Home Decisions

Decision 299/2025

Decision 299/2025:  Details of severance package of former Chief Executive


Authority: CalMac Ferries Ltd
Case Ref: 202500675
 

Summary

The Applicant asked the Authority for details of the severance package the former Chief Executive received as a result of his departure.  The Authority withheld the information on the basis that it considered disclosure would breach the data protection principles.  The Commissioner found that the Authority had wrongly withheld the information, and he required it to be disclosed. 

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 21(4) and (5) (Review by Scottish public authority); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10), (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 3 April 2024, the Authority issued a press release on its website stating that its Chief Executive was “stepping down with immediate effect”.
  2. Following the Authority complying with Decision 269/2024[1] of the Commissioner, the Applicant made a new request for information to the Authority on 8 January 2025.  Among other things, he asked for how much (in financial and any other terms, including benefits) the former Chief Executive would receive as a result of his departure.
  3. The Authority responded to the request on 5 February 2025.  It advised the Applicant that it was withholding the total amount the former Chief Executive received as a result of his departure under the exemption in section 38(1)(b) of FOISA.  However, it said that a settlement agreement with the former Chief Executive was reached on 11 July 2024, he was entitled to a six-month notice period and that the payment included pay in lieu of notice (PILON), pay in lieu of accrued holidays untaken, reimbursement of legal fees, and compensation for loss of employment.
  4. On 13 February 2025, the Applicant wrote to the Authority requesting a review of its decision.  He stated that he was dissatisfied because he did not consider the exemption in section 38(1)(b) of FOISA applied to the information requested and explained why.
  5. The Authority notified the Applicant of the outcome of its review on 7 April 2025, which upheld its original decision to withhold the information requested under the exemption in section 38(1)(b) of FOISA.  However, it said that details of the former Chief Executive’s remuneration for his tenure during the year 2024/25 would be published later in 2025, within its Annual Report.
  6. On 1 May 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated that he was dissatisfied with the outcome of the Authority’s review for the reasons set out in his requirement for review (which will be set out in further detail later in the decision notice) and because the Authority’s review outcome was late.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 21 May 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions, related to its application of the exemption in section 38(1)(b) of FOISA to withhold the information requested and the information it intended to publish in its Annual Report by the end of 2025.
  4. The Commissioner also asked the Authority to confirm precisely how much the former Chief Executive received as a result of his departure as this was not clear to him from the withheld information it had originally provided to him.  The Authority provided the Commissioner with the confirmation requested.

Commissioner’s analysis and findings

  1. The Commissioner has considered all the submissions made to him by the Applicant and the Authority.
  2. As stated in previous decisions, in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8[2], at paragraph [18], the Court of Session recognised that:

  3. "in giving reasons for his decision, [the Commissioner] is necessarily restrained by the need to avoid, deliberately or accidentally, disclosing information which ought not 
    to be disclosed."

  4. In this decision notice, the Commissioner has endeavoured to give as full account of his reasoning as he can, but, by necessity, in this case the comments of the Court of Session are applicable to some aspects of this decision notice.

Section 38(1)(b) – Personal information

  1. Section 1(1) of FOISA provides that a person who requests information from a Scottish public authority which holds it is entitled to be given that information by the authority, subject to qualifications which, by virtue of section 1(6) of FOISA, allow Scottish public authorities to withhold information or charge a fee for it.
  2. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data“ (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
  3. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.  To rely on the exemption in section 38(1)(b) of FOISA, the Authority must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Article 5(1) of the UK GDPR. 

Is the withheld information personal data?

  1. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018.  The two main elements of personal data are that:

  • the information must “relate to” a living person; and

  • the living individual must be identifiable.

  1. Information will “relate to” a person if it is about them, linked to them, has biographical significant for them, is used to inform decisions affecting them or has them as its main focus.
  2. An “identifiable living individual” is one who can be identified, directly or indirectly, by reference to an identifier (such as a name) or one or more factors specific to the individual (see section 3(3) of the DPA 2018).
  3. Given the terms of the request and having considered the withheld information, the Commissioner is satisfied that the withheld information is personal data: the former Chief Executive is identifiable from this information, and the information clearly relates to him.

Would disclosure contravene one of the data protection principles?

  1. The Commissioner must now consider whether disclosing this personal information would breach the first data protection principle.
  2. The Authority argued that disclosure of this data would breach Article 5(1)(a) of the UK GDPR, which requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject".
  3. "Processing" of personal data is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data.  The definition therefore covers disclosing information into the public domain in response to a FOISA request.
  4. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
  5. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

  1. Condition (f) states that processing shall be lawful if it “is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”.
  2. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
  3. The three tests which must be fulfilled before Article 6(1)(f) can be relied on are as follows:

    1. does the Applicant have a legitimate interest in the personal data?

