Contact: Kevin Gardner, Head of Legal Practice, ext 7381

1 Summary

This report advises the Governance Committee on certain issues that have arisen in the operation of the Freedom of Information Act ("the Act") with regard to the handling of requests for disclosure of information that includes personal information. In particular, these issues have arisen in relation to requests for disclosure of details of remuneration of the Council's staff, and requests for disclosure of internal audit reports. The report also relates some concerns arising as to the costs of compliance with certain time-consuming requests. The arguments for and against disclosure of information in the public interest are considered, and recommendations made as to the way forward.

2 Recommendations

2.1 That the Committee consider whether the public interest requires greater disclosure by the Council of staff salary information than is the case at present. If the Committee considers that, in principle, this should be explored, the Chief Executive and Director of HR be authorised to undertake consultation with staff generally on the development of a disclosure policy, to be reported back to the Committee for further consideration.

2.2 That the position with regard to the handling and determination of requests under the Act, for disclosure of internal audit reports, is noted.

3 Background

3.1 The Act, which came fully into force on 1 January 2005, promotes a culture of greater openness and accountability amongst public sector bodies, by giving members of the public rights of access to the information held by those bodies. The intention is that these rights will enable the public to have a better understanding of how public authorities carry out their duties, why they make the decisions they do and how they spend public money. In this respect, the Act complements rights of access to information already available under the Data Protection Act 1998 ("DPA"), the Environmental Information Regulations 2004 and, in the case of local authorities, the access to information regime under local government legislation. The Act facilitates access to information held by public bodies in two ways.

3.2 Firstly, there is a requirement for each public authority to adopt and maintain a publication scheme, setting out the types of information which it willingly makes available to the public. It is intended that this should have the effect of improving the amount and quality of information routinely made available to members of the public. The County Council's Publication Scheme was approved by the Information Commissioner and published by February 2003, within the statutory time scale. The Publication Scheme has been maintained since that date.

3.3 Secondly, the Act gives members of the public the right to submit an individual request for particular information. It is this right which became effective from 1^st January 2005. From that date, anyone has been able to ask a public authority to supply any information it holds. This right can be exercised by people living anywhere in the world, including journalists, political parties, lobby groups and commercial organisations. In most cases, a public authority has a maximum of twenty working days to respond to the request. If the authority holds the information requested, it must supply it unless the information falls within a category which is exempt from disclosure under the Act.

3.4 The right of access to information is subject to a range of exemptions. Some of the exemptions are "absolute", which means that the information in question does not have to be disclosed under the Act, although discretionary release is still possible. Where an absolute exemption does not apply, consideration needs to be given to whether any of the other "qualified" exemptions in the Act are relevant. Where a qualified exemption applies, it is then necessary to apply the "public interest test". This means that, unless the public interest in maintaining the exemption (i.e. withholding the information) outweighs the public interest in disclosing it, the information must be released.

3.5 Prior to implementation, the Executive Member, Policy and Resources, welcomed the Act as an opportunity to further enhance the County Council's arrangements for openness and accountability in relation to its affairs and to encourage participation in local issues. Since 1 January 2005, the Council has handled 1,051 requests , 79% of which have resulted in full or partially edited disclosure of the information requested. 17% of requests have been refused, and 4% are currently in progress. In practice, this has meant that many ordinary people have been able to further their interests in matters and projects affecting their local community, by seeking and being given further information by the Council, in most cases at no cost to them. However, a minority of requests have given rise to some issues where disclosure would involve releasing information concerning particular individuals, or supplied by individuals in confidence. These are considered further below.

4 Issue 1: Staff Salary Information

4.1 Some requests have been received seeking disclosure of the remuneration paid to Council staff. One request sought information on the number of Council staff receiving total remuneration of £100,000 or more per annum, and the name, position and total remuneration of each individual concerned. The request sought a breakdown of remuneration received into base salary, bonuses, and other benefits, and the total cash equivalent transfer value of each individual's pension by year end. Another request sought the job titles and salary bands for all staff earning above £50,000 in £10,000 pay brackets.These requests were refused, although in response to the latter request, a generic table of job categories and salaries for Council staff earning above £50,000 has been published.

4.2 Under the Act, there is a general right of access to information held by public authorities, unless that information falls within a category of exemption in the Act. The exemption that requires consideration in relation to requests for staff salary details is that in S.40(2) of the Act, regarding personal information. Although this exemption is worded quite technically, it can be summarised as applying in the current case where (1) the information is "personal data" and (2) disclosure of that data would contravene any of the data protection principles in the DPA.

4.3 Is the information in question personal data?

"Personal data " is personal information about a living individual who can be identified. In other words, if it is known that a member of staff's job title is X and the pay bracket for X is disclosed, that will be personal data, as the member of staff's remuneration can be identified from it.

