Home Decisions

Decision 108/2007

Decision 108/2007 John Kemp and Glasgow City Council

Earnings information

Applicant: John Kemp
Authority: Glasgow City Council
Case No: 200700574
Decision Date: 10 July 2007

Kevin Dunion
Scottish Information Commissioner

Request for information about an individual ? refused by Glasgow City Council ? decision upheld by Commissioner

Relevant Statutory Provisions and Other Sources

Freedom of Information (Scotland) Act 2002 (FOISA): sections 1(1) (General entitlement) and 38(1)(a), (b) and (2)(a)(i) and (b) (Personal information)

Data Protection Act 1998 (DPA): section 7(1)(c)(i) (Rights of access to personal data), Schedule 1 (The data protection principles) (first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of an personal data)

The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Facts

Digby Brown, Solicitors made an information request under FOISA on behalf of their client, Mr John Kemp, to Glasgow City Council (the Council) for a number of documents in relation to an accident at work suffered by Mr Kemp.

As part of their response, the Council refused to disclose information about Mr Kemp's earnings on the basis that the information was exemption under section 38(1)(b) of FOISA. However, it advised Digby Brown that it would be willing to treat the request as a subject access request under section 7 of the DPA and that upon receipt of a signed mandate from their client, the earnings information would be released to them.

Digby Brown asked the Council to review its decision. On review, the Council upheld its decision with regards to the earnings information. Digby Brown remained dissatisfied and applied to the Commissioner for a decision in relation to the wages information only.

Following an investigation, the Commissioner found that the Council had dealt with the request for information in accordance with Part 1 of FOISA.

Background

1. On 5 February 2007, Digby Brown made an information request under section 1 of FOISA to the Council. They requested a number of documents from the Council, including information on Mr Kemp's earnings.

2. The Council responded on 7 March 2007, but refused to disclose Mr Kemp's earnings information on the basis that it was exempt under section 38(1)(b) of FOISA. The Council advised Digby Brown that it would treat the request as a subject access request under section 7 of the DPA and that, upon receipt of a signed mandate from their client (i.e. proof that Mr Kemp had authorised Digby Brown to make this request on his behalf), would release the information to them.

3. On 12 March 2007, Digby Brown asked the Council to review its decision on the basis that the information was not exempt under section 38(1)(b) as the disclosure would not contravene any of the data protection principles.

4. On 5 April 2007, the Council notified Digby Brown of the outcome of its review. The Council upheld its decision not to release information on Mr Kemp's earnings. The Council reaffirmed that it considered the matter should be dealt with by way of a subject access request under the DPA and that the information would be released if their client, Mr Kemp, signed a mandate authorising release of the information.

5. On 16 April 2007, Digby Brown wrote to my Office, stating that they were dissatisfied with the outcome of the Council's review in relation to the earnings information and applying to me for a decision in terms of section 47(1) of FOISA.

6. The application was validated by establishing that Digby Brown had made a request for information on behalf of Mr Kemp to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to that request.

The Investigation

7. On 4 May 2007, my office wrote to the Council, giving notice that an application had been received and that an investigation into the matter had begun and inviting comments from the Council as required under section 49(3)(a) of FOISA. In particular, the Council was asked to provide copies of the information withheld from Digby Brown, along with detailed analysis of its application of the relevant exemptions.

8. The Council responded on 29 May 2007, enclosing the information withheld, its statements on the case and other supporting documentation.

9. The Council indicated that it considered the earnings information to be Mr Kemp's personal data and that, since they had not received a signed mandate which would serve to put Digby Brown in the shoes of their client, they considered the most applicable exemption under section 38 to be section 38(1)(b).

The Commissioner's Analysis and Findings

10. In coming to a decision on this matter, I have considered all of the information and the submissions that have been presented to me by bothparties and I am satisfied that no matter of relevance has been overlooked

11. The first question I wish to consider is whether the earnings information is in fact the personal data of Mr Kemp. Having looked at the information provided to me by the Council, I am satisfied that it is. The information in question lists Mr Kemp's gross and net weekly pay, together with other information such as bonuses he has been paid.

