Decision 002/2024: Correspondence relating to a named street
Authority: South Lanarkshire Council
Case Ref: 202101464
Summary
The Applicant asked the Authority for correspondence relating to service areas and driveways of a named street. The Authority provided the Applicant with information, but it redacted some information it considered it to be personal data. The Commissioner investigated and found that the Authority had wrongly withheld information as personal data, and required it to be disclosed.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner)
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definitions of “the data protection principles”, “data subject”, “environmental information” (paragraphs (a), (b) and (c)), “personal data” and “the UK GDPR”) and (3A)(a) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3A)(a) (Personal data); and 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to the processing of personal data)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and 14(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 6 July 2023, the Commissioner issued Decision 069/2023 which focused on the information request made by the Applicant on 20 September 2021, but did not address the Applicant’s complaint that the Authority had wrongly withheld information describing the “nature of an enquiry” as personal data. This Decision Notice will focus solely on this point.
2. On 20 September 2021, the Applicant made a request for information to the Authority. He asked for all correspondence (including but not limited to enquiries and complaints) relating to roads, service strips, service verges and driveways for a named road.
3. The Authority responded on 30 September 2021, and provided the Applicant with information falling within the scope of his request.
4. On 16 October 2021, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision, because some information had been redacted from the disclosed documents and he believed some information had not been provided.
5. The Authority notified the Applicant of the outcome of its review on 11 November 2021. It identified and disclosed a letter that had been omitted from the original response, and notified the Applicant that information had been redacted from the correspondence it had previously disclosed, under regulation 11(2) of the EIRs.
6. On 25 November 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. One of his grounds of dissatisfaction
was that the Authority had wrongly redacted information in the “nature of enquiry” field, under regulation 11(2) of the EIRs. The Applicant did not accept this information was personal data and considered the redaction to go beyond the requirements of regulation 11(2).
Investigation
7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation, and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to its reasons for withholding information under regulation 11(2) of the EIRs.
Commissioner’s analysis and findings
9. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Application of the EIRs
10. In its correspondence with the Applicant, the Authority identified all of the information requested as being environmental information, as defined in regulation 2(1) of the EIRs. Having reached this conclusion, it applied section 39(2) of FOISA.
11. The Commissioner is satisfied that the information covered by this request (information regarding the service strips and driveways of a named street) is environmental information, as defined in regulation 2(1) of the EIRs. In reaching this conclusion, the Commissioner has considered the information in question, along with paragraphs (a), (b) and (c) of the definition of environmental information (reproduced in Appendix 1), and he agrees that the Authority was correct to have categorised the information as environmental. (The Applicant has not disputed the Authority’s decision to handle the request under the EIRs.)
12. The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs. In this case, the Commissioner accepts that the Authority was entitled to apply the exemption to the information withheld in this case, given his conclusion that it is properly classified as environmental information.
13. The exemption in section 39(2) is subject to the public interest test in section 2(1)(b) of FOISA. As there is a statutory right of access to environmental information available to the Applicant in this case, the Commissioner accepts, in all the circumstances, that the public interest in maintaining this exemption (and responding to the request under the EIRs) outweighs any public interest in disclosing the information under FOISA. Both regimes are intended to promote public access to information and there would appear to be no reason why (in this particular case) disclosure of the information should be more likely under FOISA than under the EIRs.
14. The Commissioner therefore concludes that the Authority was correct to apply section 39(2) of FOISA, and consider the Applicant’s information request wholly under the EIRs. In what follows, the Commissioner will consider this case solely in terms of the EIRs.
Regulation 5(1) of the EIRs – Duty to make environmental information available
15. In terms of regulation 5(1) of the EIRs, a Scottish public authority that holds environmental information is required make it available when requested to do so. This obligation is subject to various other provisions in terms of regulation 5(2)(b), including the exceptions in regulation 10. A Scottish public authority is required to
interpret these exceptions restrictively (regulation 10(2)(a)) and apply a presumption in favour of disclosure (regulation 10(2)(b)).
16. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within scope of the request. Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).
Information disclosure during the investigation
17. When the Authority provided the Applicant with information in response to his request, it redacted information that indicated the nature of the enquiry received, under regulation 11(2) of the EIRs.
18. The Authority was challenged on this redaction and was asked for its reasons for concluding that text which identified the medium of an enquiry was personal data.
Regulation 11(2) – Personal data
19. The Authority relied on the exception in regulation 11(2) (as read with regulation 11(3A)(a)) for withholding information from the “nature of enquiry” field in an email it disclosed to the Applicant.
20. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in the UK GDPR
or the DPA 2018 (regulation 11(3A)(a)).
21. The Authority submitted that the redacted information constituted personal data, disclosure of which in response to this request would breach the first data protection principle in Article 5(1) of the UK GDPR ("lawfulness, fairness and transparency".)
Is the withheld information personal data?
22. The first question the Commissioner must address is whether the information is personal data in terms of section 3(2) of the DPA 2018.
