Decision 307/2025:  Voluntary Early Release (VER) payments over £150,000

Authority:  North Ayrshire Council
Case Ref:  202500411
 

Summary

The Applicant asked the Authority for details of the relevant posts and decision-making processes involved in a Voluntary Early Release scheme for its employees.  The Authority provided some information about the decision-making processes but withheld other information because it considered it to be personal data.

The Commissioner investigated and found that, while the Authority had correctly withheld some personal data, it had wrongly withheld some other information under the personal data exemption, and he required the Authority to this disclose to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data).

Background

1. On 16 January 2025, the Applicant made a request for information to the Authority.  For the period 2022 to date, he asked for:

   A. the job title of all positions that received Voluntary Early Release (VER) payments over £150,000,

   B. the annual salary for these positions at the time of VER agreement,

   C. a copy of the VER decision making process and the job titles of the Council staff involved at each stage, and

   D. a copy of the decision/scoring/assessment for each VER payment over £150,000.

2. The Authority responded on 13 February 2025.  The Authority provided information captured by part C of the request, but withheld information under section 38(1)(b) of FOISA for the remaining parts of the request because it comprised the personal data of third party individuals.
3. On 18 February 2025, the Applicant wrote to the Authority requesting a review of its decision for parts A, B and D of his request.  The Applicant was dissatisfied with the decision because the information captured by these parts of his request had been withheld.
4. The Authority notified the Applicant of the outcome of its review on 17 March 2025, which upheld its original decision without modification.
5. On 18 March 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant was dissatisfied with the outcome of the Authority’s review because he did not consider that job titles and salaries constituted personal data or could lead to the identification of individuals.  It was his view that the information captured by parts A, B and D of his request could be suitably redacted and that there was a strong public interest in disclosure.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 2 April 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  It was asked why it considered the information captured by the request to be personal data, and to give its reasons for withholding the information under section 38(1)(b) of FOISA.

Commissioner’s analysis and findings

9. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Interpretation of the request

10. In submissions, the Authority stated that “no individual received a VER payment of over £150,000”.
11. However, in its initial response to the Applicant, the Authority stated that there were nine individuals “whose combination of both their severance payment (i.e. the payment received by the employee) and the strain on the fund costs (i.e. that borne by the Employer) amounted to over £150,000.”
12. The Authority was queried on this apparently contradictory position and its interpretation of the request, given the terms of part A of the request.

The Applicant’s intended meaning of the request

13. The Applicant explained that in terms of part A of his request - “the job title of all positions that received VER payments over £150,000” – his intended meaning was that this encompassed “all aspects of the VER packages that total over £150,000 so both any upfront lump sum and also any early pension payments or costs that are above that amount”.

The Authority’s interpretation of the request

14. The Authority explained that it had originally considered responding that no individual had received a VER payment of £150,000 but given discussions that had taken place between the Applicant and the Authority prior to the request being made, the Authority amended its interpretation and responded in terms of the nine individuals whose total package had a resultant total cost to the Authority of over £150,000.  The Authority stated that, in its view, the Applicant’s interpretation and its own interpretation of the request was the same.

The Commissioners view

15. The Commissioner is content that both parties have taken the same interpretation of part A of the request.  He will go on to consider the Authority’s application of section 38(1)(b) to information within scope of parts A, B and D of the request.

Section 38(1)(b) – Third party personal data

16. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
17. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
18. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
19. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

20. "Personal data" is defined in section 3(2) of the DPA as "any information relating to an identified or identifiable living individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as "a living individual who can be identified, directly or indirectly, in particular with reference to – 

    • an identifier such as a name, an identification number, location data or an online identifier, or 

    • one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual."

