ICO - FS50887618
| ICO (UK) - FS50887618 | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | 40(2) FOIA |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 31.01.2020 |
| Published: | |
| Fine: | None |
| Parties: | [Anonymous City of York Council] |
| National Case Number/Name: | FS50887618 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | n/a |
On the 31st January 2020 the Information Commissioners Office (ICO) supported the position of the City of York Council, finding that details of the Council's employees professional qualifications amounted to personal information. As such, the City of York Council were correct in applying the Section 40(2) Freedom of Information Act 2000 (FOIA) exemption.
English Summary
Facts
The complainant requested the Council provide details of their Conservation Officers and Flood Risk Management Team, including the nature of their employment, salary and professional qualifications. The Commissioner regulates the FOIA and Data Protection Act 2018 (DPA) and so was tasked to consider whether the Council's refusal to supply information requested, which it claimed was personal information and so exempt under Section 40(2) FOIA, was correct application of the law.
whether the information requested amounted to personal information and in
Dispute
The ICO had to assess whether the requested information constitutes personal data according to the DPA. Then, if it is personal data, the ICO must establish whether disclosure could be justified.
Holding
Article 40(2) FOIA provides an exemption against the disclosure of personal information. According to the ICO the information at stake is personal data. The fact that information constitutes the personal data of identifiable living individuals does not automatically exclude it from disclosure under the FOIA.
The second element of the test is to determine whether disclosure would contravene any of the data protection principles. In the present case, the most relevant principle is the one protected under Article 5(1)(a) GDPR: "Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject".
The Commissioner considers that the most likely applicable lawful bases is the legitimate interest of the controller under Article 6(1)(f) GDPR. In considering the application of Article 6(1)(f) GDPR in the context of a request for information under FOIA it is necessary to consider the three-part test: (i) legitimate interest, (ii) necessity and (iii) balancing of conflicting interests.
The Commissioner accepts that the complainant has (i) a legitimate interest in seeing the requested information on the basis of accountability and transparency as well as case specific interests, however disclosure must be deemed (ii) necessary for meeting a legitimate public interest and (iii) balanced against the data subjects’ interests. In doing so, it is necessary to consider inter alia the impact of disclosure.
In the Commissioner’s view, it is likely that those appointed in the specific roles would have had sufficient checks against their qualifications during the recruitment process by the Council and therefore it would be sufficient for the Council to confirm that their employees are sufficiently qualified. This would constitute a less intrusive means of achieving the legitimate aims and so disclosure would not be necessary.
The Commissioner therefore considers that there is no Article 6 basis for processing and so disclosure of the personal data requested would be not be lawful.
Comment
This decision reaffirms previous, similar, decisions;
Further Resources
Share blogs or news articles here!
English official version
to be completed..
