Decision 190/2007 Ms May Docherty and Lothian NHS Board
Copy of PFI Contract
Applicant: Ms May Docherty
Authority: Lothian NHS Board
Case No: 200501839
Decision Date: 22 October 2007
Kevin Dunion
Scottish Information Commissioner
Request for copy of the PFI Contract relating to the Royal Infirmary of Edinburgh ? withheld on the grounds of confidentiality and excessive cost of compliance ? Commissioner required disclosure
Relevant Statutory Provisions and Other Sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 12(1) (Excessive cost of compliance); 36(2) (Confidentiality) and 38(1)(b) and (5) (Personal information)
Data Protection Act 1998 (DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data")
The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulation 5 (Excessive cost ? prescribed amount)
The full text of each of these provisions is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Facts
Ms Docherty requested a copy of the PFI contract relating to the construction, maintenance and provision of support services for the Royal Infirmary of Edinburgh from Lothian NHS Board (NHS Lothian). NHS Lothian responded by informing Ms Docherty that it considered the information to be exempt under section 36(2) of FOISA. Following a review which upheld the initial decision, Ms Docherty remained dissatisfied and applied to the Commissioner for a decision.
NHS Lothian consistently failed, during the course of the investigation, to present an appropriate case for the application of any FOISA exemption.The Commissioner did not accept NHS Lothian's arguments, raised during the investigation, that the cost of compliance with the request would be excessive. As a result, the Commissioner concluded that the contract in question should be released to Ms Docherty, subject to the removal or redaction of personal data which did not fall within the scope of Ms Docherty's request.
Background
1.On 24 January 2005, Ms Docherty contacted NHS Lothian to request a copy of the PFI Contract signed between the Royal Infirmary of Edinburgh NHS Trust and Consort Healthcare Limited (Consort), covering the provision of building, maintenance and support services for the new Royal Infirmary of Edinburgh.In her information request, Ms Docherty requested that this contract be supplied to her in electronic format.
2.NHS Lothian responded to Ms Docherty's request on 21 February 2005.In this response, NHS Lothian informed Ms Docherty that, following discussions with Consort and its own legal advisers, it considered that the contract in question was subject to a legally enforceable duty of confidence. It therefore informed Ms Docherty that the entire contract was considered to be exempt under section 36(2) of FOISA (Confidentiality).
3.Ms Docherty requested that NHS Lothian review its decision to withhold the information on 17 March 2005.
4.NHS Lothian responded to this request for review on 12 April 2005.In this response, NHS Lothian made reference to another NHS Trust, operating in England, which had previously released details of its own PFI contract covering the provision of similar services.NHS Lothian stated, however, that this release was made with the consent of the commercial PFI partner.NHS Lothian went on to inform Ms Docherty that similar consent had been refused by Consort in relation to her request, and NHS Lothian's legal advisers had therefore recommended that the information should not be released. NHS Lothian therefore upheld its application of section 36(2) in relation to the entire contract.
5.On 23 May 2005, I received an application for decision from Ms Docherty in relation to this matter. Ms Docherty's application was allocated to an investigating officer and validated by establishing that she had made a valid request for information to a Scottish public authority and had applied to me for a decision only after asking the authority to review its response to her request.
The Investigation
6.On 27 June 2005, NHS Lothian was notified that Ms Docherty's application had been received and asked for its comments in terms of section 49(3)(a) of FOISA.It was also asked to provide a full copy of the contract in question, along with details of the reasoning behind its decision to apply the exemption under section 36(2) to the information in question and correspondence with Consort relating to the consideration of the request.
7.In response, NHS Lothian supplied my Office with an electronic version of the Consort contract, which comprised approximately 2,400 pages of information, including a project agreement and 27 associated schedules. NHS Lothian failed, however, to set out why it was considered that each component part of the contract fell within the scope of the exemption contained in section 36(2) of FOISA.Instead, NHS Lothian merely presented documentation received by it from Consort, which set out Consort's view that it believed the release of the entire contract would be an actionable breach of confidence. This documentation also indicated that Consort considered the information in the contract to be commercially sensitive and/or to comprise trade secrets, and at one point made specific reference to the potential application to the information of the exemption in section 33(1)(b) of FOISA (which relates to commercial interests). NHS Lothian did not argue, however, either in its correspondence with Ms Docherty or its submissions to me, that any of the information was in fact exempt under either section 33(1)(a) (which relates to trade secrets) or section 33(1)(b).