    2. if so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

    3. even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. The Authority’s initial response of 5 February 2025 acknowledged that there was a legitimate public interest in the disclosure of settlement sums paid to senior staff of public companies.  It did not change this position.
  2. The Commissioner agrees that the Applicant has a legitimate interest in the personal data, for the reasons acknowledged by the Authority in its initial response.  The settlement sums paid to senior staff of public companies are matters of public interest.

Would disclosure of the personal data be necessary?

  1. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of the personal data would be necessary to meet the Applicant's legitimate interests.
  2. Here, “necessary” means “reasonably” rather than absolutely or strictly necessary.  The Commissioner must therefore consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the named individual.
  3. The Authority’s initial response of 5 February 2025 acknowledged that disclosure of the withheld personal data was necessary to meet the Applicant’s legitimate interest.  It did not change this position.   
  4. The Commissioner agrees that disclosure of the personal data is necessary to achieve the Applicant's legitimate interest, as well as the wider legitimate interest in the use of public funds.  
  5. The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interest which would interfere less with the privacy of the data subject than disclosing the withheld information.  In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the information is necessary for the purposes of the Applicant's legitimate interests.
  6. As stated above, the Commissioner asked the Authority to confirm what information it intended to publish in its Annual Report by the end of 2025, relating to how much the former Chief Executive’s received as a result of his departure.  While he must be careful not to reveal the specific content of the withheld information, the Commissioner notes that the withheld information is not identical to the information that the Authority indicated that it intended to publish.  (If this information were the same, then the Commissioner would have had to reconsider whether disclosure would have been necessary to meet the Applicant’s legitimate interest (although it does not necessarily follow that he would have reached a different conclusion).  In the circumstances, he is satisfied that disclosure is necessary.)
  7. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the withheld information outweighs the rights and freedoms of the data subject.

The data subject’s interests or fundamental rights and freedoms (and balancing exercise)

  1. The Commissioner must balance the legitimate interests in disclosure against the data subject’s interests or fundamental rights and freedoms. In doing so, it is necessary for him to consider the impact of disclosure.
  2. For example, if the data subject would not reasonably expect that the information would be disclosed to the public under FOISA in response to a request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override the legitimate interests in disclosure.  Only if the legitimate interests of the Applicant outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.
  3. The Commissioner's guidance on section 38 of FOISA[3] notes factors that should be taken into account in balancing the interests of parties.  He notes that Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects.  These are some of the factors public authorities should consider:

    1. Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?

    2. Has the individual objected to the disclosure?

    3. Would the disclosure cause harm or distress?

The Applicant’s submissions

  1. The Applicant argued that wage details of the former Chief Executive did not constitute personal information that could be properly withheld under FOISA by a “transparent publicly funded organisation”. He said that most authorities published the financial remuneration details of their most senior employees (like Chief Executives) as a matter of routine.
  2. The Applicant noted that all bodies across the devolved public sector are required to report “exit payment activity” and that this information is “never hidden”.  He said that all proposals on compensation payments had to comply with the Settlement Agreements, Severance, Early Retirement and Redundancy Terms section of the Scottish Public Finance Manual.
  3. The Applicant submitted that any person taking the role of Chief Executive of a public company signed up to the duty of transparency as part of that.  He said it was accepted that the remuneration of executives in public bodies and corporations should be transparent, but the Authority’s response to his request contravened that and went against the way other public authorities worked.

The Authority’s submissions

  1. The Authority considered that the fundamental rights and freedoms of the former Chief Executive outweighed the Applicant’s legitimate interest in disclosure of the withheld information because disclosure of “the full settlement amount” would likely cause “personal distress” to the former Chief Executive and “unwarranted prejudice” to his rights and freedoms.
  2. The Authority explained that it had considered the confidential nature of the settlement agreement entered with the former Chief Executive (a copy of which it provided to the Commissioner) and the impact on him had the information requested been disclosed in advance of the “normal disclosure” of the remuneration of directors.
  3. Given the confidential nature of the settlement agreement, the Authority said that it considered that the former Chief Executive’s expectation of privacy aligned with the timing of the publication of the Authority’s 2024/25 Annual Accounts (i.e. by the end of 2025).  By proposing to disclose this information “in line with standard practices and timelines”, it believed that it had both satisfied its duty to publish Director’s remuneration while also respecting the privacy of the former Chief Executive at a “sensitive time”.

