23-24/83

I refer to your request for information dated 26 January 2024 (FOI 23 - 24 / 83) in which you asked for information on the Register of the General Teaching Council for Scotland.

Specifically, you asked for information on all current registrations to include Sex, Registration Status, Qualification, Last Known Employer, Fitness to Teach, Standard for Headship and Professional Recognition. You also clarified that this information should be provided in .csv or .xls format.

I have attached that information which was available on category of registration (currently known as ‘qualification’ on Search the Register) as data extracted on 11 February 2024 and sex, registration status, last known employer, Fitness to Teach, Standard for Headship and Professional Recognition as data extracted on 9 February 2024. Please note that we rely on Registrants to provide information on their current Employer, therefore, where none has been provided this is reflected in the enclosure.

You will see that I have not provided all the requested areas with Registrants listed as requested since this could identify individuals. Providing all these categories with individual Registrants listed could identify these individuals and would breach the data protection principles set out in data protection legislation. FOISA does not require us to provide this information as it is exempt under section 38(1)(b).

However, to provide as much information as possible without enabling individuals to be identified, I have provided the total amounts of Registrants in the enclosure for those areas where the individuals would be identified through filtering of the spreadsheet. Please note that Table 4 displays the number of Registrants with “Y” shown on the Search the Register. A description of what each means is provided on the Member of the Public Search.

By way of advice and assistance under section 15 of FOISA, I can clarify that whilst there is a Search the Register functionality which the public uses to identify applicable categories, an individual must first know the name of the Registrant for the search to work. Should we provide all the areas under your request with each individual listed this could enable individuals to be identified without first knowing their name.

I hope this information is helpful. If you are dissatisfied with this response, you may contact informationgovernance@gtcs.org.uk to request GTCS conduct a review of this decision. You should describe the original request and explain your grounds of review. You have 40 working days from receipt of this decision to submit a review request. When the review process has been completed, if you are still dissatisfied, you may use the Scottish Information Commissioner`s guidance on making an appeal to make an appeal to the Commissioner.

I refer to your request dated 23 February 2024 (FOI 23-24/16) for a review of the response you received on the same date to your original information request (FOI23-24/83) dated 26 January 2024. I have been appointed to undertake the internal review.

I have considered your original request for information, your review request, and our organisation’s obligations under the Freedom of Information (Scotland) Act 2002 (FOISA). For the reasons set out below, I have concluded that the original decision should be upheld without modification.   

Your original request  

In your original request you stated the following: 

Would it be possible to get information on all current registration to GTCS? This file would have about 80,000 rows and be about 10 MB in size, but even an old laptop can easily handle this and I think the information could be useful.

If possible I would like columns for Sex, Registration Status, Qualification, Last Known Employer, Fitness to Teach, Standard for Headship and Professional Recognition. (i.e. the information currently available to the public on the register but not including First Name and Surname).

We provided you with the number of Registrants in each of the categories under your request however, we cited section 38(1)(b) of FOISA as an exemption to providing all of the categories alongside each other as this could enable individuals to be identified.

On 23 February 2024, you sent an email requesting we review our decision under section 20(1) of FOISA.  

Your internal review request  

In your review request of 23 February 2024, you state:

The information I asked for was not released. I think that releasing the requested information would not breach the data protection principles set out in data protection legislation.

You further stated on 25 February 2024:  

Just to clarify it would be great to get all of the information requested, but the main columns I am interested in are 'Registration Status', 'Qualification', 'Last Known Employer' and 'Standard for Headship'.

I believe similar information is already available in table 8.9 and I think it would be useful for citizens interested in education to be able to have another data source.  

Please see our response to your request for an internal review below.

Our response 

Firstly, please note that while you state that the information you asked for “was not released” this is not strictly accurate. You asked for all the categories of information held on our Search the Register functionality to be released. Whilst you did not receive each category as it applied to an individual we did aggregate the amounts and provide you with totals to protect the personal data of Registrants whose information we are required to process lawfully as a data controller.