12. I note that although Digby Brown originally argued that the information was not personal data, when they requested that the Council review their decision, they accepted that the information requested may be personal data. (Digby Brown then argued that if it was personal information then it should be released under section 35 of the DPA. I am not responsible for the enforcement or regulation of the DPA and do not consider it appropriate for me to comment on whether the Council should have exercised its discretion to release information in terms of section 35 of the DPA in this particular case.)

13. As noted above, the Council has relied on the exemption in section 38(1)(b) to withhold the earnings information from Digby Brown, given that Digby Brown did not provide the Council with a signed mandate to prove that in making the information request they were in fact acting on behalf of Mr Kemp. Section 38(1)(b) is normally relied on to withhold third party personal information from release. I assume that if Digby Brown had provided the Council with such a mandate, then the Council would have instead decided to withhold the information under the exemption in section 38(1)(a) of FOISA (which exempts personal information from release if the request has been made by the subject of that information) while releasing the information to Digby Brown under section 7 of the DPA. If Digby Brown were acting on behalf of Mr Kemp, then they would be considered to be in the same position as Mr Kemp and, accordingly, section 38(1)(a) would have been the appropriate exemption to rely on.

14. It should be remembered that while the DPA allows personal information to be released to the subject of the information (or to a person acting on his/her behalf), a release of information under FOISA is similar to releasing information into the public domain. This is why Parliament has exempted such personal information from release under FOISA while ensuring that the right to access such information is available under other legislation, i.e. the DPA.

15. I am satisfied that, in making the information request on behalf of Mr Kemp, Digby Brown were acting on his behalf. I therefore consider that the Council could have relied on the exemption in section 38(1)(a) without sight of a signed mandate, although I appreciate why it chose to rely on section 38(1)(b) instead.

16. Throughout its correspondence with Digby Brown, the Council have intimated that the information requested could be available if their client signed a mandate authoring the release of the information. I take this, not as the Council being obstructive or refusing to disclose the information, but acting within the guidance given by the Law Society's Professional Practice Committee as published within the July 2003 edition of the Journal of the Law Society of Scotland.

17. Here, the Committee accepted that whilst solicitors act as agents for their clients, and no formal mandate is required to establish that, the position has been altered by the DPA. The Committee agreed with the Council's view that a person responding to a subject access request made by a solicitor on behalf of a client is entitled to be satisfied by means of a signed mandate that the data subject (i.e. the client) is happy for the request to be made.

18. Given that I am satisfied that Digby Brown were acting on behalf of their client, and given that I am satisfied that the information in question is Mr Kemp's personal information, I consider that the information in question is exempt in terms of section 38(1)(a) of FOISA.

19. However, for completeness sake, I should also make it clear that I consider that the information would also be exempt under section 38(1)(b) of FOISA. The Council could only have released the information under section 38(1)(b) if the release of the information would not have breached any of the data protection principles. The first data protection principle says that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

20. Having considered Schedule 2, I am not satisfied that any of the conditions can be met. Neither the Council nor Digby Brown has provided me with evidence to show that Mr Kemp has consented to details about his salary being put into the public domain. In addition, given that all that is required for Mr Kemp to receive the information under section 7 of the DPA is for him to sign a mandate, I am not satisfied that the release of the information under FOISA (and, accordingly, into the public domain), would be necessary (the test used in Schedule 2) to satisfy any of the other conditions in the schedule.

Decision

I find that Glasgow City Council acted in accordance with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Digby Brown on behalf of their client, John Kemp.

Appeal

Should either Mr Kemp or Glasgow City Council wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this decision notice.

 

Kevin Dunion
Scottish Information Commissioner
1 July 2007

 

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

38 Personal information

(1) Information is exempt information if it constitutes-

(a) personal data of which the applicant is the data subject;

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

(?)

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

(?)

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

Data Protection Act 1998

7 Right of access to personal data

(1) Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled ?

?

(c) to have communicated to him in an intelligible form ?

(i) the information constituting any personal data of which that individual is the data subject

(?)

Schedule 1 ? The data protection principles

Part 1 ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

2. The processing is necessary -

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4. The processing is necessary in order to protect the vital interests of the data subject.

5. The processing is necessary -

(a) for the administration of justice,

(aa) for the exercise of any functions of either House of Parliament,

(b) for the exercise of any functions conferred on any person by or under any enactment,

(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?