The Authority’s comments

21. The Authority explained that, for part A of the request, it considered whether the job titles of the individuals deemed to be within the scope of the request could be released.  The Authority referred to the UK Information Commissioner (ICO) guidance relating to indirect identification[1]and, having done so, concluded that this information was personal information because the low number of individuals who held the affected posts meant that the post holders could be easily identified.  The Authority submitted additional information to the Commissioner to support its argument on this issue.
22. The Authority submitted that there were nine individuals in total whose VER payments were captured by the request.
23. For part B of the request, the Authority submitted that, on reflection, it was of the view that salary information in isolation would not amount to personal data, as it would not relate to an identifiable living individual in the absence of further context.  However, it argued that, taken together with the information captured by part A of the request, it was personal data because disclosure of salary information would then be linked to a job title which could lead to identification of individuals.
24. The Authority provided the Commissioner with copies of the VER scrutiny panel minutes which fell within part D of the Applicant’s request.  The Authority submitted that the relevant information in those minutes was personal data, particularly when taken together with information falling within scope of part A of the request.  Furthermore, in some cases, the job title of the person being discussed was explicitly stated in the minutes and, given that each job title related to only one individual, these sections of the minutes were considered to be personal information for the reasons already set out.
25. The Authority also commented that, even without providing the job titles requested in part A, the identities of many of the people who received VER would have become known within the organisation after the decisions were made, as it was necessary to restructure and plan for exit, and some individuals would have chosen to disclose the fact that they had received VER to colleagues.  The Authority considered that this knowledge may lead to identification of the individuals being discussed.

The Applicant’s comments

26. The Applicant disagreed that the information he had requested was personal data.  He commented that that he did not believe that individuals could be identified by the disclosure of job titles or salaries. The Applicant stated that, at no point, had he asked for personal information and he commented that he would not expect any personal details, such as names, to be disclosed.  He commented that the Authority had not even provided him with redacted documents, which would have allowed him to access the information in part.

The Commissioner’s view on whether the information is personal data

27. The Commissioner notes the Applicant’s view that the information could be disclosed to him “privately, if not publicly”.  The Commissioner’s remit extends to FOI and, in this case, whether the Authority was entitled to withhold the information under section 38(1)(b) of FOISA. Disclosure under FOI is disclosure into the wider public domain.  The Commissioner notes that the Applicant is a Councillor and he is aware that authorities often provide councillors with information in confidence, which is not placed into the public domain.   However, he cannot comment on whether, or not, an Applicant should be afforded private access to information.  Notwithstanding, the processing of third party personal data must be in accordance with the requirements of UK data protection law.
28. Information which is capable of identifying individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
29. In terms of the information being withheld in this case, with reference to part A of the request, the Commissioner considered whether the job titles could be generalised or anonymised in some way as to make them less specific to an individual. Similarly, he considered whether the information captured by part D of the request could be anonymised or extracted in any meaningful way.  However, he concluded that it could not.  He was persuaded by the Authority’s position that the information was personal data from which individuals could be identified.
30. The Commissioner is satisfied that all of the withheld information, including that within scope of part B of the request when read alongside the information covered by parts A and D, taken together, would constitute personal data as defined in in section 3(2) of the DPA 2018.
31. However, the Commissioner agrees with the Authority’s revised view that the annual salary details for the relevant posts, captured by part B of the request, is not personal data when considered in isolation.  He does not consider that disclosure of the salary details alone would lead to the identification of those individuals.  He will consider the implications of this further below.
32. The Commissioner will now go on to consider that remaining information which he does consider to be personal data.

Disclosure of the personal data

Would disclosure contravene one of the data protection principles?

33. In its initial response, upheld at review, the Authority argued that disclosing the personal data would breach the first data protection principle.  This requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject" (Article 5(1)(a) of the UK GDPR).
34. "Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a FOISA request.
35. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
36. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

37. Condition (f) states that processing shall be lawful if it is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
38. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
39. The three tests which must be met before Article 6(1)(f) can be met are as follows:

    1. Does the Applicant have a legitimate interest in the personal data?

    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

    3. Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data?

40. There is no presumption in favour of the disclosure of personal data under the general obligation laid down by section 1(1) of FOISA.  Accordingly, the legitimate interests of the Applicant must outweigh the rights and freedoms or legitimate interests of the data subjects before condition (f) will permit the data to be disclosed.  If the two are evenly balanced, the Commissioner must find that the Authority was correct to refuse to disclose the personal data to the Applicant.

