Decision 080/2023: Self-cleansing letter
Authority: Forestry and Land Scotland
Case Ref: 202101481
Summary
The Applicant asked the Authority for a copy of a specific “self-cleansing” letter received from a named individual. The Authority refused to disclose this as it considered doing so would substantially prejudice the interests of the person who provided the letter, and would also lead to disclosure of third-party personal data in breach of the data protection principles. The Commissioner investigated and found that the Authority had been entitled to refuse to make available the information for which it claimed an exception in the “self-cleansing” letter.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner)
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant”, “the Commissioner”, “the data protection principles”, “data subject”, paragraphs (a) and (c) of the definition of “environmental information”, “personal data” and “the UK GDPR”) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(1), (2), (5)(f) (Exceptions from duty to make environmental information available); 11(2)(b), (3A)(a) and (7) (Personal data); 17(1), (2)(a) and (b) (Enforcement and appeal provisions)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10), (14)(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 18 May 2021, the Applicant made a request for information to the Authority. They asked for a copy of a “self-cleansing letter” issued to the Authority by [ ] pursuant to regulation 58 of the Public Contracts (Scotland) Regulations 2015 (“the Regulations”) in relation to a Framework Agreement for Deer Management on the Scottish National Forest Estate.
2. The Authority responded on 14 June 2021. The Authority processed and responded to the request under FOISA, relying on the exemptions in sections 33(1)(b), 36(2) and 38(1)(b) for refusing to disclose the content of the letter to the Applicant.
3. On 29 July 2021, the Applicant wrote to the Authority, requesting a review of its decision. The Applicant stated that they were dissatisfied with the decision because the Authority had not disclosed the particular commercial interests they considered to be at risk or how this would impact the economy, either at the present time or in future. The Applicant also expressed dissatisfaction that no reason had been given to them as to why the author of the letter did not want this to be disclosed, and that there appeared to have been no consideration given as to whether a redacted version of the letter could be disclosed.
4. The Authority notified the Applicant of the outcome of its review on 25 August 2021. The Authority upheld its original decision and sought to address the reasons for dissatisfaction raised by the Applicant in their requirement for review.
5. On 28 November 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated they were dissatisfied with the outcome of the Authority’s review for the following reasons:
- They did not believe the exemptions in sections 33(1)(b), 36(2) and 38(1)(b) of FOISA applied to the information;
- They believed the public interest to favour disclosure;
- hey believed the requested information to contain statements, used by the Authority in an investigation into their company;
- They believed that the letter might contain information which might not only be defamatory to their company but was being, or had been, used to refuse them two separate applications for self-cleansing;
- They considered they had a right to see the information as it was directly named in an investigation into their company.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 19 January 2022, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to the Authority’s reliance on the exemptions in sections 33(1)(b), 36(2) and 38(1)(b) of FOISA.
9. During the investigation, the Authority issued a revised response to the Applicant’s requirement for review. In this revised response, the Authority confirmed that it considered the requested information to be environmental, and so responded to the request in line with the EIRs. In doing so, the Authority explained, with reasons, that it was seeking to rely on the exceptions in regulations 10(5)(f) and 11(2) of the EIRs for continuing to withhold the information in the self-cleansing letter.
10. Following receipt of a copy of the revised review response, the Commissioner asked the Authority to answer specific questions to justify why it considered the requested information to be “environmental”, and why it considered the exceptions in regulations 10(5)(f) and 11(2) to apply to it. A response to these questions was received.
11. Additional submissions were sought and received from both the Applicant and the Authority during the investigation.
Commissioner’s analysis and findings
12. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Background
13. In this case, the Applicant requested a copy of a “self-cleansing letter”.
14. Under the terms of the Regulations there is a mechanism, whereby companies who have been excluded from tendering for specific contracts, for particular reasons, can reclaim such eligibility through a process known as “self-cleansing”.
15. It is this process that the sender of the “self-cleansing letter”, which is the subject of this request, went through. They did this in an effort to declare that effective measures had been put in place to remedy the consequences of previous offences or misconduct, and to ensure that such misconduct would not reoccur.
Handling in terms of the EIRs
16. In its revised review response to the Applicant, the Authority explained that because the requested information was “environmental information” for the purposes of the EIRs, it was applying the exemption in section 39(2) of FOISA and instead processing the request under the EIRs.