4.4 Would disclosure breach the data protection principles?

4.4.1 There are eight data protection principles which, taken together, form the basic standard to which those processing personal data must operate. In practice, when considering an application from a third party for personal data to be disclosed, the key issue will be whether disclosure would breach the first data protection principle. This requires that personal data be processed "fairly and lawfully".

4.4.2 An example of where disclosure would be unlawful would be where this amounted to a breach of confidence e.g. where the information disclosed about a staff member was sensitive medical information or personal banking/financial details.

4.4.3 As for whether disclosure of the information would be unfair, guidance issued by the Information Commissioner suggests that a number of questions should be asked:

- would the disclosure cause unnecessary or unjustified distress or damage to the person?

- is disclosure compatible with the purposes for which the personal information was obtained?

- has the person been led to believe that his or her information would be kept secret?

- has the person expressly refused consent to the information being disclosed?

- does the legitimate interest of a member of the public seeking information about a public authority, including personal information, outweigh the rights, freedoms and legitimate interests of the data subject?

4.4.4 The Commissioner's guidance also states:

"In thinking about fairness, it is likely to be helpful to ask whether the information relates to the private or public lives of the third party. Information which is about the home or family life of an individual, his or her personal finances, or consists of personal references, is likely to deserve protection. By contrast, information which is about someone acting in an official or work capacity should normally be provided on request unless there is some risk to the individual concerned."

"While it is right to take into account any damage or distress that may be caused to a third party by the disclosure of personal information, the focus should be on damage or distress to an individual acting in a personal or private capacity. The exemption should not be used, for instance, as a means of sparing officials embarrassment over poor administrative decisions."

"An issue which will often arise is whether the DPA prevents the disclosure of information about members of staff. Applying the (above) criteria, if the information requested consists of job functions, grades or decisions which they have made in their official capacities, then disclosure would normally be made. On the other hand, information such as home addresses or internal disciplinary matters would not normally be disclosed. While it would be wrong to disclose bank account details of staff, it would be unlikely to be unfair to publish details of expenses incurred in the course of official business, information about pay bands, or, in the case of senior staff, details of salaries and other benefits. While this information clearly does relate to staff personally, there is a strong public interest in provision of information about how a public authority has spent public money."

"These are not hard and fast rules. While names of officials in public facing roles would normally be provided on request, it may not be fair processing to provide the name of a member of staff in a junior role. There may also be good reason not to disclose the names of those in a public facing role if there is good reason to think that disclosure of that information could put someone at risk. It may be unfair processing to disclose the full names and work locations of those who carry out a role involving a risk of harassment or abuse. It may also be relevant to think about the seniority of staff generally: the more senior a person is the less likely it will be that to disclose information about him or her acting in an official capacity would be unfair."

4.5 The request for information of staff earning more than £100,000 per annum was refused following an internal review, in the course of which those staff who would be affected by disclosure were consulted. Their responses did bring forward some considerable concern as to ways in which their rights, freedoms and/or legitimate interests may be prejudiced by disclosure. These included:

- prejudice to an individual's personal financial affairs as a result of details of these being made public

- prejudice to an individual's partner and children as a result of their family income being made public

- publication was likely to lead to media comment and speculation which would be damaging to the wellbeing of staff and their families

- publication was likely to damage relationships with other agencies with whom the Council works in partnership on key public service projects.

4.6 A point made by the person seeking disclosure of staff salary details in excess of £100,000 per annum was that "it is not unfair to expect that if you take the public's money you will need to account for yourself to the public - that involves, at the very least, telling the public who you are, how much of their money you are taking, and for what purpose." After careful consideration, it was concluded that this point did not justify the level of disclosure sought. This was on the basis that the Council already publishes information in its annual Statement of Accounts as to the numbers of employees whose remuneration, excluding pension contributions, was £50,000 or more, in bands of £10,000, in the relevant financial year. This is in accordance with Regulation 7 of the Accounts and Audit Regulations 2003. These Regulations set out the requirements for the Council to account publicly for its expenditure of public money in connection with its functions, through published annual accounts.

4.7 Further, Section 15 of the Audit Commission Act 1998 provides that the right of interested persons to inspect the Council's annual accounts at the time of audit expressly excludes personal information about a member of staff, and does not require personal information to be disclosed in answer to any question. Personal information in this context specifically includes "payments or other benefits in respect of an office or employment" (S.15(4)). It was concluded that, if the principles of openness and accountability in the use of public finances required the salary details of named staff to be published, then it would be reasonable to expect this to be reflected in the public accounting requirements to which the Council is subject. It was felt that this legislation struck an appropriate balance between the public interest in transparency and accountability in the use of public funds, and the public interest in protecting the privacy of individuals. Having regard to these express statutory provisions, it was decided that publishing the detail requested could not be justified on public interest grounds. The request was therefore refused.

