Decision 004/2024: Details of specified planning file
Authority: Scottish Borders Council
Case Ref: 202101547
Summary
The Applicant asked the Authority for all communication and supporting documents related to a particular planning application. The Authority initially withheld some information, but subsequently provided the Applicant with all the information it held, apart from some third-party personal data. The Commissioner investigated and found that the Authority was wrong to withhold some information initially, but that all of
the information falling within the scope of the request was identified and provided to the Applicant, other than a small amount of personal data correctly withheld by the Authority.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 39(2) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner)
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a), (b) and (c) of definition of “environmental information” and definitions of “personal data” and the “UK GDPR”) (Interpretation); 5(1) (Duty to make environmental information available on request); 11(2), (3A)(a) and (7) (Personal data) ; 17(1), (2)(a) and (b) (Enforcement and appeal provisions)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14) (a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 24 March 2021, the Applicant made a request for information to the Authority. He asked for all communications and supporting documents related to a particular planning application. The Applicant asked that the information include emails and other communication with parties external to the Authority.
2. The Authority responded on 23 April 2021. It applied section 39(2) of FOISA and responded to the request solely under the EIRs. The Authority provided the Applicant with a substantial amount of information, with some information withheld under regulation 11(2) of the EIRs as it was considered to be third party personal
data.
3. On 3 June 2021, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the Authority’s response because he did not think he had been provided with all the information falling within his request and he believed numerous documents that were provided had “white block redactions”.
4. The Authority notified the Applicant of the outcome of its review on 30 June 2021. It upheld its original response, as it was satisfied that it had undertaken a thorough and comprehensive search for the information requested. The Authority explained that it could not find any areas of white redaction but that, when
downloading information from some of its systems, there may be areas that did not contain any detail (and could be mistaken for white redactions). It asked the Applicant to identify areas within the documentation that he considered were “white redaction”, so that it could review the material again.
5. On 20 December 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated that he was
dissatisfied with the outcome of the Authority’s review because he believed documents were missing and there were unnecessary white and black redactions.
6. On 11 March 2022, the Authority provided the Applicant with a revised response, providing information it had previously withheld under regulation 11(2) (but that it had subsequently realised was already in the public domain). The Authority continued to withhold a small amount of information under regulation 11(2) of the EIRs.
7. The Applicant confirmed to the Commissioner on 8 March 2023 that he wished to proceed with his application for a decision.
Investigation
8. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
9. On 25 January 2022, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to the searches carried out to identify the information falling within the scope of the
request and the reasons for withholding some information under regulation 11(2) of the EIRs.
Commissioner’s analysis and findings
11. The Commissioner has considered all the submissions made to him by the Applicant and the Authority.
Handling in terms of the EIRs
12. The Authority processed and responded to the Applicant’s request and requirement for review in accordance with the EIRs.
13. When information falls within the definition of “environmental information” in regulation 2(1) of the EIRs, a person has the right to access it (and the public authority a corresponding obligation to respond) under the EIRs, subject to various restrictions and exceptions contained in the EIRs.
14. The Applicant has not challenged the Authority’s decision to deal with the information as environmental information. The Commissioner is satisfied that the information does comprise environmental information (see in particular paragraphs (a), (b) and (c) of the definition in regulation 2(1) of the EIRs) and will consider the
handling of the request in what follows solely in terms of the EIRs.
Regulation 5(1) – Duty to make environmental information available
15. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by an applicant. This obligation relates to information that is held by the authority when it receives a request.
16. On receipt of a request for environmental information, therefore, the Authority must ascertain what information it holds falling within the scope of the request. Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in regulations 6 – 12 applies (regulation 5(2)(b)).
Information held by the Authority
17. The Applicant believed that information was missing from that provided to him by the Authority. The investigating officer asked the Applicant if he had any indication of the type of information he considered was missing, or why he considered this to be the case, but no further submissions were received from the Applicant that addressed this point.