17. In their submissions to the Commissioner, the Authority submitted that the requested information fell within scope of parts (a) and (c) of the definition of environmental information in regulation 2(1) of the EIRs.
18. Having considered the content of the withheld information, the Commissioner is satisfied that this relates to biological diversity and measures or activities designed to protect that (given that it concerns activity carried out in relation to the Framework Agreement for Deer Management on the Scottish Forest Estate).
19. The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined in regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs. In this case, the Commissioner accepts that the Authority was entitled to apply the exemption to the information withheld here, given his conclusion that it is properly classified as environmental information.
20. The exception in regulation 39(2) is subject to the public interest test in section 2(1)(b) of FOISA. As there is a statutory right of access to environmental information available to the Applicant in this case, the Commissioner accepts that, in all the circumstances, the public interest in maintaining this exemption (and responding to the request under the EIRs) outweighs any public interest in disclosing the information under FOISA. Both regimes are intended to promote public access to information and there would appear to be no reason why (in this particular case) disclosure of the information should be more likely under FOISA than under the EIRs.
21. The Commissioner therefore concludes that the Authority was correct to apply section 39(2) of FOISA, and consider the Applicant’s information request wholly under the EIRs. In what follows the Commissioner will consider this case solely in terms of the EIRs.
Regulation 5(1) of the EIRs – duty to make environmental information available
22. Regulation 5(1) of the EIRs requires a Scottish public authority that holds environmental information to make it available when requested to do so by any applicant. This obligation relates to information that is held by the authority when it receives a request. On receipt of a request for environmental information, therefore, an authority must ascertain what information it holds falling within scope of the request. Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in regulation 6 to 12 applies (regulation 5(2)(b)).
Regulation 10(5)(f) – third party interests
23. In terms of regulation 10(5)(f) of the EIRs, a Scottish public authority may refuse to make environmental information available to the extent that its disclosure would, or would be likely to, prejudice substantially the interests of the person who provided the information where that person:
- was not under, and could not have been put under, any legal obligation to supply the information;
- did not supply it in circumstances such that it could, apart from the EIRs, be made available; and
- has not consented to its disclosure.
24. Regulation 10(2) of the EIRs provides that this exception must be interpreted in a restrictive way and that the public authority shall apply a presumption in favour of disclosure. The exception is also subject to the public interest test in regulation 10(1)(b).
Does regulation 10(5)(f) apply in this case?
25. In the Commissioner’s guidance on regulation 10(5)(f), he states that a number of factors should be addressed in considering whether this exception applies. These include:
- Was the information provided by a third party?
- Was the provider, or could the provider be, required by law to provide it?
- Is the information otherwise publicly available?
- Has the provider consented to disclosure?
- Would release of the information cause, or be likely to cause, substantial harm to the interests of the provider?
26. The Commissioner has considered all of the submissions provided by the Authority on this matter throughout the investigation and notes that the various submissions provided cover the five points listed above.
Was the information provided by a third party?
27. The Commissioner has to first of all consider whether the information being withheld was provided by a third party. Where information was not provided by a third party, regulation 10(5)(f) of the EIRs cannot be engaged and the Commissioner is not required to consider the remaining factors, as outlined in paragraph 25 above.
28. The Authority submitted that the “self-cleansing letter” had been provided to it by a third party, and informed the Commissioner of who this was.
29. Having read the withheld information, the Commissioner accepts that the “self-cleansing letter” was provided to the Authority by a third party.
30. The Commissioner will now consider the other tests that have to be met in order for regulation 10(5)(f) of the EIRs to apply to the “self-cleansing letter”.
Was the provider, or could the provider be, required by law to provide it?
31. The Authority submitted that the author of the “self-cleansing letter” was under no legal requirement to submit it. A bidder who has previously been excluded does not need to put in place self-cleansing measures. However, if it did not do so, it would not be possible for a public contracting authority to make a judgement as to whether improvements had been made to prevent a recurrence of the situation that led to the termination of the prior public contract.
32. The Authority explained that the author of the “self-cleansing letter” voluntarily submitted it, so that the Authority could ascertain that appropriate steps had been taken by their organisation to demonstrate that previous practice would not reoccur.
33. The Authority stated that it could not compel the author of the letter to provide it. It also commented that there were examples of previous suppliers in the same circumstances who had chosen not to engage in the self-cleansing process and instead chose not to supply services to the Authority.
