Decision 226/2006 Liam O’Donnell & Co and Scottish Drug Enforcement Agency

Decision 226/2006 – request for details of overtime claims – section 31(1) national security – section 35(1) law enforcement – section 38(1)(b) personal data – section 39(1) health, safety and the environment – public interest applied – section 38(1)(b) upheld

Request for details of overtime claims

Applicant: Liam O’Donnell & Co
Authority: Scottish Drug Enforcement Agency
Case No: 200503191
Decision Date: 7 December 2006

Kevin Dunion
Scottish Information Commissioner

Facts

Liam O’Donnell & Co, a firm of solicitors, requested information from the Scottish Drug Enforcement Agency (SDEA) about the overtime claims submitted and claimed by two named officers. The SDEA responded by indicating it held limited information relevant to the request. The SDEA advised that the information was exempt under section 31(1) national security, section 35(1) law enforcement, section 38(1)(b) personal information and section 39(1) health, safety and the environment. The applicants were dissatisfied with this response and restricted its request on review. The SDEA refused to supply the information on review and upheld the application of the original exemptions. Liam O’Donnell & Co applied to the Commissioner for a decision.

Outcome

The Commissioner finds that the SDEA complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in that the information requested is exempt by virtue of section 38(1)(b) of FOISA.

Appeal

Should either the SDEA or Liam O’Donnell & Co wish to appeal against this decision, there is a right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days of receipt of this notice.

Background

1. On 16 September 2005 Liam O’Donnell & Co requested the following information from the SDEA:

- Details of overtime claims submitted and paid in relation to 2 officers seconded to the SDEA. The information is sought in relation to the period 20 February 2002 and 5 March 2002.
- Any information submitted by the officers relative to the hours claimed for and the activities undertaken in connection with that overtime.

2. The SDEA responded to this request on 13 October 2005. The SDEA indicated that it held limited information relevant to this request for information. The SDEA advised that it held “daily duty sheets” between the dates specified and that it also held “overtime and expenses claims” for the two named officers. The SDEA advised that both officers were seconded to the SDEA from Strathclyde Police and that therefore Strathclyde Police would administer the payment of their salaries. The SDEA advised that it held a 6 monthly return but that this did not have a breakdown of specific relating to the period requested. The SDEA referred the applicants to Strathclyde Police.

3. The SDEA indicated that the information it held was being withheld on the basis of a series of exemptions. The SDEA set out its submissions in respect of the following exemptions:

a) Section 31 National Security
b) Section 35(1) Law Enforcement
c) Section 38(1)(b) Personal data
d) Section 39(1) Health, Safety and the Environment

4. The SDEA also set out its consideration of the public interest test as required by section 2(1)(b) of FOISA. The SDEA concluded that the information requested related directly to the SDEA’s and Scottish Police forces’ capability to mount police operations targeting serious organised crime and terrorist activities. The SDEA stated that this information specifically related to the operational business of policing and its release would not benefit the public as it could hinder the operational effectiveness of Scottish police forces and the SDEA. Having considered both elements of the public interest test, the SDEA considered that the public interest in retaining the information, i.e. in maintaining the exemptions, outweighed the public interest in disclosure.

5. Liam O’Donnell & Co was dissatisfied with this response and on 26 October 2005 requested a review of the decision. In an attempt to address the SDEA’s concerns, the applicant revised its request and sought the following information:

a) Between the relevant dates specified a note simply of the times that the officers were on duty or on over time payment during the period mentioned
b) Any locus or loci that they visited could be deleted at this stage except for their returning to Headquarters at Osprey House

6. In making this request the applicant indicated that this was very limited information which would not disclose any operational matters. The applicant indicated that it was well-known that police officers could work outwith a normal 9-5 pattern so that disclosure of the times itself, in essence, carried no threat. Further disclosure of their return to Osprey House at any stage, whilst on shift, would again disclose no threat in terms of the operational business of policing.

7. The SDEA responded to this request for review on 15 November 2005. The SDEA acknowledged the restricted request. The SDEA confirmed its original decision made and articulated in its letter of 13 October 2005.

8. Liam O’Donnell & Co was dissatisfied with this response and on 22 November 2005 applied to my office for a decision. The applicant asked that both requests for information (made on 16 September and 26 October) be considered as part of the application.

9. The case was allocated to an investigating officer.

Investigation

10. Liam O’Donnell and & Co’s appeal was validated by establishing that it had made a request to a Scottish public authority, and had appealed to me only after asking the authority to review its response to the request.

11. The investigating officer contacted the SDEA on 6 December 2005 giving notice that an appeal had been received and that an investigation into the matter had begun. The SDEA was asked to comment on the issues raised by the applicant’s case and to provide supporting documentation for the purposes of the investigation.