18. The Authority explained that all the officers within its Planning and Regulatory services departments who had been involved in the planning application process were asked to search all recorded information, including emails. The Authority highlighted that it did not record telephone or video conversations. The Authority
added that some of the staff who had been involved in the planning request were no longer employees of the Authority and their email accounts were no longer held.
19. The standard of proof to determine whether a public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality and thoroughness and the results of searches carried out by the public authority. He also considers, where
appropriate any reasons offered by the public authority to explain why it does not hold the information.
20. Having considered the submissions, the Commissioner is satisfied that the Authority carried out adequate searches, and that these were likely to find all the information falling within the scope of the Applicant’s request.
21. In all of the circumstances, therefore, the Commissioner is satisfied, on the balance of probabilities, that the Authority does not (and did not, on receipt of the request) hold any further information falling within the Applicant’s request.
Regulation 11(2) – Personal data
22. The Authority relied on the exception in regulation 11(2) (read with regulation 11(3A)(a)) for withholding personal data.
23. On 11 March 2022, the Authority provided a revised response to the Applicant, providing some of the information it had previously withheld by virtue of regulation 11(2), after it realised that this information was already in the public domain. It also provided the Applicant with some further information under data protection legislation.
24. The Authority continued to rely on regulation 11(2) to withhold a small amount of information it considered to be third party personal data. Here, the Commissioner will consider the information which remained withheld under this provision.
25. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include that disclosure would contravene any of the data protection principles in the UK GDPR
or DPA 2018 (regulation 11(3A)(a)).
26. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would breach the first and second data principles in Article 5(1) of the UK GDPR (“lawfulness, fairness and transparency” and “purpose limitation”).
Is the withheld information personal data?
27. The first question the Commissioner must address is whether the information is personal data.
28. “Personal data” is defined in section 3(2) of the DPA 2008 as “any information relating to an identified individual”. Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more of the factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
29. Information will “relate to” a person if it about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
30. The Authority confirmed that the information being withheld comprised names, addresses, email addresses and mobile phone numbers of living individuals. As such, the Authority considered this information met the criteria to be classed as personal data, as defined in the DPA 2018.
31. Having considered the Authority’s submissions, and the withheld information, the Commissioner accepts that the withheld information taken on its own, or in conjunction with other information, is personal data, as it relates to identifiable living individuals.
Would disclosure contravene one of the data protection principles?
32. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.
33. The definition of “processing” is wide and includes (section 3(4)(d) of the DPA 2018) “disclosure by transmissions, dissemination or otherwise making available”. For the purposes of the EIRs, personal data are processed when made available in response to a request. This means that the personal data can only be made available if doing so would be both lawful (i.e. it would meet one of the condition for lawful processing in
Article 6(1) of the UK GDPR) and fair.
34. The Authority did not consider that any conditions in Article 6(1) applied in the circumstances of the case. In considering this, the Commissioner has looked at condition 6(1)(f), as the only one which might potentially apply in the circumstances.
Condition (f): legitimate interests
35. Condition (f) states that the processing will be lawful if it is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subjects which require the protection of personal data (in
particular where the data subject is a child).
36. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
37. The tests which must be met before Article 6(f) can apply are as follows:
a) Does the Applicant have a legitimate interest in obtaining the personal data?
b) If so, would making the personal data available be necessary to achieve that legitimate interest?
c) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the Applicant have a legitimate interest in obtaining the personal data?
38. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he is simply inquisitive. The Commissioner’s published guidance on the Personal data exception in regulation 11 states:
“In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.”
39. The Authority acknowledged that the Applicant did have a legitimate interest in the requested information, although it had not asked him what this was.
40. The Applicant did not provide the Commissioner with any comments on the legitimate interest. He did comment in his application to the Commissioner that individuals communicating with the Authority in relation to the planning application would be aware that documentation would be available on the Authority’s Planning Portal.