34. Having considered the submissions from the Authority and the content of the withheld information, the Commissioner is not satisfied that it is information that the author of the letter was required, or could have been required, to provide by law.
Is the information otherwise publicly available?
35. The Authority stated that the terms of the letter were only known to the provider and the Authority, and so were not in the public domain.
36. Having considered the information, the Commissioner is satisfied that the withheld information is not (and has not been) otherwise available to the public.
Has the provider consented to disclosure?
37. The Authority submitted that the author of the “self-cleansing letter” had not consented to the information being disclosed.
38. It provided evidence to the Commissioner to demonstrate that the third party had specifically indicated that they did not want the information in the letter to be disclosed in response to an information request.
39. Evidence was also provided by the Authority of the expectation by the author of the letter that its content would remain confidential.
40. Having considered these submissions, and the supporting evidence, from the Authority, the Commissioner is not satisfied that the author of the “self-cleansing letter” has consented to disclosure of the information.
Substantial prejudice
41. The Commissioner will now consider whether the disclosure of the information provided by the author of the letter would, or would be likely to, cause substantial prejudice to them.
42. As regulation 10(5)(f) is focused on substantial prejudice to the interests of the person who provided the information, the Authority was asked to explain fully how substantial prejudice would manifest itself should the information be disclosed.
43. While there is no definition in FOISA or the EIRs of what is deemed to be “substantial-prejudice”, the Commissioner considers the authority would have to identify harm of real and demonstrable significance. The harm would also have to be at least likely, and therefore more than simply a remote possibility.
44. The Authority provided detailed submissions to the Commissioner as to why it considered that substantial prejudice would occur to the author of the letter if it were disclosed. Not all of these submissions are detailed below, but all have been considered by the Commissioner.
45. In its submissions, the Authority explained that the deer management sector is a very small cohort of small/micro businesses, who are well known to each other and on occasion collaborate on bigger contracts. It submitted that release of the content of the letter would substantially impact the author’s ability to work in the industry in future.
46. The Authority considered that disclosure of the content of the letter would disclose commercially sensitive information regarding the author. This would, the Authority argued, prejudice the author’s ability to compete in the market in which it operates and give its competitors an unfair advantage in any future public procurement or other competitive situations in which it participates.
47. The Authority considers that if it disclosed the withheld information to the requester, it would be possible for them, and/or other competitors, to build up a detailed picture of the author’s business, the nature of that business and its approach to future public procurement. All of this was likely, the Authority submitted, to undermine the fairness of such procurement exercises or other competitive situations.
48. Having considered the submissions from the Authority, the Commissioner understands that the sector in which the author operates is a small one where those delivering this service work closely together and tend to compete for similar contracts. The Commissioner also acknowledges that, given the role of the Authority as the largest manager of deer in Scotland, it is likely that the majority of contracts for this type of work would be awarded by them.
49. As stated above, the Commissioner has to be satisfied that disclosure would lead to substantial prejudice to the interests of those who provided the information.
50. Based on all of the submissions received, together with the content of the withheld information, the Commissioner is persuaded that disclosure of the information would, or would be likely, to prejudice substantially the interests of the author in the ways described by the Authority.
51. The Commissioner is therefore satisfied that the Authority was entitled to rely on the exception in regulation 10(5)(f) in relation to this information.
The public interest test - Regulation 10(1)(b)
52. Having found that the exception in regulation 10(5)(f) of the EIRs was correctly applied to the withheld information, the Commissioner is required to go on to consider the public interest test required by regulation 10(1)(b) of the EIRs. This states that a Scottish public authority may only withhold information to which an exception applies where, in all the circumstances, the public interest in making the information available is outweighed by the public interest in maintaining the exception.
The Authority’s submissions on the public interest
53. The Authority recognised the public interest in disclosing information as part of open and transparent government. It also acknowledged the general public interest that procurement information should be accessible in order to enhance scrutiny of decision-making processes, providing oversight of expenditure of public funds and the extent to which the public obtain value for money.
54. However, against this, the Authority considered there to be a greater public interest in protecting the interests of anyone, such as the author of the letter, who provided it with information on a confidential basis. The Authority also considered there to be a strong public interest in protecting those suppliers who voluntarily participated in the self-cleansing process, in order that this process was protected.
55. The Authority asserted that there was a significant public interest in ensuring fair competition in relation to public procurement activities, through not allowing the market to become skewed or distorted.