4.8 The request for disclosure of job titles and salary bands for all staff earning above £50,000 in £10,000 pay brackets was also refused on the grounds that this would involve unfair processing of personal data. However, a generic table of job categories and salaries for Council staff earning above £50,000, which does not identify individual post holders, has been published. It was also stated that the Council would seek guidance from the Information Commissioner on the determination of such requests. Such guidance has been received and is attached as an Appendix.

4.9 The above sets out the basis on which such requests have been determined to date. However, it is a fact that certain other public authorities have responded to similar requests by publishing more detailed information about the remuneration of certain of their senior staff, although it is not known whether this was done with the consent of those affected, or the extent to which the considerations outlined above were taken into account in making the decision to publish. Further, the guidance attached from the Information Commissioner confirms that, in his view, "there is a greater expectation that more information about staff in certain roles, such as those carrying out public facing roles, and those in more senior positions would be disclosed."

4.10 The Committee is invited to consider whether the public interest requires greater disclosure by the Council of staff salary information than is the case at present. If the Committee considers that, in principle, this should be explored, then the Committee is advised to authorise the Chief Executive and Director of HR to undertake consultation with staff generally on the development of a disclosure policy. This would identify the degree of information that should be made publicly available in relation to particular groups, or grades, of staff. Consultation would take place via normal communication channels, such as Hantsnet, The Hog, at team meetings, with trade union representatives, and with representatives of school governing bodies. The disclosure policy would then be brought to Members for approval.

5 Issue 2: Audit Reports

5.1 The second area to be considered, where disclosure of information requested may involve disclosure of personal information, is in relation to internal audit reports. The exemptions that will normally be relevant here are:

- disclosure would prejudice the audit functions the Council has in relation to other public authorities e.g. maintained schools (S.33 of the Act). This is a qualified exemption, in which case it is also necessary to consider whether the public interest in maintaining the exemption (i.e. withholding the information) outweighs the public interest in disclosing it;

- disclosure would mean releasing personal information in contravention of the DPA (S.40(2)). This is an absolute exemption and the considerations that apply here are examined in section 4 above; and

- disclosure would be an actionable breach of confidence i.e. a breach of confidence in respect of which legal proceedings could be brought (S.41). This is also an absolute exemption, although consideration of whether the breach is "actionable" necessitates consideration of whether the disclosure is in the public interest.

5.2 Guidance has been issued on the exemption in Section 33 (prejudice to audit functions) by the Ministry of Justice. This Guidance acknowledges that publication of an audit report may harm relations between the auditors and the body audited, and so affect the ability of the auditors to carry out their functions effectively. In general, "it is better if information is made available voluntarily within the context of an open and effective relationship. Moreover, auditors may also rely on information from third parties which sometimes provides a more accurate assessment of a public authority's accounts, or the efficiency/effectiveness with which it carries out its functions. If the disclosure of information by the auditors would make it less likely that such information would be volunteered in the future it would be likely to prejudice the audit function."

5.3 The Guidance also states that "Disclosure of audit methods after an audit may also prejudice subsequent audits where, for example, an auditor intends to use the same method. Releasing information about how the auditing body derives its conclusions could also prejudice the audit function for the same reason."

5.4 The Guidance suggests that disclosure of a report before it is finalised may also prejudice the audit function, as "this might pre-empt the proper reporting process and might lead to preliminary findings that had not been fully tested being given the same currency as fully tested conclusions. This might undermine the fairness of the audit process and create a misleading impression of both the auditor and the body being audited, causing unwarranted damage to either reputation."

5.5 With regard to the public interest test, the Guidance states "While the nature, degree and probability of any likely prejudice must always be taken into account, there is a clear public interest in good audit of public authorities. The audit process facilitates the accountability and transparency of public authorities for decisions taken by them, which in turn facilitates accountability and transparency in the spending of public money. And most value-for-money audits lead to a public report with these express aims. There is therefore a clear public interest in protecting the effectiveness of the audit process. But there is also a counter-balancing public interest in making available information which would lead to greater public confidence in the integrity of the audit process by allowing scrutiny, not only of the audited body, but also the auditor's performance."

5.6 The Guidance also recognises that there will be times when a final audit report is not published: "This is likely to be in instances where either the audited body commissions a report into some aspect of its organisation or performance, or where the auditor decides to complete a report for the management of the public body for similar reasons. There is an obvious public interest in ensuring that public bodies improve their efficiency and the delivery of services. Experience has shown that such reports are often enhanced by the frankness and candour with which the advice is given. Releasing this information might therefore reduce the effectiveness of the reports and in turn reduce their usefulness to the public body being audited. In these circumstances the audit function would be prejudiced."