8.The investigating officer then requested that NHS Lothian provide specific submissions setting out its own view on the appropriate application of the section 36(2) exemption to the component information within the contract: in particular, it was asked to identify which information within the contract it genuinely considered to be exempt under section 36(2) and which it did not.NHS Lothian's response failed to do this, but simply reiterated the argument that Consort (for the reasons it had advanced in earlier correspondence) considered the contract to be exempt in its entirety.
9.This response then led to an Information Notice being served on NHS Lothian under section 50(1)(a) of FOISA.This Information Notice, dated 10 October 2006, identified 127 component sections within the contract as supplied by NHS Lothian, and required that NHS Lothian provide my Office with a separate and distinct commentary in relation to each component section, clearly setting out why it was considered that specific information within that section fell within the scope of section 36(2) of FOISA, taking into account all relevant tests required for the application of that exemption.
10.NHS Lothian was also reminded that it was its own responsibility to apply any FOISA exemptions to the requested information, and that any exemptions applied should be fully and appropriately considered by it, supported by arguments setting out why each applicable exemption was considered to apply.
11.As the Consort correspondence forwarded by NHS Lothian previously had indicated or suggested that Consort believed section 33(1)(a) and section 33(1)(b) of FOISA to apply to the requested information, NHS Lothian was also asked to provide details (with reasons) of any exemptions other that section 36(2) which it considered applied to the requested information.
12.NHS Lothian's response to this Information Notice informed my Office that Consort had now "agreed to remove the blanket exemption, which had prevented the release of non-commercially sensitive information up to this point".NHS Lothian went on to state that Consort and NHS Lothian now "share the view that only the commercially sensitive information within the contract should be exempt from release".NHS Lothian went on to provide a spreadsheet which detailed all 127 component sections identified by my Office.
13.In making this submission, however, NHS Lothian again failed to set out its own arguments on whether the exemption under section 36(2) of FOISA should apply to the information requested.Instead, NHS Lothian merely relied on very brief statements made by Consort (in the spreadsheet referred to in paragraph 12 above), which advanced the view that information within the relevant sections should not be released because, in most cases, it was considered to be "commercially sensitive" (and therefore the section 36(2) exemption applied).
14.In relation to the question of whether any other exemption was considered to apply to the information requested, the spreadsheet provided by NHS Lothian identified five sections of the contract which were considered by Consort to contain information which fell within the scope of FOISA's section 38 exemption (personal information).This submission failed, however, to identify which subsection of section 38 was considered to apply, what specific information from within the relevant section of the contract was considered to be exempt, or why that information was considered to fall within the scope of the relevant subsection, despite the Information Notice requiring that all relevant exemptions were clearly identified, and a full and appropriate case made in relation to each.
15.It should be noted that in the course of the investigation Ms Docherty clarified that she did not require any of the personal data which might be contained within the contract.
16.In addition, it should be noted that NHS Lothian did not present a case for the application of either of the exemptions in section 33(1) of FOISA, nor indeed did it make any reference to these exemptions, whether directly or by reference to comments made by Consort, either in its letter or in the accompanying spreadsheet.
17.Further correspondence took place with NHS Lothian in an attempt to resolve this case.During this correspondence, NHS Lothian informed my Office that were it required to release the contract to Ms Docherty with exempt information redacted, there would be a substantial amount of work required to prepare the document for release.
18.Following this submission, NHS Lothian provided an estimate of the cost to it of supplying the information to Ms Docherty.Section 12(1) of FOISA sets out that an authority is not obliged to comply with a request for information if the estimated cost of complying would exceed the relevant amount prescribed in regulations by the Scottish Ministers. The Scottish Ministers have, under regulation 5 of the Fees Regulations, set this amount at ?600.
19.In response, NHS Lothian provided a cost estimate which appeared to be based on the provision of a 20,000 page document, as opposed to the 2,400 page document which had been supplied to my Office and referred to in all previous communications.NHS Lothian was asked to provide an explanation for this inconsistency.
20.While NHS Lothian confirmed that the estimate based on 20,000 pages was due to a calculation error, it also stated that a substantial amount of additional information which formed part of the contract had been discovered.
21.A revised cost submission was provided by NHS Lothian on the basis of the newly discovered full version of the contract.In this submission, NHS Lothian stated that the complete PFI Contract for the Royal Infirmary of Edinburgh comprised 8,022 A4 sheets, 38 A3 sheets and 1 drawing.NHS Lothian also provided an overview of the content of the full contract, confirming that the additional information did indeed constitute component parts of the contract.