56. The Authority submitted that disclosing the information in the “self-cleansing letter”, against the express wishes of the stakeholder, would be likely to undermine their trust, and the trust of others who might have to consider taking part in the self-cleansing process, and/or tendering for work with the Authority, making them reluctant to work with the Authority in future. This would, the Authority submitted, significantly impair the Authority’s ability to secure the best service and best value for money – and, in turn, the management of Scotland’s national forests.
57. The Authority also argued that, if it could not secure suitably qualified contractors to undertake deer culling services on Scotland’s national forests and estate, it would be unable to protect tree crops, leading to a massive detrimental impact on environmental sustainability and its ability to create profitable crops – the main source of income for the Authority.
58. Therefore, the Authority concluded that the public interest lay in upholding the exception and withholding the information.
The Applicant's submissions about the public interest
59. In their submissions, the Applicant provided background to the circumstances which led to their company and the author of the “self-cleansing letter” being excluded from tendering for specific contracts.
60. The Applicant also submitted that the Authority had indicated it would allow both parties to work for them if they passed a self-cleansing process.
61. The Applicant submitted that attempts by their company to pass the “self-cleansing” process had been unsuccessful. They believed this might have been due to the content of the “self-cleansing” letter (which is the subject of this request), which had already been submitted.
62. It is the Applicant’s view that a self-cleansing document should not contain information which is deemed private or confidential. However, if there is anything that it is, the Applicant considers this could easily be redacted.
63. The Applicant also submitted that in order to fulfil their duty to be transparent, the Authority should disclose the requested information.
The Commissioner's view on the public interest
64. The Commissioner has already concluded that disclosure of the information would be likely to cause substantial harm to a legitimate commercial interest.
65. The Commissioner recognises the considerable public interest in transparency and public scrutiny in relation to how public authorities make decisions, including around which suppliers it permits to tender for contracts with it (particularly where this involves the use of public funds).
66. In this case, the Commissioner acknowledges that disclosure of the information in the “self-cleansing letter” might satisfy the requester’s curiosity and interest around decisions taken by the Authority in relation to their business. However, he must set that against any public interest in withholding the information, bearing in mind that disclosure under the EIRs is, of necessity, disclosure into the public domain.
67. Given the substantial harm the Commissioner has identified as a result of disclosure, he accepts that it is not in the public interest to disclose information which would harm trust and confidence between potential contractors and the Authority around the self-cleansing process. Similarly, he also accepts that there is no public interest in disclosing information which would negatively impact on suitable competition in an already restricted pool of businesses who can offer services of the kind required under deer management contracts let by the Authority.
68. On balance, and having applied a presumption in favour of disclosure, the Commissioner has concluded that the public interest in maintaining the exception in regulation 10(5)(f) of the EIRs outweighs the public interest in making the information available. Therefore, he finds that the Authority was entitled to withhold the information under regulation 10(5)(f) of the EIRs.
Regulation 11(2) – personal information
69. As mentioned above, the Authority relied on the exception in regulation 11(2) of the EIRs for withholding certain of the information contained in the “self-cleansing letter”.
70. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in the UK GDPR or in the DPA 2018 (regulation 11(3)(A)(a)).
71. The Authority submitted that disclosure would breach the data protection principle in Article 5(1)(a) of the UK GDPR.
Is the withheld information personal data?
72. Personal data are defined in section 3(2) of the DPA 2018 which, read with section 3(3), incorporates the definition of personal data in Article 4(1) of the UK GDPR:
“…any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”
73. The Authority’s view was that certain of the information in the “self-cleansing letter” related to living individuals, and disclosure of it would identify these individuals and therefore was their personal data in line with section 3 of the DPA 2018.
74. Having considered the information for which the Authority has relied on the exception in regulation 11(2) of the EIRs, the Commissioner accepts that the information is personal data as it comprises names, initials and images which would enable someone to identify those living individuals. The information clearly relates to the individuals in question.
Would disclosure contravene one of the data protection principles?
75. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”. The definition of “processing” is wide and includes (section 3(4)(d) of the DPA 2018) “disclosure by transmission, dissemination or otherwise making-available”. In the case of the EIRs, personal data are processed when disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Article 6(1)(f) of the UK GDPR
76. Among other questions, therefore, the Commissioner must consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
77. The Authority was of the view that the lawful basis in Article 6(1)(f) was only one that might apply to allow them to process the personal data in response to the Applicant’s request. However, it concluded that disclosure would not fulfil the conditions required by Article 6(1)(f).