41. However, the withheld information comprises names and contact details for private individuals who have corresponded with the Authority in relation to the planning application. The Applicant is correct to highlight that some of this information is posted on the Planning Portal, such as objections to the planning
application, but not all correspondence is publicly available. The Authority stated on its Planning Portal website that contact details such as email addresses, addresses and phone numbers would be redacted from the information posted there.
42. In the absence of any clear expression of what the Applicant’s legitimate interest in the personal data might be, it is difficult for the Commissioner to find that the Applicant had a legitimate interest. Although the Commissioner accepts that the Authority concluded the Applicant had a legitimate interest, it is not clear
whether this was in the information as a whole or the personal information that had been redacted.
43. The Commissioner can see that there would be a legitimate interest in seeking to understand actions taken, and processes followed by the Authority in respect of this planning application, however, he does not consider there is a legitimate interest in the disclosure of the withheld information. Disclosure of the personal data in
question would not add anything to the Applicant’s understanding of the information already provided by the Authority. The identity of the Authority’s staff involved, and those from other organisations and companies concerned, is already clear from the information disclosed to the Applicant in the Authority’s revised response.
44. As the Commissioner has concluded that the Applicant does not have a legitimate interest in receiving the personal data redacted in this case, he finds that condition (f) of Article 6 of the UK GDPR cannot be satisfied. Accordingly, he accepts that making the personal data available would be unlawful.
45. In the circumstances, in the absence of a condition in Article 6(1) of the GDPR being met, the Commissioner must conclude that making the personal data available would breach the data protection principle in Article 5(1)(a) of the UK GDPR. (He is not required to go on to consider separately whether disclosure would also breach the data protection principle in Article 5(1)(b).) Consequently, he is satisfied that disclosure of the personal data still being withheld is not permitted by regulation 11(2) of the EIRs.
46. Given that the Authority provided information to the Applicant, previously withheld under regulation 11(2), in its revised response, the Commissioner must find that the Authority was not entitled to rely on regulation 11(2) of the EIRs to withhold these personal data and therefore failed to comply fully with the EIRs in its response
to The Applicant. The Commissioner does not require the Authority to take any action.
Decision
The Commissioner finds that the Authority partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.
The Commissioner finds that, by correctly withholding the remaining third-party personal information under regulation 11(2) of the EIRs, the Authority complied with the EIRs.
However, by wrongly withholding information some information under regulation 11(2), the Authority failed to comply with regulation 5(1) the EIRs.
Given that the Authority disclosed this information during the investigation, the Commissioner does not require the Authority to take any action in respect of this failure, in response to the Applicant’s application.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Euan McCulloch
Head of Enforcement
9 October 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
39 Health, safety and the environment
…
(2) Information is exempt information if a Scottish public authority-
(a) is obliged by regulations under section 62 to make it available to the public in accordance with the regulations; or
(b) would be so obliged but for any exemption contained in the regulations.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations –
“the Act” means the Freedom of Information (Scotland) Act 2002;
“applicant” means any person who requests that environmental information be made available;
“the Commissioner” means the Scottish Information Commissioner constituted by section 42 of the Act;
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
(b) factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in paragraph (a);
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
…
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
…
11 Personal data
…
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -
(a) the first condition set out in paragraph (3A) is satisfied, or
(b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations –
(a) would contravene any of the data protection principles, or
…
…
(7) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public
authorities) were omitted.
…
17 Enforcement and appeal provisions
(1) The provisions of Part 4 of the Act (Enforcement) including schedule 3 (powers of entry and inspection), shall apply for the purposes of these Regulations as they apply for the purposes of the Act but with the modifications specified in paragraph
(2).
(2) In the application of any provision of the Act by paragraph (1) any reference to -
(a) the Act is deemed to be a reference to these Regulations;
(b) the requirements of Part 1 of the Act is deemed to be a reference to the requirements of these Regulations;
…
(f) a notice under section 21(5) or (9) (review by a Scottish public authority) of the Act is deemed to be a reference to a notice under regulation 16(4); and
…
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal)
Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