22.There were further inconsistencies identified within the cost submissions provided by NHS Lothian.NHS Lothian was asked to review these apparent inconsistencies and provide a revised submission.Additional inconsistencies were contained within subsequent submissions made by NHS Lothian, and NHS Lothian was asked to provide further detail and clarification in relation to the submissions made.
23.NHS Lothian was also asked in this follow-up correspondence to provide an estimate of the proportion of information within the contract which it considered had been obtained from a third party (i.e. Consort).It was stressed to NHS Lothian that I took the view that the section 36(2) exemption would only apply to information which had been obtained from a third party, and that generally I could not accept that information which had been created as a result of a process of negotiation between an authority and its contractor could be regarded as having been obtained from that contractor.
24.Further correspondence on this matter, which failed to provide the required clarification, led to a second Information Notice being served on NHS Lothian in order to obtain relevant information. This Notice, dated 16 August 2007, again required NHS Lothian to provide detailed submissions in relation to its application of section 36(2), including clarification of which elements of the contract should be regarded as having been obtained form a third party, and also further clarification on aspects of its cost submissions.
25.The response supplied by NHS Lothian again failed to provide in full the information sought within the Information Notice, providing no detailed submission in relation to the application of section 36(2) within the context of the Consort contract.In place of this information, NHS Lothian forwarded advice it had received from the NHS Scotland's Central Legal Office on the application of section 36(2).This addressed the application of the exemption to information in contracts in fairly general terms and no attempt was made by NHS Lothian to apply this advice to the particular information contained within the Consort contract.The revised fees estimate provided by NHS Lothian also contained further inconsistencies.
The Commissioner's Analysis and Findings
26.In considering this case, I have considered all of the submissions and other information that have been presented by both Ms Docherty and the Council and am satisfied that no matter of relevance has been overlooked.
27.Correspondence received by NHS Lothian from Consort suggests that one or both of the exemptions contained under sections 33(1)(a) and 33(1)(b) of FOISA (which relate to trade secrets and commercial interests respectively) may apply to parts of the contract.However, it should be noted that NHS Lothian has not sought to apply either of these exemptions at any point during the extended investigation period of this case - despite explicit requests for clarification on this point from my staff. As a result, it does not fall to me to consider the application of these exemptions to the information requested by Ms Docherty.
28.On the other hand, NHS Lothian has asserted in its submissions to my Office that the information requested by Ms Docherty is exempt under section 36(2) of FOISA (confidentiality), while also suggesting, in later submissions, that some of the information might be considered to be exempt under section 38 of FOISA (personal information).
29.In making these submissions, however, NHS Lothian has repeatedly and consistently failed to conduct its own independent assessment of the information contained within the Consort contract, and has consequently failed to make adequate representations to support their application. This failure has occurred despite numerous requests from my Office, and the serving of two formal Information Notices which explicitly sought such information.
30.Where an authority seeks to withhold information in response to a FOISA request, it will be the responsibility of the authority alone to apply any appropriate exemption, and the application of any such exemption must therefore be considered fully, carefully and appropriately by that authority.
31.While it may frequently be appropriate for authorities to seek comment and opinion from third parties in relation to information which might, for example, give rise to an actionable breach of confidence if disclosed, this information should be used to inform the authority's own consideration.In many cases, third parties will argue vigorously for the non-disclosure of such information, but the authority will be required to assess those arguments independently in the context of the relevant FOISA exemption before ultimately deciding whether or not that exemption should be applied.
32.It is clear in relation to this case, however, that such an independent assessment has not taken place at any point. In place of such an assessment, NHS Lothian has repeatedly presented only broad statements received from Consort as the sole justification for the application of the relevant exemptions. These are, essentially, statements as to why Consort considers the information in question to be exempt.
Section 36(2) (Confidentiality)
33.NHS Lothian has indicated that it considers the section 36(2) exemption should apply to information contained within the contract.
34.Section 36(2) of FOISA is an absolute exemption (i.e. it is not subject to the public interest test contained in section 2(1)(b) of FOISA) and provides that information will be exempt if it has been obtained from another person (which may include another Scottish public authority) and its disclosure to the public would constitute a breach of confidence actionable by any person.
35.In circumstances where an authority asserts that information should be exempt from release under the section 36(2) exemption, and in order to investigate this assertion, I require the authority to provide a detailed case setting out why the exemption is considered to apply.In order for an authority to demonstrate that these tests have been applied appropriately, I will normally expect an authority to provide:
Precise details of the specific information believed to fall within the scope of the exemption;
Details of why that specific information should be considered to have been obtained from another person;
Details of why the information should be considered to have the necessary quality of confidence;
Evidence that the information was received in circumstances which imposed an obligation to maintain confidentiality;
Details of why disclosure of the information would cause damage to the person who communicated the information.