Condition (f): legitimate interests
78. Condition (f) states that processing would be lawful if it “…is necessary for the purposes of the legitimate interests to be pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the subject is a child”.
79. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
80. The tests which must be met before Article 6(1)(f) can apply are as follows:
- Does the Applicant have a legitimate interest in obtaining the personal data?
- If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
- Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject(s)?
Does the Applicant have a legitimate interest in obtaining the personal data?
81. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner has published guidance on the Personal Data exception in regulation 11, and it states:
“In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.”
82. The Authority accepted that the Applicant had a legitimate interest in the requested information.
83. The Applicant provided reasons to the Commissioner as to why they considered the requested information should be disclosed.
84. Having considered the submissions from both the Authority and the Applicant, the Commissioner accepts that the Applicant was pursuing a legitimate interest in seeking to understand the actions and decisions taken by the Authority in relation to their business. The Commissioner is also satisfied that this legitimate interest would extend to the wider public interest, in being satisfied that the Authority was acting appropriately and transparently when administering the “self-cleansing process” under the Regulations. The Commissioner is therefore satisfied that the Applicant has a legitimate interest in obtaining the personal data.
Is disclosure of the personal data necessary?
85. Having accepted that there is a legitimate interest in the withheld personal data, the Commissioner must consider whether disclosure of the personal data is necessary for those legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
86. The Commissioner has considered this carefully in light of the decision of the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner (2013) UKSC 55. In this case, the Supreme Court stated (at paragraph 27):
“…A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”
87. As the Supreme Court confirmed, “necessary” means “reasonably” rather than “absolutely” or “strictly” necessary. When considering whether disclosure would be necessary, public authorities need to consider whether the disclosure is proportionate as a means and fairly balanced as to ends, or whether the requester’s legitimate interests can be met with means which interfere less with the privacy of the data subject(s).
88. The Authority was of the view that disclosure of the withheld personal data was necessary to achieve the Applicant’s legitimate interests. It had concluded that it was not possible to fulfil the Applicant’s legitimate interests by a means which interfered less with the fundamental rights and freedoms of the data subjects.
89. Having considered the legitimate interests outlined by the Applicant, the Commissioner accepts that disclosure of the withheld personal data would be necessary to achieve the Applicant’s legitimate interests.
Interests or fundamental rights and freedoms of the data subject
90. As the Commissioner accepts that the Applicant’s legitimate interest could only be met by the disclosure of the withheld information, he must go on to balance the legitimate interests of the Applicant against the fundamental rights and freedoms of the data subjects. This involves a balancing exercise between the legitimate interests of the Applicant and the data subjects in question. Only if the legitimate interests of the Applicant outweigh those of the data subjects can the data be disclosed without breaching the first data protection principle.
91. In the Commissioner’s briefing on the personal data exception, he notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:
- whether the information relates to an individual’s public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
- the potential harm or distress that might be caused by disclosure
- whether the individual objected to the disclosure
- the reasonable expectations of the individual as to whether the information should be disclosed.
92. In its submissions, the Authority explained that the individuals referred to in the letter, other than the author, did not know they had been referred to in this context or what had been said about them. The Authority submitted that these were private individuals with no public profile, and that the same was true of the author.
93. The Authority argued that these individuals would have no expectation that this information would be revealed publicly, which would be the effect of disclosure under the EIRs. The Authority also provided submissions around specific harm that it considered would be caused to the rights and freedoms of the data subjects if this information were to be disclosed.
94. As a consequence, the Authority concluded that the fundamental rights and freedoms of the individuals outweighed the legitimate interests of the Applicant in this case.
95. As mentioned above, the personal information under consideration concerns names, initials and images.
96. The Commissioner has considered the Authority’s submissions carefully and accepts that none of the data subjects, apart from the author, would have awareness that personal information about them was contained in the “self-cleansing letter”. Whilst the information about the data subjects (including the author) relates to their working life, as opposed to their private life, the Commissioner accepts that these data subjects are not public sector employees. Nor do they occupy a role for which they would have a public profile. As such, the Commissioner agrees that they would have no reasonable expectation that information of this nature would be disclosed into the public domain as a consequence of an information request under the EIRs.
