ICO - FS50839431: Difference between revisions

Revision as of 18:56, 20 January 2020

ICO - FS50839431

Authority:	ICO (UK)
Jurisdiction:	United Kingdom
Relevant Law:	Article 4(1) GDPR Article 5(1)(a) GDPR Article 6(1)(f) GDPR Section 3(2) DPA 40(2) FOIA
Type:	Complaint
Outcome:	Rejected
Decided:	1.11.2019
Published:	n/a
Fine:	None
Parties:	University of Leicester Vs. anonymous
National Case Number:	FS50839431
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language:	English
Original Source:	ICO (EN)

The ICO issued a decisions regarding refusal to access to third party personal data.

English Summary

Facts

The complainant has requested information from University of Leicester about external examiners for the department of engineering between the years 2010 to 2018. The University withheld the information, citing section 40(2) (personal information) of the FOIA.

The complainant challenged the decision before the ICO.

Dispute

The Commissioner considers the scope of her investigation to be to establish whether the Universityis entitled to withhold the requested information under section 40(2) of the FOIA.

Holding

As per the applicability of Article Articles 40(2) FOIA, it must be determined whether the withheld information constitutes personal data and, in the affirmative, whether disclosure of that data would breach any of the data protection principles under the Data Protection Act.

According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.

The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".

The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.

The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information and that the disclosure is (ii) necessary for meeting a legitimate public interest. Such interest is to be (iii) balanced against the data subjects’ interests.

In carrying out the assessment under (iii) it is necessary to consider the impact of disclosure in terms of harm or distress, the reasonable expectations of the individual as well as whether the information is already in the public domain.

Within the University’s response to the Commissioner’s enquiries, it outlined that at the time of the request, the external examiners for that academic year had also been the external examiners for the previous two academic years. Therefore, the University argued, any student who had concerns about any conflicts of interest an external examiner might have had,would already have had two years in which to complain.

Based on the above factors, the Commissioner has determined that there is insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. The Commissioner therefore considers that there is no Article 6 basis for processing and so the disclosure of the information would not be lawful.

In conclusion, the ICO decided that the University was entitled to rely on the exemption at section 40(2) FOIA.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English official version

 to be completed..

@@ Line 53: / Line 53: @@
 ===Facts===
-As reminded by yhe ICO itslef, "the complainant has requested information from University of Leicester about external examiners for the department of engineering between the years 2010 to 2018. The University withheld the information, citing section 40(2) (personal information) of the FOIA. "
+The complainant has requested information from University of Leicester about external examiners for the department of engineering between the years 2010 to 2018. The University withheld the information, citing section 40(2) (personal information) of the FOIA.
 The complainant challenged the decision before the ICO.
 ===Dispute===
-Is the information personal data? Would a disclosure contravene GDPR principles? What are the legitimate interests at stake?
+The Commissioner considers the scope of her investigation to be to establish whether the Universityis entitled to withhold the requested information under section 40(2) of the FOIA.
-Is disclosure necessary?
+===Holding===
+As per the applicability of Article Articles 40(2) FOIA, it must be determined whether the withheld information constitutes personal data and, in the affirmative, whether disclosure of that data would breach any of the data protection principles under the Data Protection Act.
-===Holding===
+According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.
-While balancing legitimate interest in disclosure against data subject’s interest and fundamental rights and freedoms, the Commissioner considered that the public authority would have infringed Articles 5(1)(a) and 6(1)(f) of the GDPR in disclosing this information. It found that the disclosure was not necessary to pursue a legitimate interest and it would have caused unjustified harm to the data subjects. Overall, the interests and rights of the data subjects were likely to override legitimate interest in disclosure. In conclusion, the ICO decision decided that the University was entitled to rely on the exemption at section 40(2) FOIA.
+The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".
+The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.
+The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information and that the disclosure is (ii) necessary for meeting a legitimate public interest. Such interest is to be (iii) balanced against the data subjects’ interests.
+In carrying out the assessment under (iii) it is necessary to consider the impact of disclosure in terms of harm or distress, the reasonable expectations of the individual as well as whether the information is already in the public domain.
+Within the University’s response to the Commissioner’s enquiries, it outlined that at the time of the request, the external examiners for that academic year had also been the external examiners for the previous two academic years. Therefore, the University argued, any student who had concerns about any conflicts of interest an external examiner might have had,would already have had two years in which to complain.
+Based on the above factors, the Commissioner has determined that there is insufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. The Commissioner therefore considers that there is no Article 6 basis for processing and so the disclosure of the information would not be lawful.
+In conclusion, the ICO decided that the University was entitled to rely on the exemption at section 40(2) FOIA.
 ==Comment==