Does the Applicant have a legitimate interest in obtaining the personal data?

41. The Applicant submitted that the information related to large sums of public spending and he considered that he should have access to the information in order to effectively undertake his role.

42. The Authority noted that it had asked the Applicant what his legitimate interest was. The Authority acknowledged that the Applicant, as an elected member, considered that he had a legitimate interest in having oversight of policy in order to properly scrutinise spend. 

    However, it argued that the type of information requested was not within the remit of an elected member because it covered operational processes rather than policy or strategy and it referred to paragraph 3 in Annex A of the Councillors’ Code of Conduct (2021) (p24)[2], which states:

    “Councillors are required to provide strategic leadership and oversight. This involves setting strategy and policy, scrutinising and making major, complex decisions that concern the Council as a whole. Councillors are not, however, responsible for operational management (being the planning, organising and execution involved in day-to-day activities) as this is the role of employees. Chief Executives and senior employees have ultimate responsibility to ensure that the Council meets its responsibilities.”

    The Authority commented that responsibility for VER processes relating to the organisation of the Authority’s staff and the number and grades of staff required by the Authority for the discharge of its functions was an operational matter, and therefore the Applicant, as an elected member, had no legitimate interest in disclosure of the information captured by parts A and D of his request.

43. The Commissioner accepts that the Applicant, in his capacity as an elected member and as a member of the public, has a legitimate interest in scrutinising the spending of substantial sums of public money.  The Commissioner is therefore satisfied that the Applicant has a legitimate interest in obtaining the personal data.

Is disclosure of the personal data necessary?

44. The Commissioner must now consider whether disclosure of the personal data would be necessary to meet the Applicant's legitimate interests.
45. Here, “necessary” means “reasonably” rather than absolutely or strictly necessary.  The Commissioner must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the individuals.
46. The Applicant argued that he had concerns surrounding the amount or cost of some of the VER packages at the higher end of the scale.  By way of example, he commented that one of the VER packages was for £318,000 and to meet the best value payback period of three years that would mean the Authority would have to save £106,000 per year from that individual ceasing to be employed.  Given that the Authority’s senior leadership team were not allowed to apply for VER and those were the only level of staff who would earn a salary within this region to justify this amount being spent to save, the Applicant stated his concerns that the sums did not add up.
47. The Applicant noted that he had tried to raise his concerns privately within the Authority prior to making his request.
48. The Applicant argued that other councils had disclosed job descriptions in the past when releasing information about early release schemes and he gave examples of Glasgow City Council’s former chief executive and the former director of legal and administration[3], and a councillor in Edinburgh who was standing again[4] after receiving a retirement payout.
49. In the event that the Commissioner considered the Applicant did have a legitimate interest in the information requested in parts A and D of his request, the Authority submitted that disclosure of this information would not be necessary to achieve that legitimate interest.  It noted that the Early Release Scheme policy document was approved by the Authority’s Staffing and Recruitment Committee in 2018.  The Authority commented that its annual accounts contained details of exit packages and values, and this information was publicly available.
50. The Authority submitted that the impact of the VER for its employees during 2023-24 formed part of the 2023-24 Remuneration Report and was subject to audit by Audit Scotland who noted in their report that “The audited part of the Remuneration Report was consistent with the Annual Accounts and has been prepared in accordance with applicable regulations”.  The packages arising during the 2024-2025 were subject to audit over the summer of 2025.
51. The Authority commented that the standard VER programme was approved by its Staffing and Recruitment Committee.  The Authority explained that elected members sat on the Staffing and Recruitment Committee and therefore had oversight of the process.
52. The Authority submitted that it had privately provided the Applicant, in his capacity as an elected member (outwith FOI), with a spreadsheet showing the generic job titles and exact figures in respect of each VER package totalling over £150,000 in the financial year 2023-24.  The Authority explained that he had then, privately, asked for the specific roles of those members of staff, and the directorate they were from.  This further information was not provided as the Authority considered it amounted to personal information and, as such, it did not consider there was any legal basis for disclosure.
53. In addition to the information disclosed outwith FOI, the Authority also provided the Applicant, on a confidential basis, with the agenda and minute of the relevant Staffing and Recruitment Committee and the Exempt Report for the Early Release Scheme 2018 from the relevant Staffing and Recruitment Committee.
54. The Authority submitted that the Applicant subsequently used his position as an elected member to ask questions at meetings of the full Council in relation to the VER process on 26 March 2025 and 14 May 2025.
55. Given the information which had been made available to the Applicant and which was provided to him in his role as an elected member, the Authority argued that it did not consider it was necessary, for the purpose of the scrutiny of public expenditure, to disclose personal information about specific individuals who received VER in accordance with approved processes.

