ICO - FS50777458: Difference between revisions

From GDPRhub
No edit summary
 
No edit summary
Line 51: Line 51:
==English Summary==
==English Summary==
===Facts===
===Facts===
The complainant requested copies of minutes for the Wales Interpretation and Translation Service for the public sector from the Cardiff Council, which provided him with redacted copies of the minutes. The complainant filled a complaint with the ICO because they wanted to have access the names of the attendees of the minutes.   
The complainant requested copies of minutes of the Wales Interpretation and Translation Service´ meetings. The Cardiff Council provided him with redacted copies. In particular, the names of the attendees were omitted. In substantiating its response, the Cardiff Council cited section 40(2) and section 43(2) of the FOIA. The complainant filled a complaint with the ICO because he wanted to have access such information.   


===Dispute===
===Dispute===
Is it the data personal data?  Would the disclosure contravene Article 5(1)(a) GDPR? Is the disclose necessary in order to meet accountability and transparency legitimate interests? 
The first step for the Commissioner is to determine whether the exception set forth in Articles 40(2) and 43(2) FOIA apply to the case. 


===Holding===
===Holding===
After having reviewd if the information at stake was personal data and if the disclosure would contravene Articels 5(1)(a) GDPR principle, the ICO assessed whether this disclosure was lawful. The Commissioner went through the three-step test (legitimate interest – necessity - balancing) in order to assess if the conditions of the processing - to disclose -  meet the requirements of Article 6(1)(f) GDPR. It found that the disclosure of the names of the attendees was necessary to satisfy the legitimate public interests of accountability and transparency, which outweigh the data subjects’ fundamental rights and freedoms. Thus, it concluded that there was the legal basis of Article 6(1)(f) GDPR for the processing and it required the public authority to provide a copy of the full minutes to the complainant.  
As per the applicability of Article Articles 40(2) FOIA, it must be determined whether the withheld information constitutes personal data and, in the affirmative, whether disclosure of that data would breach any of the data protection principles under the Data Protection Act.
 
According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.
 
The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".  
 
The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.  
 
The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information and that, as an advocate for the local deaf community, the disclosure is (ii) necessary for meeting a legitimate public interest. Such interest is to be (iii) balanced against the data subjects’ interests whose names were redacted. In doing so, it is necessary to consider inter alia the impact of disclosure.
 
In the Commissioner’s view, a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed. It is also important to consider whether disclosure would be likely to result in unwarranted damage or distress to that individual.
 
Each individual is representing their employer organisation on an important body for the local deaf community. Moreover, the Commissioner has been unable to identify any specific harm or distress that disclosure may cause.
 
Based on the above factors, the Commissioner has determined that there is sufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. The commissioner therefore considers that there is an Article 6 basis for processing (in this case article 6(1)(f). Moreover, the Commissioner specifies that Cardiff Council has failed to demonstrate that the exemption at section 40(2) is engaged. 
 
<u>U</u>nder Article 43(2) FOIA (prejudice to commercial interests) information is exempt from disclosure if its disclosure would or would be likely to prejudice the commercial interests of any person (including the public authority holding it). The Cardiff Council states that “information sought is too commercially sensitive” and that that releasing the information may affect the working relationship between the Council and the third parties which may prejudice the best value achieved by the council.
 
The Commissioner asked the Council to provide full arguments specifying why it considers that the exemption is engaged and pointed out that this should include details of whose commercial interests it believes would be prejudiced in the event of disclosure and details of the nature of the prejudice itself. The Commissioner wrote to the Council pointing out these omissions and notes that it merely repeated the arguments in its previous response. She therefore has no alternative but to conclude that section 43(2) is not engaged in respect of the withheld information.
 
In light of the above, the Commissioner required the public authority to provide a copy of the full, unredacted minutes to the complainant.  
==Comment==
==Comment==



Revision as of 18:05, 20 January 2020

ICO - FS50777458
ICOLOGO.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law: Article 4(1) GDPR

Article 5(1)(a) GDPR

Article 6(1)(f) GDPR

Section 3(2) DPA

40(2) FOIA

Type: Complaint
Outcome: Upheld
Decided: 7.11.2019
Published: n/a
Fine: none
Parties: Wales Interpretation and Translation Service Vs. anonymous
National Case Number: FS50777458
European Case Law Identifier: n/a
Appeal: n/a
Original Language:

English

Original Source: ICO (EN)

The ICO issued a decision on the necessity of a disclosure of information hold by a public entity to satisfy the legitimate public interests of accountability and transparency.

English Summary

Facts

The complainant requested copies of minutes of the Wales Interpretation and Translation Service´ meetings. The Cardiff Council provided him with redacted copies. In particular, the names of the attendees were omitted. In substantiating its response, the Cardiff Council cited section 40(2) and section 43(2) of the FOIA. The complainant filled a complaint with the ICO because he wanted to have access such information.

Dispute

The first step for the Commissioner is to determine whether the exception set forth in Articles 40(2) and 43(2) FOIA apply to the case.

Holding

As per the applicability of Article Articles 40(2) FOIA, it must be determined whether the withheld information constitutes personal data and, in the affirmative, whether disclosure of that data would breach any of the data protection principles under the Data Protection Act.

According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.

The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".

The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.

The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information and that, as an advocate for the local deaf community, the disclosure is (ii) necessary for meeting a legitimate public interest. Such interest is to be (iii) balanced against the data subjects’ interests whose names were redacted. In doing so, it is necessary to consider inter alia the impact of disclosure.

In the Commissioner’s view, a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed. It is also important to consider whether disclosure would be likely to result in unwarranted damage or distress to that individual.

Each individual is representing their employer organisation on an important body for the local deaf community. Moreover, the Commissioner has been unable to identify any specific harm or distress that disclosure may cause.

Based on the above factors, the Commissioner has determined that there is sufficient legitimate interest to outweigh the data subjects’ fundamental rights and freedoms. The commissioner therefore considers that there is an Article 6 basis for processing (in this case article 6(1)(f). Moreover, the Commissioner specifies that Cardiff Council has failed to demonstrate that the exemption at section 40(2) is engaged.

Under Article 43(2) FOIA (prejudice to commercial interests) information is exempt from disclosure if its disclosure would or would be likely to prejudice the commercial interests of any person (including the public authority holding it). The Cardiff Council states that “information sought is too commercially sensitive” and that that releasing the information may affect the working relationship between the Council and the third parties which may prejudice the best value achieved by the council.

The Commissioner asked the Council to provide full arguments specifying why it considers that the exemption is engaged and pointed out that this should include details of whose commercial interests it believes would be prejudiced in the event of disclosure and details of the nature of the prejudice itself. The Commissioner wrote to the Council pointing out these omissions and notes that it merely repeated the arguments in its previous response. She therefore has no alternative but to conclude that section 43(2) is not engaged in respect of the withheld information.

In light of the above, the Commissioner required the public authority to provide a copy of the full, unredacted minutes to the complainant.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English official version

 to be completed..