23. "Personal data" is defined in section 3(2) of the DPA as "any information relating to an identified or identifiable individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
24. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
25. An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
26. In the case of Breyer v Bundesrepublik Deutschland (C-582/14), the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is a realistic prospect of someone being identified. In deciding whether there is a realistic prospect of
identification, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is "insignificant", the information will not be personal data.
27. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply. As set out in Recital (26) of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, the available technology at the time of processing and technological developments. It confirms that data should be considered anonymous (and therefore no longer subject to the GDPR) when the data
subject(s) is/are no longer identifiable.
Authority’s submissions
28. In its submissions, the Authority explained that the information it had redacted under regulation 11(2) of the EIRs comprised the personal data of an individual who had made an enquiry. The Authority stressed that it was important to consider matters in context. It submitted that there was no reason to believe that the individual concerned would expect that disclosure would occur. The Authority argued that members of the public would expect it to keep their details confidential and not disclose them to anyone, unless required to process their interactions with the Authority.
29. The Authority acknowledged that it disclosed the “nature of enquiry” information (that it had redacted under regulation 11(2) of the EIRs) to the Applicant on 27 September 2022, but it submitted that this was done in error, not because the Authority no longer considered the information to be personal data. The Authority
noted that information about an address was also disclosed in error on the same day but, again, it maintained that this information was also excepted from disclosure under regulation 11(2) of the EIRs, as it comprised personal data.
The Commissioner’s view
30. The Commissioner has considered the Authority’s submissions, together with the information redacted from the “nature of enquiry” field (and later disclosed to the Applicant).
31. The Commissioner does not agree that the information redacted from the “nature of enquiry” field on its own “relates to” an identifiable individual and would be that person’s personal data. The information simply indicates the mode by which an enquiry was made to the Authority. Furthermore, the Authority has failed to demonstrate, how disclosure of that information could, by itself or in conjunction with other information, identify a living individual.
32. The Commissioner notes, with some disappointment, that the Authority’s arguments on the question of identifiability are generic, with no obvious focus on the particular information under consideration here. Naturally, context should be taken into account in determining whether any information has a genuine contribution to make to identifying a particular living individual, but in this case it is far from evident
why the mode of communication should, on any reasonable interpretation, be deemed to make such a contribution– or, for that matter, to say anything of substance about the individual in question. No such connection has been explained by the Authority. In circumstances where there is already a difficult relationship between the Applicant and the Authority, the Authority’s approach to this particular information appears to
demonstrate a lack of care which is, to the say the least, unhelpful.
33. For the above reasons. the Commissioner is not satisfied that the information redacted from the “nature of enquiry” field is personal data. Therefore, he must find that the information was wrongly withheld under regulation 11(2) of the EIRS, and that the Authority breached the provisions of regulation 5(1) of the EIRS, by not disclosing this information when requested to do so.
34. The Commissioner notes that the Authority disclosed this information to the Applicant on 27 September 2022, albeit in error, so he does not require it to take any action in relation to this breach.
Decision
The Commissioner finds that the Authority failed to comply with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.
The Commissioner finds that regulation 11(2) of the EIRs did not prohibit the Authority from making the information available. Failure to make the information available breached the EIRs (in particular, regulation 5(1)).
Given that the Authority has already disclosed this information to the Applicant, the Commissioner does not require the Authority to take any action in response to this failure in response to the Applicant’s application.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Euan McCulloch
Head of Enforcement
9 January 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
…
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
…
39 Health, safety and the environment
…
(2) Information is exempt information if a Scottish public authority-
(a) is obliged by regulations under section 62 to make it available to the public in accordance with the regulations; or
(b) would be so obliged but for any exemption contained in the regulations.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c);
and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations –
… “the data protection principles” means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section of that Act):
…
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
(b) factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in paragraph (a);
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
…
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);
…
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act); and
…
(3A) In these Regulations, references to the UK GDPR and the Data Protection Act 2018 have effect as if in Article 2 of the UK GDPR and Chapter 3 of Part 2 of that Act (exemptions for manual unstructured processing and for national security and defence purposes) -
(a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and
…
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
…
(b) is subject to regulations 6 to 12.
…
10 Exceptions from duty to make environmental information available
…
(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.
…
11 Personal data
…
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -
(a) the first condition set out in paragraph (3A) is satisfied, or
…
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations –
(a) would contravene any of the data protection principles, or
…
17 Enforcement and appeal provisions
(1) The provisions of Part 4 of the Act (Enforcement) including schedule 3 (powers of entry and inspection), shall apply for the purposes of these Regulations as they apply for the purposes of the Act but with the modifications specified in paragraph (2).
(2) In the application of any provision of the Act by paragraph (1) any reference to -
(a) the Act is deemed to be a reference to these Regulations;
(b) the requirements of Part 1 of the Act is deemed to be a reference to the requirements of these Regulations;
…
(f) a notice under section 21(5) or (9) (review by a Scottish public authority) of the Act is deemed to be a reference to a notice under regulation 16(4); and
…
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) “Data subject” means the identified or identifiable living individual to whom the data relates.
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal)Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
…