36.Despite repeated efforts by my staff to obtain the above information from NHS Lothian, no appropriate submissions were forthcoming throughout the extensive investigation period, with NHS Lothian repeatedly presenting the view simply that the information was exempt because Consort had claimed it to be so.
37.In taking this approach, NHS Lothian seemingly sought to remove itself from its responsibility to appropriately assess the information held against the relevant FOISA exemption(s).During the course of the investigation, however, NHS Lothian was repeatedly informed that such an approach was unacceptable, and that it was the responsibility of NHS Lothian itself to make an appropriate case for any exemption it sought to apply. Nevertheless, NHS Lothian repeatedly and consistently failed to do so.
38.As a result of this repeated failure to provide any appropriate submission to support its application of the section 36(2) exemption - and taking into account the various opportunities that NHS Lothian was given in which to make such a submission - I find that I have no alternative but to conclude that NHS Lothian failed to make an appropriate case for the application of section 36(2) of FOISA.I arrive at this conclusion following NHS Lothian's complete failure to either identify the specific information it sought to exempt (and in particular that information it regarded as having been obtained from another person), or provide any appropriate reasoning in support of the application of the exemption to that information.
39.I therefore conclude that the contractual information requested by Ms Docherty cannot be exempted from release under section 36(2) of FOISA, for the reason that NHS Lothian has comprehensively failed to make an appropriate case in support of the application of that exemption.
Section 38 (Personal Information)
40.NHS Lothian sought to apply section 38 of FOISA to certain of the information withheld from Ms Docherty. It did not specify which exemption in section 38 it considered to be applicable and its arguments in relation to this exemption were no more full or adequate than those in relation to section 36(2). In the circumstances, however, I consider that the only relevant exemption is that set out in section 38(1)(b), which exempts personal data (as defined in section 1(1) of the DPA) in certain circumstances, including where its disclosure to a member of the public would contravene any of the data protection principles set out in Schedule 1 to the DPA.
41.As I have indicated at paragraph 15 above, Ms Docherty has advised that she does not require any personal data that may be found in the contract.
42.It was argued that an exemption in section 38 of FOISA applied to clauses 5 and 48 of the Project Agreement, and to schedules 0, 23 and 24. Having considered the information in question in the light of the definition of personal data contained in section 1(1) of FOISA, I have been unable to identify any personal data in schedule 24. Clauses 5 and 48 and schedule 0 do, however, contain the names of individuals, which I would regard as personal data, while I would also consider to be personal data in its entirety the provisional transferred employees list comprising schedule 23.
43.Ms Docherty having confirmed that she does not require personal data in response to her request for information, any information in the contract falling within that category falls outwith the scope of her request and I cannot require NHS Lothian to disclose it. Therefore, NHS Lothian may, in disclosing the contract to Ms Docherty, remove the personal data identified in paragraph 42 above.
The cost to NHS Lothian of complying with the request
44.NHS Lothian has provided me with submissions in relation to the cost of complying with Ms Docherty's request. In circumstances where the cost to an authority of complying with the applicant's request (on a reasonable estimate) exceeds the upper limit of ?600 prescribed in regulation 5 of the Fees Regulations, I cannot require the authority to release the information.
45.As indicated in paragraphs 17-25 above, however, there have been repeated inconsistencies and inaccuracies in the cost estimates advanced by NHS Lothian.
46.In its most recent submission on costs, received by this Office on 28 August 2007, NHS Lothian sought to argue that (taking no account of the cost of making any redactions requiring to be made to the contract) the cost of providing Ms Docherty with a copy of the contract would nevertheless exceed ?600, with ?681.90 estimated for the production of a paper copy and ?603.55 for the production of a copy in Ms Docherty's preferred electronic format.
