfied that condition 6 of Schedule 2 to
the DPA cannot be met in this case.
40.Having concluded that disclosure of the withheld information would
lead to unwarranted prejudice, as described above, to the rights,
freedoms and legitimate interests of the signatories of the petition,
the writer of the handwritten letters and the person to whom the
typewritten note was addressed, the Commissioner must also conclude that
disclosure would be unfair. As condition 6 cannot be met, he would also
regard disclosure as unlawful. In all the circumstances, therefore, he
finds that disclosure would breach the first data protection principle
and that the information was therefore properly withheld under section
38(1)(b) of FOISA.
Section 17 – Notice that information is not held
41.As indicated above, Mr Henderson was not satisfied that the
University had located and provided all of the information it held
falling within the scope of his request.
42.In its submissions to the Commissioner, the University explained that
since the individual in question had been dismissed by the University it
had undergone extensive reorganisation.It advised that the case of the
individual in question had been dealt with at the time by the University
HR Department and the University Secretary.
43.The University has provided full details of the areas it searched to
try to locate any other relevant information.Searches were made in the
files of the HR department and the University Secretary.However, it is
the University's submission that any relevant information from these
files (in particular files relating directly to the employment of the
individual concerned) has been destroyed in line with its records
retention schedule.
44.The University has provided the Commissioner with a copy of the
relevant records retention schedule which was applicable to these
records. The schedule states that information relating to an employee's
termination of employment should be destroyed 6 years after the
termination.
45.The University has also advised that searches were carried out of
records held by the University Principal, Central Records Registry, HR
personal files, HR disciplinary/grievance proceedings files, HR staff
database, College Office of the College of Humanities and Social
Science, Head of College of Humanities and Social Science, School of
Philosophy, Psychology and Language Sciences, Head of Psychology,
University Archives, Head of Court Services and Payroll.Staff Committee
meeting minutes and Joint Consultation and Negotiating Committee minutes
were also searched for any relevant information.The University also
checked with current and past staff members of the University identified
by Mr Henderson, to ascertain if they held any other relevant
information.The University advised that any information that they did
find and which was relevant to Mr Henderson's request had been provided
to him.
46.The University explained that records were only held by its Payroll
section for 7 years: as the named individual's tenure had been
terminated in 1997, no relevant information was held there.
47.Further submissions which were received from the University contained
emails demonstrating the breadth of the searches that were carried out
and the areas of the University which were checked.
48.When the Commissioner is considering what information a Scottish
public authority held within the scope of a particular request for
information, he is not investigating whether the requested information
ever existed, or whether the public authority ever held it, or whether
it was under an obligation to hold it.He is instead required to consider
whether, as a matter of fact, the public authority held the information
at the time of the applicant's request.
49.Having considered the submissions received from the University,
including the relevant retention schedule and details of the searches
carried out, the Commissioner is satisfied that the University carried
out thorough and adequate searches in order to determine whether any
other relevant information was held which would address Mr Henderson's
request. The Commissioner is also satisfied that any information that
was identified during the further searches that were carried out has
been provided to Mr Henderson.
50.The Commissioner is satisfied therefore that the University was
correct to provide Mr Henderson with a notice under section 17(1) of
FOISA in this case, as he is satisfied that the University did not at
the time of Mr Henderson's request (and indeed does not) information
which would address his request, with the exception of the information
located and provided to (or withheld from) him.
DECISION
The Commissioner finds that the University of Edinburgh acted in
accordance with Part 1 of the Freedom of Information (Scotland) Act 2002
(FOISA) in responding to the information request made by Mr Henderson.
Appeal
Should either Mr Henderson or the University of Edinburgh wish to appeal
against this decision, there is an appeal to the Court of Session on a
point of law only.Any such appeal must be made within 42 days after the
date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
3 June 2009
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority
which holds it is entitled to be given it by the authority.
…..
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any
provision of Part 2, section 1 applies only to the extent that –
(a) the provision does not confer absolute exemption; and
….
(2) For the purposes of paragraph (a) of subsection 1, the following
provisions of Part 2 (and no others) are to be regarded as conferring
absolute exemption –
…
(e) in subsection (1) of section 38 –
…
(ii) paragraph (b) where the first condition referred to in that
paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that
section.
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require
it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b)
of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for
complying with the request, give the applicant notice in writing that it
does not hold it.
….
38Personal information
(1) Information is exempt information if it constitutes-
…
(b) personal data and either the condition mentioned in subsection (2)
(the "first condition") or that mentioned in subsection (3) (the "second
condition") is satisfied;
(2) The first condition is-
…
(b)in any other case, that such disclosure would contravene any of the
data protection principles if the exemptions in section 33A(1) of that
Act (which relate to manual data held) were disregarded.
