ICO - FS50887618: Difference between revisions

From GDPRhub
(Created page with "{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;" ! colspan="2" |ICO - FS50887618 |- | colspan="2" style="padding: 20px; background-color:#023868;" |F...")
 
No edit summary
 
(One intermediate revision by one other user not shown)
Line 1: Line 1:
{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
{{DPAdecisionBOX
! colspan="2" |ICO - FS50887618
 
|-
|Jurisdiction=United Kingdom
| colspan="2" style="padding: 20px; background-color:#023868;" |[[File:ICOLOGO.png|center]]
|DPA-BG-Color=background-color:#023868;
|-
|DPAlogo=LogoUK.png
|Authority:||[[ICO (UK)]]
|DPA_Abbrevation=ICO (UK)
[[Category:ICO (UK)]]
|DPA_With_Country=ICO (UK)
|-
 
|Jurisdiction:||[[Data Protection in the United Kingdom|United Kingdom]]
|Case_Number_Name=FS50887618
[[Category: United Kingdom]]
|ECLI=
|-
 
|Relevant Law:||[http://www.legislation.gov.uk/ukpga/2000/36/contents 40(2) FOIA]
|Original_Source_Name_1=ICO
|-
|Original_Source_Link_1=https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617161/fs50887618.pdf
|Type:||Complaint
|Original_Source_Language_1=English
|-
|Original_Source_Language__Code_1=EN
|Outcome:||Rejected
|Original_Source_Name_2=
|-
|Original_Source_Link_2=
|Decided:||31.01.2020
|Original_Source_Language_2=
[[Category:2020]]
|Original_Source_Language__Code_2=
|-
 
|Published:||n/a
|Type=Complaint
|-
|Outcome=Rejected
|Fine:||none
|Date_Started=
|-
|Date_Decided=31.01.2020
|Parties:||City of York Council v Anonymous
|Date_Published=
|-
|Year=2020
|National Case Number:||FS50887618
|Fine=None
|-
|Currency=
|European Case Law Identifier:||n/a
 
|-
|GDPR_Article_1=
|Appeal:||n/a
|GDPR_Article_Link_1=
|-
|GDPR_Article_2=
|Original Language:||[[Category:English]]
|GDPR_Article_Link_2=
English
 
|-
|EU_Law_Name_1=
|Original Source:||[https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617161/fs50887618.pdf ICO (EN)]
|EU_Law_Link_1=
|}  
|EU_Law_Name_2=
The ICO issued a decision on the necessity of a disclosure of information held by a public entity to satisfy the legitimate public interests of accountability and transparency.  
|EU_Law_Link_2=
 
|National_Law_Name_1=40(2) FOIA
|National_Law_Link_1=http://www.legislation.gov.uk/ukpga/2000/36/contents
|National_Law_Name_2=
|National_Law_Link_2=
|National_Law_Name_3=
|National_Law_Link_3=
 
|Party_Name_1=City of York Council
|Party_Link_1=Anonymous
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
 
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=
 
|Initial_Contributor=
|
}}
 
On the 31st January 2020 the Information Commissioners Office  (ICO) supported the position of the City of York Council, finding that details of the Council's employees professional qualifications amounted to personal information. As such, the City of York Council were correct in applying the Section 40(2) Freedom of Information Act 2000 (FOIA) exemption.  


==English Summary==
==English Summary==
===Facts===
===Facts===
The complainant requested copies of minutes of the Wales Interpretation and Translation Service´ meetings. The Cardiff Council provided him with redacted copies. In particular, the names of the attendees were omitted. In substantiating its response, the Cardiff Council cited section 40(2) and section 43(2) of the FOIA. The complainant filled a complaint with the ICO because he wanted to have access to such information. 
The complainant requested the Council provide details of their Conservation Officers and Flood Risk Management Team, including the nature of their employment, salary and professional qualifications. The Commissioner regulates the FOIA and Data Protection Act 2018 (DPA) and so was tasked to consider whether the Council's refusal to supply information requested, which it claimed was personal information and so exempt under Section 40(2) FOIA, was correct application of the law.  
 
whether the information requested amounted to personal information and in   


===Dispute===
===Dispute===
The first step for the Commissioner is to determine whether the exception set forth in Articles 40(2) and 43(2) FOIA apply to the case.   
The ICO had to assess whether the requested information constitutes personal data according to the DPA. Then, if it is personal data, the ICO must establish whether disclosure could be justified.   


===Holding===
===Holding===
As per the applicability of Article Articles 40(2) FOIA, it must be determined whether the withheld information constitutes personal data and, in the affirmative, whether disclosure of that data would breach any of the data protection principles under the Data Protection Act.  
Article 40(2) FOIA provides an exemption against the disclosure of personal information. According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.  
 
According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.  


The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".  
The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".  
Line 54: Line 79:
The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.  
The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.  