47.On reviewing these projected costs, however, I cannot accept them as a reasonable estimate of what would be involved.I have to take into account that no acceptable argument has been presented to me in support of the exemption under section 36(2) of FOISA, and that only a very small amount of information need be removed from the contract as personal information (the largest part of that being an entire schedule, which will not require partial redaction in any form). Therefore, while I accept that a degree of recopying or rescanning of the contract may be required before a version of the contract can be available for release to Ms Docherty in her preferred electronic form, I would not regard the necessary work as being substantial. It is clear to me that the Project Agreement and each individual schedule provided to me initially are held separately in electronic form. Only the Project Agreement and schedule 0 will require a degree of redaction and possibly rescanning. The remainder of these schedules will not require to be rescanned at all, while schedule 23 does not even require to be provided. Further, I do not understand any exemption other than section 36(2) to have been claimed in relation to the additional pages discovered later in the investigation: I understand these to be held in paper format and therefore that they will simply require to be scanned.
48.All things considered, it appears to me that what would actually be required to provide Ms Docherty with the information she has requested would be a considerably smaller exercise than the wholesale copying and rescanning of the contract proposed by NHS Lothian. Given that NHS Lothian's estimate of the cost of providing an electronic copy only just exceeds the ?600 limit (by ?3.55), I am not persuaded that the limit would in fact be exceeded in complying with Ms Docherty's request.
49.I am therefore satisfied that the cost of providing Ms Docherty with an copy of the contract in her preferred electronic format with any personal data removed or redacted would fall comfortably within the cost limit of ?600 prescribed in regulation 5 of the Fees Regulations and therefore that section 12(1) of FOISA does not apply.
The handling of the case
50.As will be clear from the above narrative, NHS Lothian has, in its handling of this case and its dealings with my Office, consistently and repeatedly failed to provide my Office with appropriate submissions to facilitate the formal consideration of this case.NHS Lothian repeatedly failed to identify the specific information considered to be exempt, repeatedly failed to present an appropriately stated case to support its application of any relevant exemptions and repeatedly failed to provide a reliable estimate of the cost to it of providing information.
51.In addition, NHS Lothian failed, both in handling Ms Docherty's request initially and during the investigation carried out by this office, to identify and locate the full range of information falling within its scope.Indeed, it was not until the latest stages of this investigation that the majority of the information claimed to fall within the scope of the request ? some 5,000 pages of contractual information ? was even identified by the authority.
52.While there are clearly many aspects of NHS Lothian's handling of this case which are of concern to me, I find it particularly worrying that NHS Lothian appears simply to have been unaware for much of the investigation period that the contract it had identified as relating to this substantial PFI project omitted over 5,000 pages of relevant information. Given the scale and profile of the project, and the public interest in PFI projects more generally, the contract in question can hardly be described as information which NHS Lothian would not expect to be asked for following the introduction of FOISA.
53.I would, as a result of this investigation, strongly recommendthat NHS Lothian not only review its internal procedures for handling both FOI requests and investigations which are carried out by my Office, but that it also considers conducting a review of its own records management procedures and practices with regard to such information, in order to ensure that all relevant information can be identified at the earliest practicable stage.
Decision
I find that Lothian NHS Board (NHS Lothian) failed to present an appropriate case for the application of any exemption under Part 2 of the Freedom of Information (Scotland) Act 2002 (FOISA), in particular section 36(2) of FOISA, throughout the extensive duration of this investigation.I therefore find that NHS Lothian failed to comply with Part 1, and in particular section 1(1), of FOISA in withholding the majority of the contract from Ms Docherty.
However, I also find that the scope of Ms Docherty's request, as modified by her in the course of my investigation, does not include the personal data contained within the contract, as more particularly described in paragraph 42 of this decision notice.
I do not accept that the cost of complying with Ms Docherty's request would exceed the sum of ?600 prescribed in regulation 5 of The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 and therefore do not accept that section 12(1) of FOISA applies to the request.
I therefore require NHS Lothian to provide Ms Docherty with a copy of the contract requested by her, subject to the removal or redaction of the personal data described in paragraph 42 of this decision notice, within 45 days after the date of intimation of this decision notice.
Appeal
Should either Ms Docherty or NHS Lothian wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Kevin Dunion
Scottish Information Commissioner
22 October 2007
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
12 Excessive cost of compliance
(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.
36Confidentiality
[?]
(2) Information is exempt information if-
(a) it was obtained by a Scottish public authority from another person (including another such authority); and
(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.
38Personal information
(1) Information is exempt information if it constitutes-
(a) ?
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(c) ?
(d) ?
[?]
(5) In this section-
"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;
"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;
?
Data Protection Act 1998
1Basic interpretative provisions
(1)In this Act, unless the context otherwise requires ?
[?]
"personal data" means data which relate to a living individual who can be identified ?
(a)from those data, or
(b)from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004
Excessive cost - prescribed amount
5Excessive cost ? prescribed amount
The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is ?600.