97. Furthermore, the Commissioner also notes, on the basis of the submissions received from the Authority, that the author themselves has refused consent for the disclosure of their own personal data.
98. The Commissioner is also satisfied, on the basis of the submissions received from the Authority, that disclosure of the personal data might cause harm or distress to those data subjects identified in the withheld information, by affecting their relationship with other businesses operating in this market.
99. The Commissioner acknowledges that the Applicant is interested in receiving the withheld information , to provide them with an insight into why the Authority has taken the action and decisions it has in relation to their business. However, the Commissioner takes the view that, on balance, the legitimate interests served by disclosure of the information to the Applicant (and the wider public) would not outweigh any prejudice that would be caused to the data subjects’ rights and freedoms or legitimate interests.
100. Consequently, the Commissioner finds that such prejudice would be unwarranted. He is not, therefore, satisfied that a lawful condition of processing in Article 6 of the UK GDPR could be met in relation to the personal data under consideration.
101. Given that the Commissioner has found that no condition of processing in Article 6 of the UK GDPR could be met by disclosure of the personal data, he has found that the processing would be unlawful.
102. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that making the personal data available would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Consequently, he is satisfied that making the personal data available is not permitted by regulation 11(2) of the EIRs.
Other matters
103. As already discussed, in this case the Authority relied on the exceptions in regulations 10(5)(f) and 11(2) of the EIRs for refusing to make information in the “self-cleansing letter” available to the Applicant. However, the Authority did not rely on these exceptions for all of the information contained in the letter. There are parts of the letter for which the Authority has not applied any exception.
104. Having considered the remaining parts of the letter to which no exception has been applied, the Commissioner has concluded that this remaining information would be meaningless if disclosed, given the large swathes of information he has found to have been properly withheld. The Commissioner notes the 2016 judgment of the First Tier Tribunal (Information Rights) in Paul Boam and the (UK) Information Commissioner and Ofsted. In that case, the Tribunal accepted that there are limits to reasonable redaction, for example in cases where:
the excisions required … must be so drastic that what remains in incoherent or even meaningless, meaning that it is reasonable to redact entire documents.
Decision
The Commissioner finds that the Authority complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
2 August 2023
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
…
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
…
39 Health, safety and the environment
...
(2) Information is exempt information if a Scottish public authority-
(a) is obliged by regulations under section 62 to make it available to the public in accordance with the regulations; or
(b) would be so obliged but for any exemption contained in the regulations.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations –
“the Act” means the Freedom of Information (Scotland) Act 2002;
“applicant” means any person who requests that environmental information be made available;
“the Commissioner” means the Scottish Information Commissioner constituted by section 42 of the Act;
“the data protection principles” means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section of that Act):
…
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
…
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
…
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);
…
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act); and
…
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
…
(b) is subject to regulations 6 to 12.
....
10 Exceptions from duty to make environmental information available
(1) A Scottish public authority may refuse a request to make environmental information available if-
(a) there is an exception to disclosure under paragraphs (4) or (5); and
(b) in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception.
(2) In considering the application of the exceptions referred to in paragraphs (4) and (5), a Scottish public authority shall-
(a interpret those paragraphs in a restrictive way; and
(b) apply a presumption in favour of disclosure.
...
(5) A Scottish public authority may refuse to make environmental information available to the extent that its disclosure would, or would be likely to, prejudice substantially-
…
(f) the interests of the person who provided the information where that person-
(i) was not under, and could not have been put under, any legal obligation to supply the information;
(ii) did not supply it in circumstances such that it could, apart from these Regulations, be made available; and
(iii) has not consented to its disclosure; or
…
11 Personal data
…
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -
…
(b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations –
(a) would contravene any of the data protection principles, or
…
(7) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
17 Enforcement and appeal provisions
(1) The provisions of Part 4 of the Act (Enforcement) including schedule 3 (powers of entry and inspection), shall apply for the purposes of these Regulations as they apply for the purposes of the Act but with the modifications specified in paragraph (2).
(2) In the application of any provision of the Act by paragraph (1) any reference to -
(a) the Act is deemed to be a reference to these Regulations;
(b) the requirements of Part 1 of the Act is deemed to be a reference to the requirements of these Regulations;
…
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
…
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) “Data subject” means the identified or identifiable living individual to whom the data relates.
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
…