The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information and that, as an advocate for the local deaf community, the disclosure is (ii) necessary for meeting a legitimate public interest. Such interest is to be (iii) balanced against the data subjects’ interests whose names were redacted. In doing so, it is necessary to consider inter alia the impact of disclosure.  
The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information on the basis of accountability and transparency as well as case specific interests, however disclosure must be deemed (ii) necessary for meeting a legitimate public interest and (iii) balanced against the data subjects’ interests. In doing so, it is necessary to consider inter alia the impact of disclosure.  


In the Commissioner’s view, a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed. It is also important to consider whether disclosure would be likely to result in unwarranted damage or distress to that individual.  
In the Commissioner’s view, it is likely that those appointed in the specific roles would have had sufficient checks against their qualifications during the recruitment process by the Council and therefore it would be sufficient for the Council to confirm that their employees are sufficiently qualified. This would constitute a less intrusive means of achieving the legitimate aims and so disclosure would not be necessary.


Each individual is representing their employer organisation on an important body for the local deaf community. Moreover, the Commissioner has been unable to identify any specific harm or distress that disclosure may cause.
The Commissioner therefore considers that there is no Article 6 basis for processing and so disclosure of the personal data requested would be not be lawful.  
 
==Comment==
Based on the above factors, the Commissioner has determined that there is sufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. The commissioner therefore considers that there is an Article 6 basis for processing (in this case article 6(1)(f). Moreover, the Commissioner specifies that Cardiff Council has failed to demonstrate that the exemption at section 40(2) is engaged.


<u>U</u>nder Article 43(2) FOIA (prejudice to commercial interests) information is exempt from disclosure if its disclosure would or would be likely to prejudice the commercial interests of any person (including the public authority holding it). The Cardiff Council states that “information sought is too commercially sensitive” and that that releasing the information may affect the working relationship between the Council and the third parties which may prejudice the best value achieved by the council.
This decision reaffirms previous, similar, decisions;


The Commissioner asked the Council to provide full arguments specifying why it considers that the exemption is engaged and pointed out that this should include details of whose commercial interests it believes would be prejudiced in the event of disclosure and details of the nature of the prejudice itself. The Commissioner wrote to the Council pointing out these omissions and notes that it merely repeated the arguments in its previous response. She therefore has no alternative but to conclude that section 43(2) is not engaged in respect of the withheld information.  
[https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616304/fs50819174.pdf ICO - FS50819174]


In light of the above, the Commissioner required the public authority to provide a copy of the full, unredacted minutes to the complainant.  
[https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2615914/fs50849126-1.pdf ICO - FS50849126]
==Comment==


''Share your comments here!''
[https://ico.org.uk/media/action-weve-taken/decision-notices/2017/2014311/fs50668506.pdf ICO - FS50668506]


==Further Resources==
==Further Resources==

Latest revision as of 16:39, 7 March 2022

ICO (UK) - FS50887618
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law:
40(2) FOIA
Type: Complaint
Outcome: Rejected
Started:
Decided: 31.01.2020
Published:
Fine: None
Parties: [Anonymous City of York Council]
National Case Number/Name: FS50887618
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): English
Original Source: ICO (in EN)
Initial Contributor: n/a

On the 31st January 2020 the Information Commissioners Office (ICO) supported the position of the City of York Council, finding that details of the Council's employees professional qualifications amounted to personal information. As such, the City of York Council were correct in applying the Section 40(2) Freedom of Information Act 2000 (FOIA) exemption.

English Summary

Facts

The complainant requested the Council provide details of their Conservation Officers and Flood Risk Management Team, including the nature of their employment, salary and professional qualifications. The Commissioner regulates the FOIA and Data Protection Act 2018 (DPA) and so was tasked to consider whether the Council's refusal to supply information requested, which it claimed was personal information and so exempt under Section 40(2) FOIA, was correct application of the law.

whether the information requested amounted to personal information and in

Dispute

The ICO had to assess whether the requested information constitutes personal data according to the DPA. Then, if it is personal data, the ICO must establish whether disclosure could be justified.

Holding

Article 40(2) FOIA provides an exemption against the disclosure of personal information. According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.

The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".

The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.

The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information on the basis of accountability and transparency as well as case specific interests, however disclosure must be deemed (ii) necessary for meeting a legitimate public interest and (iii) balanced against the data subjects’ interests. In doing so, it is necessary to consider inter alia the impact of disclosure.

In the Commissioner’s view, it is likely that those appointed in the specific roles would have had sufficient checks against their qualifications during the recruitment process by the Council and therefore it would be sufficient for the Council to confirm that their employees are sufficiently qualified. This would constitute a less intrusive means of achieving the legitimate aims and so disclosure would not be necessary.

The Commissioner therefore considers that there is no Article 6 basis for processing and so disclosure of the personal data requested would be not be lawful.

Comment

This decision reaffirms previous, similar, decisions;

ICO - FS50819174

ICO - FS50849126

ICO - FS50668506

Further Resources

Share blogs or news articles here!

English official version

 to be completed..
Retrieved from "https://gdprhub.eu/index.php?title=ICO_-_FS50887618&oldid=24213"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki