Home Decisions

Decision 115/2023

Decision 115/2023: Lochaber Smelter:  Guarantee and Reimbursement Agreement and Guarantee Fee letter

Authority:  Scottish Ministers
Case Ref:  202100793


Summary

The Applicant asked the Authority for the Guarantee and Reimbursement Agreement and the Guarantee Fee letter relating to the Lochaber smelter (and any amendments thereto).  The Authority disclosed some information and withheld the remainder.

Following an investigation, the Commissioner found that the Authority had correctly withheld some of the information on the basis that disclosure would, or would be likely to, prejudice substantially the effective conduct of public affairs.  He also found that some third party personal data had been correctly withheld.  For the remainder, the Commissioner found that this information had been wrongly withheld under the 
exemptions claimed and required the Authority to disclose it to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal 
data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision.  The Appendix forms part of this decision.

Background

1. On 22 April 2021, the Applicant made a request for information to the Authority, relating to the Lochaber smelter.  They asked for:

  • The Guarantee and Reimbursement Agreement (GRA) between [the Authority] and GFG Alliance companies and any subsequent amendments made to the agreement.
     
  • The Guarantee Fee Letter which sets out the terms of the guarantee fee and any subsequent amendments made to the letter.

2. The Authority responded on 21 May 2021, partially disclosing information in four documents which fell within scope.  The Authority redacted certain information (variously) under the exemptions in:

  • section 33(1)(b) of FOISA, on the basis that disclosure would likely prejudice substantially the commercial interests of the parties to the GRA and the commercial entities involved.  The Authority believed the public interest in transparency was outweighed by the risk to the companies’ commercial interests.
  • section 38(1)(b) of FOISA, on the basis that some of the information comprised third party personal data (i.e. names and contact details), disclosure of which would breach data protection principles.

3. Later that day, the Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that they were dissatisfied with the decision because, in their view, some of the information which had been redacted was in the public domain, the exemptions claimed did not apply to all of the information redacted, the 
public interest test had not been properly carried out and the public interest favoured disclosure.

4. The Authority notified the Applicant of the outcome of its review on 21 June 2021, confirming its original decision with modifications.  The Authority disclosed some further information in the in-scope documents and withheld the remainder under the exemptions in:

  • section 33(1)(b) of FOISA, on the basis that disclosure would likely weaken the negotiating position of the business while providing commercially sensitive information to competitors, and would also likely have an impact on the long term profitability and attractiveness of the business to future investors.  The Authority believed disclosure was not in the public interest as this would place the parties involved at a 
    competitive disadvantage.  In its view, the public interest lay in GFG Alliance (GFG) being able to negotiate effectively in commercial contexts to ensure the continued profitability and viability of the business, given its position as a major source of employment in the West Highlands.
  • section 38(1)(b) of FOISA, for the names and contact details of officials and equivalent third party representatives below senior civil service (SCS) level, and the direct contacts of more senior officials.

5. On 30 June 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated they were dissatisfied with the outcome of the Authority’s review for the reasons stated in their request for review: they believed the exemptions did not apply to some or all of the information, and the public interest favoured disclosure.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.

7. On 16 July 2021, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was subsequently allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to the Authority’s justification for withholding some of the information requested under the exemptions in section 33(1)(b) and section 38(1)(b) of FOISA.

9. The Applicant was also invited to submit their comments on the public interest in disclosure of the information withheld under section 33(1)(b), and to explain why the personal data withheld under section 38(1)(b) was important to them or of value to the public.

10. The Applicant provided submissions on this to the Commissioner on 2 and 3 December 2021.

11. Early in the investigation, on 28 January 2022, the Authority disclosed some further information in the in-scope documents to the Applicant.  This, the Authority stated, reflected the information which had been made publicly available since receiving the Applicant’s request.  The Authority continued to withhold the remainder 
under the exemptions in section 33(1)(b) and section 38(1)(b) of FOISA.

12. Following the Authority’s further disclosure, the Applicant provided further submissions to the Commissioner on 3, 5 and 6 February 2022, explaining why they remained dissatisfied with the Authority’s position.

13. On 7 February 2022, the Authority provided the Commissioner with the submissions requested for the remaining withheld information, in respect of its reliance on the exemptions in section 33(1)(b) and section 38(1)(b) of FOISA.

14. The Applicant provided further submissions to the Commissioner on 20 July 2022, setting out why they believed disclosure of the information requested was in the public interest.

15. On 17 November 2022, the Authority was given the opportunity to provide the Commissioner with any further submissions it wished to make.

16. On 9 December 2022, the Authority informed the Commissioner that it now wished to withdraw its reliance on section 33(1)(b) for the information originally considered to be commercially sensitive and now, instead, wished to apply section 30(c) to that same information.   It provided submissions in support of its reliance on section 30(c) and confirmed that it wished to rely on its original submissions, previously provided on 7 February 2022, for section 38(1)(b).

17. The Authority notified the Applicant of its change of position on 16 December 2022.

18. On 2 January 2023, the Applicant provided further submissions to the Commissioner, on the Authority’s decision to also now rely on section 30(c) of FOISA.

19. On 21 and 26 June 2023, and subsequently on 31 July 2023, the Applicant provided further comments to the Commissioner.

Commissioner’s analysis and findings

20. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Background:  Lochaber Smelter Guarantee

21. The Authority provided detailed background information in its submissions, the following parts of which may be helpful in explaining the background of the Lochaber Smelter Guarantee:

  • The Lochaber aluminium complex in Fort William is the UK’s last remaining aluminium smelter, the operation of which is a key component of Scotland’s industrial capability and a major source of employment in the West Highlands.
  • When Rio Tinto decided to review its Lochaber operations in 2016, the smelter faced the prospect of closure, endangering over 300 jobs in total (direct, indirect and induced).  The Authority’s focus at the time was to avoid the fragmentation of the Lochaber complex, to secure the long-term viability of the smelter and to realise 
    further industrial and employment opportunities on site.
  • In September 2016, as part of the Authority’s wider overall objective to preserve jobs, protect the economy and sustain the metals industry in Scotland, it indicated a willingness to support any purchaser who would retain the smelter and associated hydro-power scheme together, and make the necessary commitment to 
    significant investment in the development of the Lochaber assets.  The Authority’s offer included the potential to guarantee the power purchase obligations of the aluminium smelter and was made known on an even-handed basis to all short-listed bidders via the vendor (Rio Tinto).
  • To deliver its objective for the site, the Authority is standing behind a portion of the power purchase obligations of the aluminium smelter operator (Alvance British Aluminium Limited (SmelterCo)) in the event that it cannot pay for the power it is contracted to take from the hydro-electric power station operator (Simec Lochaber Hydropower 2 Limited (HyroCo)).  Both companies are part of GFG which is a collection 
    of global businesses and investments.
  • The commercial guarantee arrangement (the Guarantee) was entered into in December 2016 by the Authority, SmelterCo and HydroCo, and guarantees over a 25 year term that the Authority will pay for a percentage of the power that SmelterCo is contracted to purchase from HydroCo in the event that SmelterCo is unable to do so.
  • The nominal value of the Authority’s contingent liability on day one of the Guarantee was £586 million (i.e. the total amount of payments guaranteed by the Authority across the 25 year agreement), and is the largest industrial guarantee ever agreed by the Authority.
  •  In return for the Guarantee, the Authority receives a commercial guarantee fee (the Fee) from GFG.
  • In March 2021, GFG’s major providers of working capital and investment finance (Greensill Capital (UK) Limited and Greensill Capital Management Company (UK) Limited (together “Greensill”)) entered administration.
Authority’s interests

22. In addition to the background information above, the Authority explained that, as a result of its legal obligations arising from the Guarantee, it had a significant and specific financial and economic interest in the operation of the smelter to which the information related.  In addition, it had an overarching general interest in the original objectives of the proposal, namely the retention of jobs and the support of the metals industry in Scotland.

23. The Authority acknowledged that the Commissioner had previously indicated in Decision 144/2021 that he did not consider the Authority to be a commercial actor in respect of Scotland’s energy sector, but that it may have other economic interests in relation to the smelter.

24. The Authority considered that its commercial, economic and financial interests in respect of the Guarantee were manifest and quantifiable, and information within the material remained current.  It also submitted that there was considerable uncertainty with respect to any future scenario involving the smelter, the loss of which could materially impact upon the local regional economy.  It noted that, during the 18 months since the Greensill collapse, GFG and its primary shareholder, Sanjeev Gupta, had sought to defend and engage in legal action across multiple jurisdictions in order to preserve operations.

The Applicant’s perspective

25. Following the issue of Decision 062/23  and Decision 063/23 on 20 June 2023 (which also related to the Lochaber Smelter GRA), the Applicant wrote to the Commissioner (on 21 June 2023 and on 31 July 2023) to advise him that they strongly disagreed with the outcome.  They stated that the Commissioner appeared to have accepted information provided to him by the Authority at face value and without adequate challenge.  In 
their view, the guarantee did nothing for the preservation of jobs at the smelter, but guaranteed the income for the hydro-plant only, which had very few direct jobs.  In their view, “the story of saving jobs is concocted to divert attention away from the real purpose (a financial enabler to allow the GFG Alliance to purchase the company)”.