12. In particular, the SDEA was asked to provide a copy of the information withheld from Liam O’Donnell & Co, further information about the application of the exemptions to the information withheld and further analysis on the application of the public interest test to the information withheld.

13. The SDEA was also asked to provide information about how its review was carried out and for any guidance it had relied on in deciding whether the information should be released or withheld.

14. The SDEA visited my Office on 21 December 2005 and supplied information relevant to this investigation.

15. I will consider the submissions made by the SDEA in my analysis and findings below.

16. During the course of the investigation the applicant was advised that only the restricted request made on review could be considered as part of this application. The applicant was further advised that the request could only be considered insofar as it related to the applicant’s original request for information. This is because, in each case, the information must have been considered as part of an initial request and as part of an internal review.

17. Although the applicant’s request of 26 October 2005 restricted the original request in respect of overtime, it also contained a new request in that it sought details of times of duty. As this aspect of the request had not been the subject of an internal review I was unable to consider it as part of this application. As a result, the investigation focussed on the following information request:

- The officers hours of overtime for the time period specified
- The time they returned to Osprey House for the time period specified, where this was in connection with overtime

Commissioner’s analysis and findings

18. The applicant is seeking information about the hours of overtime claimed by two named officers for the period of 20 February 2002 to 5 March 2002.

19. Before I address the exemptions applied by the SDEA in this case I consider it helpful to describe in general terms the information held by the SDEA in this case. The SDEA has advised that it holds “daily duty sheets” between the dates specified and that it also held “overtime and expenses claims” for the two named officers. Such forms only record information about the times of duty and/or overtime. They do not record information about specific loci. I mention this because the applicants have sought information about times of arrival at Osprey House. This information is not recorded on the claim forms or duty sheets.

20. Secondly, the SDEA has advised me that an overtime claim form for one named Officer could not be found for the period 2/05/02 until 5/03/02.

21. The SDEA has submitted that a number of exemptions apply to the information requested and that, as a result, the information should not be disclosed.

Section 38(1)(b)

22. The SDEA submitted that Scottish police forces and the SDEA must comply with data protection legislation and that, in this regard, consideration must always be given to the first principle (personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 is met, and in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met) of the Data Protection Act 1998 (the DPA). The SDEA claimed that section 38(1)(b) of FOISA is relevant in that some of the information requested is personal data in respect of personal financial data (overtime claims submitted and paid), release of which would breach the first data protection principle.

23. In its restricted request made on review the applicant requested the hours of overtime worked by the two officers for the time period specified and the time at which the officers returned to Osprey House, the Headquarters of the SDEA. I am therefore required to consider whether information relating to the hours of overtime worked by named individuals falls within the scope of section 38(1)(b).

24. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i), states that information is exempt if it constitutes personal data and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles.

25. Section 38(5) of FOISA states that the definition of “personal data” is that contained in section 1(1) of DPA. That section defines personal data as:

“data which relate to a living individual who can be identified –

(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any
indication of the intentions of the data controller or any other person in
respect of the individual.”

26. In considering whether hours of overtime worked constitutes personal data I have also taken into account the decision of Durant v the Financial Services Authority [2003] EWCA Civ 1746.

27. In that decision, the Court of Appeal held that if information is to be viewed as personal data, the information has to be biographical in a significant sense, i.e. go beyond the recording of the individual’s involvement in a matter or event that has no personal connotations. The individual also has to be the focus of the information, rather than some other person with whom that individual may have been involved. The Court of Appeal summarised these two aspects as information affecting a person’s privacy whether in his personal or family life, business or professional capacity.

28. I consider that information relating to activities carried out by a public sector employee in the course of his/her employment can normally be released. Furthermore, the contractual hours connected with a specific position would not, it seems to me, generally constitute personal data, given that they are connected to the post, rather than to the post holder. However, I need to consider whether specific considerations apply in respect of hours of overtime and whether this information affects the privacy of an individual even when acting in a professional capacity.

29. I have been assisted in these deliberations by the position taken by Commissioners and Courts in other jurisdictions where this kind of information has been requested under freedom of information legislation. While these decisions are clearly not binding on me they are helpful in determining the way in which this information is generally perceived.

30. In the case of Rynne and Department of Primary Industries - Letter Decision (21 January 2002) the Information Commissioner of Queensland found that time sheets of a third party concerned the personal affairs of that third party. He indicated that there was a relevant distinction to be drawn in respect of matters that relate to an employee as an individual rather than an employee as agent or representative of the employer. The Commissioner indicated that:

While attendance at a place of work, and performance of allocated duties, does not concern a person’s personal affairs I find that a record of the variable hours worked by and the income earned by, a person comprise information concerning the personal affairs of that person.

