Mr Cox

C/o whatdotheyknow.com

3 June 2009

Dear Mr Cox

Request for Information - reference 3360

Thank you for your request which was received by the Assembly Government on 8 May 2009 and further to our request to you for clarification on 13 May. You have asked for:

With regard to the request for all the names of employees who have attended Common Purpose courses, our view is that the disclosure of the personal data requested would be unfair within the meaning of the first data protection principle. Part II of Schedule 1 to the DPA sets out how the principle of fairness is to be interpreted. It states that, in deciding whether personal data is processed fairly, regard must be had to whether any person from whom it was obtained is deceived or misled as to the purpose or purposes for which they are to be processed.

The DPA also requires the data controller to ensure, so far as is practicable, that the individual knows the purposes for which his or her personal data is to be processed, and any further information which is necessary to enable the proposed processing to be fair.

Generally, once a data subject has been informed of the parameters of what will happen to his data, if a data controller carries out processing which is outside those parameters, that processing will be unfair.

In considering whether disclosure would be fair, the question is whether those employees' of the Welsh Assembly Government, who attended Common Purpose's courses would have been made aware that their personal data may be disclosed to the public at large, as a result of the Welsh Assembly Government's response to a FOI request. Even having regard to an individuals public and private role the answer to this is no. In addition, training identified and attended by a member of staff is a development matter which is personal to that member of staff.

In considering the subject of fairness, in respect of non-sensitive personal data, it is a requirement of the first data protection principle that at least one condition in Schedule 2 to the DPA must be met before personal data can be processed. Bearing in mind the points being made above, I do not consider that any condition would be met in relation to the disclosure of the information to which you seek access to.

I have particularly considered Condition 6 in Schedule 2. However, I do not consider that the disclosure of the information you seek is necessary for the purposes of a legitimate interest pursued by the Welsh Assembly Government or a third party. As a public authority is required to be blind to the purpose, blind as to the use of the information sought and the identity of the applicant, the third party I have regard for in this particular case is a member of the general public.

Your request was considered according to the principles set out in the Assembly's Code of Practice on Public access to Information (third edition). The Code is published on the Internet at www.information.wales.gov.uk. If you prefer, I can send you a printed copy.

Part I of Schedule 1 DPA - second data protection principle

The Welsh Assembly Government considers that the disclosure would also contravene the second data protection principle. This requires that personal data must be obtained only for one or more specified and lawful purposes, and shall not be processed further in any manner incompatible with that purpose or purposes.

The Information Commissioner's Legal Guidance on the Data Protection Act (available on-line at www.informationcommmissioner.gov.uk) advises that the Commissioner takes a strict view of the concept of compatibility. The Commissioner also cross-refers to the DPA's interpretative provisions on the meaning of fairness, as set out in relation to the first data protection principle above. The DPA says that, in determining whether personal data is processed fairly, regard is to be had to whether the data subject has been deceived or misled as to the purposes for which their personal data is to be processed. The Commissioner says that this is material in considering whether further processing is incompatible with the specified purposes.

The Commissioner's guidance suggests, therefore, that the scope of the second principle overlaps with that of the first, and is essentially a requirement of fairness. As the disclosure to the public, of employees' names who attended Common Purpose training, was not within the reasonable contemplation of these individuals' when the original processing purposes were specified to them, disclosure would be unfair and would amount to "incompatible processing" and would therefore breach both the first and second data protection principles.

The information requested is therefore exempt from disclosure by virtue of section 40(2) FOIA.

Copies of invoices are only available in hard copy. Please supply a full postal address for copies to be sent to you. [Author ID1: at Fri May 29 11:43:00 2009 ]

If you believe that I have not applied the Code of Practice on Public Access to Information correctly or have not followed the relevant laws, please contact me to request a first stage review. If, after that, you are still not satisfied you may request a formal review by the Assembly Government. When dealing with any concerns, we will follow the Assembly Government's Code of Practice on Complaints which is available on the Internet at www.wales.gov.uk or by post.

You also have the right to complain to the Information Commissioner. Normally, however, you should pursue the matter through our internal procedure before you complain to the Information Commissioner. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 01625 545 745
Fax: 01625 524 510

Email: [email address]

Also, if you think that there has been maladministration in dealing with your request then you may make a complaint to the Public Services Ombudsman for Wales who can be contacted at:

Public Services Ombudsman for Wales
Ffordd yr Hen Gae
Pencoed
Bridgend
CF35 5LJ

Any information released under the Freedom of Information Act 2000 or Environmental Information Regulations 2004 will be listed in the Assembly Government's Disclosure Log (at www.information.wales.gov.uk).

.

Yours sincerely

Lynne Hamilton Knight

HR Strategy and Change

Yr Adran Adnoddau Dynol

Human Resources Department

Parc Cathays ▪ Cathays Park

Caerdydd ▪ Cardiff

Caerdydd ▪ Cardiff

CF10 3NQ

Ffôn * Tel 029 02821767

Ffacs * Fax 029 2082 5114

[email address]