The Commissioner’s view on whether disclosure is necessary

56. The Commissioner has considered the submissions from the Applicant and the Authority carefully.
57. The Commissioner acknowledges the examples of other authorities publishing similar information submitted to him by the Applicant.  In the example relating to Glasgow City Council and the large severance packages awarded, the Commissioner considers that this situation is quite different to that which is the subject of the Applicant’s request.  In the Glasgow City Council example, those senior managers who were awarded large severance packages were at a level where there was no oversight of the detail of those packages.
58. By way of contrast, the VER process which is the subject of the Applicant’s request in this case, was developed and agreed by councillors through the committee process, put in place and acted upon by officers of the Authority with service level scrutiny and then subject to financial audit; a quite different level of scrutiny from that in the Glasgow City Council case.
59. Having also considered the example given by the Applicant in relation to the former councillor, he is not persuaded that this example is relevant to the matter under consideration in this decision.  Moreover, the Commissioner notes that those involved in the Glasgow and Edinburgh examples already have public profiles, and that is not the case with the individuals whose information is under consideration here.
60. The Commissioner has carefully considered the Applicant’s comment in relation to the VER package that amounted to a total of £318,000 and his specific concern that would require a saving in salary of £106,000 per year to recoup the cost of payment over 3 years.  He refers the Applicant to the discussion at paragraphs 10 to 15 of this decision regarding the interpretation of the term “VER payment” and draws the Applicant’s attention to the fact that there was agreement between the Authority and the Applicant that “VER payment” should not be restricted to the salary component, but should also include a component relating to employee pension contributions lost to the Authority through the early release of that employee.
61. The Commissioner cannot comment on the Authority’s decision to award VER payments to individual staff.  It is not within his remit to assess such payments nor to consider whether the long-term saving to the Authority (comprised of salary and pension contributions) for each post was so considerable that a VER payment represented an overall saving.  While he acknowledges the Applicant’s concerns, the Commissioner is satisfied that the Authority has provided the Applicant with sufficient information to address these concerns.
62. The Authority has presented strong arguments which the Commissioner finds convincing.  The Commissioner accepts that the Applicant’s legitimate interest in scrutiny has been met by the governance and operational processes described by the Authority in its submissions.
63. The Commissioner’s view is that disclosure of the withheld personal data is not, therefore, necesssary to meet the Applicant’s legitimate interest.
64. He therefore finds that the information captured by parts A and D of the Applicant’s request has been correctly withheld under section 38(1)(b) of FOISA.
65. However, as indicated above (paragraph 31), the Commissioner has found that the salary information captured by part B of the request cannot be considered to be personal data in isolation.  In the circumstances, he finds that the Authority was not entitled to withhold this information under section 38(1)(b) of FOISA (and now requires its disclosure).

Decision 

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

The Commissioner finds that by relying on the exemption in section 38(1)(b) for withholding information falling within scope of part A and part D of the Applicant’s request, the Authority complied with Part 1 of FOISA.

However, by wrongly relying on section 38(1)(b) to withhold information captured by part B of the Applicant’s request, the Authority failed to comply with Part 1 (and, in particular, section 1(1)) of FOISA.

The Commissioner therefore requires the Authority to disclose to the Applicant the information captured by part B of his request by 30 January 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement 

16 December 2025