31. In the case of Dagg v Canada Minister of Finance [1997] 2 S.C.R 403 the Canadian Courts considered the difference between information that relates to a position and information relating to an individual. In that case the Court found that the hours an individual worked related to the position rather than to the individual. However, in the course of a dissenting judgement La Forest J cited views of the Information Commissioner who had stated that:

The information to which you seek to have access in this case does not, in my view, provide any insight into the position held by nor the functions performed by the persons whose names appear on the sign-in sheets. While it may indicate the hours during which they attended at their work premises on a given day, this is not the type of information which, in my view, Parliament intended should be publicly accessible…….The information at issue here is not at all about the nature of the work of named public officials but only about their specific whereabouts at a specific time. There is simply no indication that Parliament intended this derogation to be interpreted in away which would result in public officials being subjected to a form of physical surveillance through records disclosure.

32. The Virginia Freedom of Information Advisory Council has also considered the issue of whether employee time sheets may be properly exempted under the Virginia Freedom of Information Act as personnel records. In this case, the Advisory Council opined that timesheets include more information than just job classification and rate of pay. They may include information such as whether an employee has been out of the office frequently due to illness or has taken a holiday. In that case, the Advisory Council indicated that, in their view, employee timesheets did amount to personnel records.

33. The reasons why an individual works overtime will vary. An employee may be required to work overtime in order that a specific project is completed within a certain time period. In other cases, the circumstances of a particular project may require it to be carried out outwith normal working hours. In these two examples, the reasons for overtime are connected with specific professional functions. However, an employee may also work overtime because of personal reasons relating to the performance of their work, the quality of the work or reasons relating to annual or special leave.

34. I am of the view that the while the contractual hours would normally relate to the position rather than to the person, hours of overtime will be linked to a named member of staff and therefore relate to that person.

35. Further, the information contained on the claim forms will not simply reveal additional hours worked; they could also provide financial information. With knowledge of the officer's grade, a person in receipt of these forms could be able to calculate how much additional income the named officer has received over the specified time period.

36. In my view, the variable hours a public employee works is personal to them rather than to the position and that disclosure of the specific hours worked by a named individual would affect that individual’s privacy. I do not consider that Parliament intended that information relating to an individual member of staff’s overtime hours would routinely be disclosed to any member of the public who requests it. The nature of overtime is such that it impinges on an individual’s private life in that it usually involves work at weekends and/or evenings. In my view, therefore, information about overtime claims where this relates to a named individual will amount to their personal data.

37. However, even if I am satisfied that the information requested is personal data, section 38(1)(b) requires me to consider whether release of this information would breach any of the data protection principles. In reaching a decision on this issue I must consider whether disclosure can be made to a “member of the public.”

38. The SDEA has cited the first data protection principle which requires processing to be fair and lawful. In particular, the SDEA has stated that processing must be fair. The Information Commissioner, who is responsible for enforcing the DPA, has provided guidance (Freedom of Information Act Awareness Guidance No 1) on the consideration of the data protection principles within the context of freedom of information legislation. This guidance recommends that public authorities should consider the following questions when deciding if release of information would breach the first data protection principle:

a) would disclosure cause unnecessary or unjustified distress or damage to the data subject?
b) would the data subject expect that his or her information might be disclosed to others?
c) has the person been led to believe that his or her information would be kept secret?

39. It seems to me that generally public sector employees would not expect information about their hours of overtime to be disclosed to any member of the public who requests it. In particular, a reasonable person would not expect strangers to have access to detailed, systematic knowledge of an individual’s location during non-working hours, even if that location is his or her workplace.

40. There may, of course, be circumstances where disclosure of a named individual’s overtime claims or overtime hours worked can be justified; where, for example, the recorded information reveals fraud or wrong-doing. There may, of course, be circumstances where disclosure of a named individual’s overtime claims is considered fair; where, for example, the recorded information reveals fraud or wrong-doing. However, even in such cases, careful consideration would need to be given to the particular circumstances of the case before this information should be made public.

41. I am aware that the information is required for court proceedings. That, in itself, does not seem to me to be sufficient grounds for requiring disclosure of this information to the applicant. If the court requires this information to be considered then this is a matter for the court to address.

42. In conclusion, therefore, I am satisfied that details of overtime claimed in relation to a named individual, including the hours claimed, is their personal data. I am also satisfied that in this case disclosure of the information requested by the applicant would be unfair and therefore would be in breach of the first data protection principle. I will not, therefore, go on to consider whether the release would be lawful or whether any of the conditions in schedule 2 and/or 3 to the DPA can be met.

43. Given that I accept that the information requested in this case is exempt under section 38(1)(b) I have not gone on to consider the application of the other exemptions cited by the SDEA.

Decision

I find that the Scottish Drugs Enforcement Agency complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in withholding the information requested by Liam O’Donnell & Co in that the information was exempt under section 38(1)(b).

Kevin Dunion

Scottish Information Commissioner

7 December 2006

Link to PDF file of decision 226/2006 (66.7 kb)