The Commissioner’s view

  1. The Commissioner has considered the relevant submissions from both parties, together with the withheld personal data. 
  2. The Commissioner acknowledges that the withheld information relates to the former Chief Executive’s public life, in that it relates to the money and benefits he received as a result of his departure from that role.  However, he also acknowledges that, by association, the information relates to the former Chief Executive’s private life.  In the circumstances, the Commissioner concludes that the withheld information relates to both the private and public life of the data subject.
  3. The Authority has not provided any specific evidence that the former Chief Executive had personally objected to disclosure of the withheld information.  However, it submitted that early disclosure (i.e. in response to the FOISA request rather than via its Annual Report by the end of 2025) would be likely to cause the former Chief Executive distress at a sensitive time.
  4. Notwithstanding the lack of specific evidence provided by the Authority, the Commissioner has considered the harm or distress that might be caused by disclosure of the information.  He has taken into account the below factors in reaching his decision:

  • Disclosure under FOISA is, effectively, disclosure to the world-at-large

  • The existence (and terms of) the confidential settlement agreement between the Authority and the former Chief Executive

  • The date of the Authority’s review outcome (i.e. 7 April 2025), which is the time at which the Commissioner must make his assessment in relation to whether a public authority complied with its statutory obligations under FOISA

  • The Authority’s intention to publish information in its annual report by the end of 2025, relating to how much the former Chief Executive received as a result of his departure

  • The very senior nature of the former Chief Executive’s role.

  1. The Commissioner accepts, based on the Authority’s submissions, that the former Chief Executive may have had a reasonable expectation that how much he received as a result of his departure would not be published by the end of 2025.
  2. However, in the absence of more specific submissions from the Authority on this point, the Commissioner is not persuaded that disclosure in April 2025 (i.e. at review stage) of the withheld information (which is largely the same as, but not identical to, the information that the Authority indicated that it intended to publish by the end of 2025) would have, or would have been likely to have, increased the likelihood of harm or distress to the former Chief Executive.
  3. To the limited extent that the withheld information differs from the information that the Authority indicated that it intended to publish by the end of 2025, the Commissioner does not consider there to be any material difference in terms of its sensitivity.   He also notes the very senior nature of the former Chief Executive’s role and the points made by the Applicant regarding the importance of transparency and scrutiny of public expenditure (particularly in relation to monies paid as part of a settlement to a departing Chief Executive).
  4. In all of the circumstances, the Commissioner is not satisfied that disclosure of the withheld information at review stage would have, or would have been likely to have, increased, in any meaningful way, whatever harm or distress might result to the former Chief Executive as a result of the Authority publishing the information it indicated it intended to publish by the end of 2025 in its Annual Report.
  5. The Commissioner therefore finds, on balance, that the legitimate interests served by disclosure of the personal data would not be outweighed by any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subject.
  6. In the circumstances of this particular case, then, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR can be met in relation to the withheld personal data.

Fairness

  1. The Commissioner must also consider whether disclosure would be fair.  He finds, for the same reasons as he finds that condition (f) in Article 6(1) can be met, that disclosure of the withheld information would be fair.

Conclusion on the data protection principles

  1. In the absence of any reason for finding disclosure to be unlawful other than a breach of Article 5(1)(a) (and none has been put forward by the Authority) and given that the Commissioner is satisfied that condition (f) can be met, he must find that disclosure would be lawful in this case.  
  2. The Commissioner therefore finds that disclosure of the withheld information would not breach the first data protection principle, and so the Authority was not entitled to withhold this information under the exemption in section 38(1)(b) of FOISA.
  3. The Commissioner requires the Authority to disclose the withheld information to the Applicant.
  4. However, the Commissioner would like to stress that it is important for public authorities to treat each request for information on a case-by-case basis.  That information should be disclosed in one case should not be taken to imply that information of a particular type will be routinely disclosed in future.  The circumstances of each case, including the content of the specific information under consideration, must be taken into consideration and (where required) the public interest in each case assessed on its own merits.

Handling of the request for review – timescale for compliance 

  1. In his application to the Commissioner, the Applicant was dissatisfied with the failure of the Authority to comply with the statutory timescale in FOISA for responding to his requirement for review.
  2. Section 21(1) of FOISA gives Scottish public authorities a maximum of 20 working days following the date of receipt of the requirement to comply with a requirement for review.  This is subject to qualifications which are not relevant in this case.
  3. It is a matter of fact that the Authority did not provide a response to the Applicant’s requirement for review within 20 working days, so the Commissioner finds that it failed to comply with section 21(1) of FOISA.
  4. The Commissioner recommends that the Authority considers whether it would be appropriate to apologise to the Applicant for its failure to comply with section 21(1) of FOISA when it discloses the information that he has found it was not entitled to withhold from the Applicant under the exemption in section 38(1)(b) of FOISA.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

Specifically, the Commissioner finds that the Authority:

  • was not entitled to withhold the information requested under the exemption in section 38(1)(b) of FOISA (and thereby failed to comply with section 1(1) of FOISA)

  • failed to respond to the Applicant’s requirement for review within the timescale laid down by section 21(1) of FOISA.

The Commissioner therefore requires the Authority to provide the wrongly withheld information to the Applicant, by 26 January 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

Euan McCulloch 

Head of Enforcement 

 

11 December 2025