5.7 The exemption for personal information (S.40(2)) will be relevant where an audit report identifies an individual as the source, or subject of, information. However, the principles set out at Appendix A would need to be considered, as it may still be appropriate in all the circumstances for all or some of such information to be disclosed, or redacted from (i.e. edited out of) the published document.

5.8 The exemption for information provided in confidence (S.41) may be relevant where an individual has co-operated with the audit process and given information on the basis that they will not subsequently be publicly identified as its source. The Ministry of Justice Guidance recognises that information volunteered by third parties is important to the effectiveness of the audit process (see paragraph 5.2 above). However, as disclosure of information is, ultimately, subject to the provisions of the Act, an auditor can never give an individual a guarantee that information provided will never be disclosed. It is possible that, where an audit reveals very serious matters, the public interest in the disclosure of the findings will outweigh the public interest in maintaining the exemption.

5.9 Guidance published by the Information Commissioner on the S.33 exemption supports that of the Ministry of Justice, and suggests further that auditor should clarify with the auditable body, at the outset of an audit, what information may be freely disclosed to enquirers and which would raise concerns. The Guidance also advocates making as much information as possible available through the Publication Scheme. Consideration could be given to making available non-confidential summaries of audit reports in this way.

5.10 Having regard to all of the above, the position is that a request for disclosure of an internal audit report will be determined on a case by case basis, with regard to the Guidance issued by the Ministry of Justice and Information Commissioner. In practice, this is likely to mean that "routine" audit reports will normally be exempt from disclosure.

6. Costs of Compliance

6.1 The Council's general obligation under the Act to respond to requests does not apply where it assesses that the costs of compliance with the request would exceed "the appropriate limit". Legislation sets this limit at £450, and prescribes how the costs of compliance are to be calculated. This is by reference to the time that would need to be taken to determine whether the information in question is held, and if so, the time then taken to locate, retrieve and extract it, calculated on the basis of an hourly rate of £25. In practice this means that, if the activities referred to would take more than 18 hours of officer time, the request does not have to be responded to (although there is a discretion to do so).

6.2 The time taken in determining whether exemptions apply to the request may not be taken into account in assessing costs of compliance. In 2007, the Ministry of Justice consulted on a possible change to the law so that this factor could be taken into account, but decided against any change.

6.3 Recent advice from the Information Commissioner is that his interpretation of the current legislation is that the time taken "extracting" the information requested does not include time taken redacting (i.e. editing out ) exempt information from documents. This is despite the Ministry of Justice guidance on the matter specifically stating that time spent redacting exempt information can be included in the costs assessment. It is difficult to see the practical distinction between extracting non-exempt information from a set of documents for disclosure, and editing exempt information from those documents - both processes involving the separation of exempt and non-exempt information. Further, it is difficult to justify the Commissioner's interpretation, when one considers that the reason for having an "appropriate limit" in the first place is to keep some sense of proportion to the time spent in handling information requests, recognising this must be balanced with the important task of delivering other public services.

6.4 General application of the Commissioner's interpretation of the law would have significant implications for the time spent by staff of public authorities in responding to larger and more time-consuming requests where extensive editing of personal or other exempt information was necessary. This is a particular concern, as the Council does receive a certain number of wide-ranging and time-consuming requests, where some may question the general public interest value of the information being sought. The matter is being raised with the Information Commissioner so that clarification can be obtained. If necessary, the need for clarification or amendment of the legislation may be a matter for taking further.

7 Conclusion

It is important to remember that the majority of requests for information received by the Council are relatively straightforward and readily agreed, promoting greater transparency and understanding of public affairs. However, this report has examined issues that arise in two particular areas, where requests for disclosure of information under the Act involve disclosure of information concerning individuals, or supplied by individuals in confidence, and some concerns about the cost implications of compliance.The Council's practice is to balance the case for, and against, disclosure, giving very careful consideration to these arguments, while having regard to the Act, relevant guidance and public interest factors.

8 Recommendations

8.1 That the Committee consider whether the public interest requires greater disclosure by the Council of staff salary information than is the case at present. If the Committee considers that, in principle, this should be explored, the Chief Executive and Director of HR be authorised to undertake consultation with staff generally on the development of a disclosure policy, to be reported back to the Committee for further consideration.

8.2 That the position with regard to the handling and determination of requests under the Act, for disclosure of internal audit reports, is noted.

Section 100 D - Local Government Act 1972 - background documents

The following documents disclose facts or matters on which this report, or an important part of it, is based and have been relied upon to a material extent in the preparation of this report.

NB: the list excludes:

1. Published works

2. Documents which disclose exempt or confidential information as defined in the Act.

TITLE: LOCATION:

Decision notices Chief Executive's Dept files

Guidance by Ministry of Justice Ministry of Justice website: http://www.justice.gov.uk

Guidance by Information Commissioner Information Commissioner website: http://www.ico.gov.uk