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires –
"data" means information which –
(a) is being processed by means of equipment operating automatically in
response to instructions given for that purpose,
(b) is recorded with the intention that it should be processed by means
of such equipment,
(c) is recorded as part of a relevant filing system or with the
intention that it should form part of a relevant filing system,
(d) does not fall within paragraphs (a), (b) or (c) but forms part of an
accessible record as defined in section 68; or
(e) is recorded information held by a public authority and does not fall
within any of paragraphs (a) to (d);
…
"personal data" means data which relate to a living individual who can
be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of,
or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any
indication of the intentions of the data controller or any other person
in respect of the individual;
…
"public authority" means a public authority as defined by the Freedom of
Information Act2000 or a Scottish public authority as defined by the
Freedom of Information (Scotland) Act 2002;
"relevant filing system" means any set of information relating to
individuals to the extent that, although the information is not
processed by means of equipment operating automatically in response to
instructions given for that purpose, the set is structured, either by
reference to individuals or by reference to criteria relating to
individuals, in such a way that specific information relating to a
particular individual is readily accessible.
33A Manual data held by public authorities
(1) Personal data falling within paragraph (e) of the definition of
"data" in section 1(1) are exempt from –
(a) the first, second, third, fifth, seventh and eighth data protection
principles,
(b) the sixth data protection principle except so far as it relates to
the rights conferred on data subjects by sections 7 and 14,
(c) sections 10 and 12,
(d) section 13, except so far as it relates to damage caused by a
contravention of section 7 or the fourth data protection principle and
to any distress which is also suffered by reason of that contravention,
(e) Part III, and
(f) Section 55.
Schedule 1 – The data protection principles
Part I – The principles
1.Personal data shall be processed fairly and lawfully and, in
particular, shall not be processed unless –
(a)at least one of the conditions in Schedule 2 is met, and
(b)in the case of sensitive personal data, at least one of the
conditions in Schedule 3 is also met.
…
Schedule 2 – Conditions relevant for purposes of the first principle:
processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate
interests pursued by the data controller or by the third party or
parties to whom the data are disclosed, except where the processing is
unwarranted in any particular case by reason of prejudice to the rights
and freedoms or legitimate interests of the data subject.
…
Link to PDF file of decision 064/2009 (117 kb)
--
Robert Henderson
Blair Scandal website: http://www.geocities.com/ blairscandal/
Personal website: http://www.anywhere.demon.co.uk
Smolley
"Robert Henderson" <phi...@anywhere.demon.co.uk> wrote in message
news:9ZMu4Pt5...@anywhere.demon.co.uk...
> Note on Robert Henderson's FOI request to Edinburgh University asking for
> data on Chris Brand
>
> Chris Brand is a psychologist who held a tenured position at Edinburgh
> University (EU) until 1997 when his tenure was put aside and he was
> dismissed from his post.
Brand's most controversial views generated headlines in 1996, when he was
quoted in the Independent on Sunday
recommending that "low-IQ girls" be "encouraged to have sex with higher-IQ
boys" rather than with their more usual
low-IQ companions (resulting in genetic deterioration). "There are plenty of
intelligent African men for black girls
to be having sex with," he said, though adding (like his hero psychologist
William McDougall) that blacks
probably needed to be allowed polygamy. Brand has also written that "women
are inclined to deceitful promiscuity"
and that Sigmund Freud was therefore right to ascribe weaker superegos to
women than to men. (Brand is a supporter
both of psychometrician-psychologist Hans Eysenck and of Freud.) His 1996
book The g Factor: General Intelligence
and Its Implications led to accusations of scientific racism and sexism, and
his university lectures were protested
and closed by the Anti-Nazi League of Edinburgh. Brand's book was
subsequently withdrawn by publisher John Wiley &
Sons. It was subsequently published free on the web by Douance.
Also in 1996 Brand came to the defense of Nobel laureate Daniel Carleton
Gajdusek who had been charged with paedophilia.
Brand wrote that, "Academic studies and my own experience [as a choir boy
occasionally importuned by older men] suggest
that non-violent paedophilia with a consenting partner over age 12 does no
harm so long as the paedophiles and their partners
are of above-average IQ and educational level." He was fired after a year of
secret trial from his 27-year tenured position at
Edinburgh University in 1997 for conduct that had allegedly "brought the
university into disrepute." Brand sued the University
for unfair dismissal, and received �12,000 in an out-of-court settlement.