Based on your request you have asked that we provide all the information that applies to a Registrant from the various categories in a single spreadsheet. As stated in our response, providing all these categories with individual Registrants listed against their applicable data could identify them and this would breach the data protection principles set out in data protection legislation.  

Specifically, this would disclose their “personal data” which is defined as “any information relating to an identified or identifiable living individual” under section 3(2) of the Data Protection Act (2018).  Furthermore, section 3(3)(a) further defines “identifiable living individual” as identifiable by their “name, an identification number, location data or an online identifier” as factors to consider when identifying personal data. Clearly, disclosing their Qualification, location of their Employer and Registration Status would amount to a breach of personal data under section 3(3)(a) of the Act.

Even if we were to remove only the name of the Registrant and still disclose their Sex, Registration Status, Qualification, Last Known Employer, Fitness to Teach, Standard for Headship and Professional Recognition in a single spreadsheet this information could be filtered to identify a single person. Individually these categories do not narrow the population down to identify an individual when used in conjunction with the other categories, a disclosure such as you requested makes it possible to identify individuals.

For example, if a recipient of the response were to filter the spreadsheet to identify a fully registered Male, qualified in a Secondary Education subject, working for Glasgow City Council with a Fitness to Teach decision holding the Standard for Headship and a Professional Recognition award then this would narrow to a single person and disclose their identity. Whilst the Search the Register functionality would display this information to the public, an individual must first know the name of the Registrant for the search to display these categories of information.  

We are guided by a decision of the Office of the Scottish Information Commissioner (Decision 052/2021) which held that the Commissioner must “consider whether, if the numbers were disclosed into the public domain, third parties (including the Applicant) would be able to identify persons from the numbers and from other information in the public domain.” Clearly, under FOISA, if we disclose information to one person, we are expected to disclose it to all. While you may not be able to identify individuals from the information you have requested, others may be able to do so and this would amount to a breach of data protection principles contained under Article 5 of the UK GDPR and section 38(1)(b) read with section 38(2A)(a) of FOISA.  

In your review request you state that you “think that releasing the requested information would not breach the data protection principles set out in data protection legislation” referenced in our response.  

As we have explained above, this information would amount to personal information, however, personal data can still be lawfully disclosed where it would serve a legitimate interest under Article 6(1)(f) of the UK GDPR where it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data....”

To consider whether this disclosure under FOISA would apply, we are required to carry out a three-part test. Firstly, does the Applicant have a legitimate interest in obtaining the personal data? Secondly, would the disclosure be necessary to achieve the legitimate interest and, thirdly, even if the processing would be necessary would that be overridden by the interests or fundamental right and freedoms of the data subjects?  

Regarding the first test, given the statutory obligation placed on the GTC Scotland to keep a public register of teachers under Article 14(3) of the Public Services Reform (General Teaching Council for Scotland) Order 2011 we agree that as a member of the public you have a legitimate interest in information contained within the Register. As such, we accept that as a requester under FOISA you have a legitimate interest in this information.

Regarding the second test, given that we provided totals in our initial response we believe that your legitimate interest is examining the Register has not been frustrated. There is sufficient information contained within these records to allow for evaluation of the Register without compromising the personal data of those contained within it.

As you noted in your further response of 25 February, supplementary information is already available on certain categories of information under your request. We also note that these data sets display the information against a single category instead of against all available categories as you have requested. You may also be interested in information disclosed in a similar request which provides details on registration categories as an applicable query under your request.

Therefore, given that the information you have been provided is sufficient to meet your legitimate interest in obtaining information related to the Register we have decided to uphold our original decision. We conclude that disclosing the information as you have requested would risk perpetually exposing the data subjects to disclosure of their personal data.

I trust that this has been of assistance but if you remain dissatisfied with the responses you have received, you have the right to appeal to the Scottish Information Commissioner. You must do so within six months of receipt of this response. The Scottish Information Commissioner’s guidance on making an appeal describes the process, including the application form. Further information, including relevant contact details is available on their website.