26. The Applicant also wrote to the Commissioner on 26 June 2023, contesting in more detail the accuracy of the background information provided by the Authority in paragraphs 16 and 13 of those Decisions respectively.  The Applicant provided what they described as an “alternative background”, as set out below:

  • The primary purpose of the guarantee was to enable GFG to purchase Alcan Aluminium UK Ltd (Alcan) by issuing debt.  The guarantee did not directly support existing jobs.  As part of the agreement, Greensill Capital securitised the guarantee together with forecasted revenue streams from the smelter to the supporting hydro-electric facility in order to provide loan-financing to GFG.  In the event that the guarantee was called in, it provided protection to Greensill (now in administration), not companies within GFG.
  • While the Authority may claim that the guarantee was offered on an even-handed basis to all prospective bidders, it strongly favoured bidders using supply-chain finance as the mechanism of acquisition (such as GFG).  The offer provided much less advantage, for example, to cash bidders and so the “even-handed” offer merely created an illusion of fairness.  The net effect of the guarantee offer to all bidders was to significantly elevate the attractiveness of the debt-financed GFG bid.  (The Authority had an already-established relationship with GFG through its purchase of the Dalzell and Clydebridge steelworks.)
  • Alcan was not a distressed company at the time of acquisition by GFG and was trading profitably.  GFG purchased the company for £330 million.  This was not the value of a distressed company.  The funding enabled by the guarantee was not “last resort funding” in relation to the Lochaber complex.
  • A stated objective of the Authority was to prevent the fragmentation of the Lochaber smelter complex.  However, immediately after the acquisition, GFG removed the Lochaber smelter, Kinlochleven hydro-plant and estate land holdings from the existing legal entity (Alcan), transferring them to new and separate legal entities under different structures ultimately controlled from different off-shore jurisdictions.
  • The Authority had represented that, in return for entering into the guarantee, it received a “commercial fee”.  There was no independent evidence to support the assertion that the fee was at a commercial level.  If the arrangement was of a commercial level, GFG could have obtained the guarantee from the private sector where there are much lower transparency expectations.
  • High levels of secrecy over high-value government contracts were a red flag of potential fraud.  Fraudsters were extremely unlikely to consent to disclosure of any information in any circumstance.  GFG is under investigation by the Serious Fraud Office for suspected fraud, fraudulent trading and money-laundering including its financing arrangements with Greensill.  The Serious Fraud Office has no jurisdiction in 
    Scotland where there is no equivalent agency.

Section 30(c) – Prejudice to effective conduct of public affairs – “otherwise” prejudice

27. Section 30(c) of FOISA provides that information is exempt information if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.

28. The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in section 30(a) and (b).  This is a broad exemption and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.

29. There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers the harm in question would require to be of real and demonstrable significance.  An authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur: therefore, the authority needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.

30. During the investigation, the Authority confirmed that it was now relying on this exemption to withhold some information, namely that which it had withheld, at review stage, under section 33(1)(b) of FOISA.

The Authority’s submissions on section 30(c)

31. In its submissions to the Commissioner, the Authority believed it was essential for it to have a productive relationship with companies like GFG, which run businesses of national and local importance to Scotland.  As the Lochaber smelter was a significant employer in the local area, the Authority had a significant interest in the business through the Guarantee.

32. The Authority submitted that there were three key reasons for withholding the information under the exemption in section 30(c), as follows:

Point (a) - Disclosure would weaken the Authority’s ability to negotiate guarantee terms

33. The Authority submitted it was likely that external lenders will be involved in situations where it is providing guarantees to support businesses.  It would be in these lenders’ interests to negotiate the most generous guarantee terms possible, thereby passing risk to the Authority (which would be to the detriment of the 
Authority’s interests were such a guarantee more likely to be called up).  Disclosure would enable future lenders to form views about the Authority’s likely appetite for risk and on how it takes decisions on these matters, and would allow them to use this as part of their negotiation strategy.  The Authority believed the process of 
benchmarking one guarantee against another would ultimately be detrimental to its interests.

Point (b) - Disclosure would make distressed businesses less likely to engage with 
Authority support

34. The Authority submitted that businesses may be hesitant to consider financial intervention sponsored by it, or its Agencies, due to the risk of this becoming public knowledge, as this would alert customers and suppliers to the fact that the business was utilising last resort funding to continue to trade.  This, in turn, would adversely 
affect the business as its customers and suppliers would be less willing to deal with it due to fear of wasted costs (e.g. where the business was unable to pay for materials ordered), leading to further difficulties in trading.  In the Authority’s view, disclosure would exacerbate the issue by underscoring not only that fact, but also the 
underlying basis on which decisions are made about sensitive business operations and situations, and this risk was not one that arose where a business secured support from a third party which was not a Scottish public authority.  The Authority also believed this would heighten concerns about seeking support from the Authority, making such support less effective and thereby prejudicing its own commercial interests.

35. As these companies had not consented to disclosure, the Authority considered that release of the information would likely undermine trust in it, leading to businesses being reluctant to engage with it on such matters in the future, to the detriment of the Scottish economy and employment.  For these reasons, the Authority believed disclosure would substantially prejudice its ability to take similar action to secure 
the future of employers and jobs.

36. The Authority argued that it must be able to assure businesses that sensitive information about their financial position and future plans will not be released as a result of their involvement with the Authority.  In the Authority’s view, maintenance of trust was important to allow it to engage with businesses in the best interests of Scotland, with the ultimate aim of preserving employment and growing the economy.  It believed that disclosure of the information would jeopardise its ability to work in partnership with commercial actors such as GFG in future.

Point (c) - Disclosure would remove the private space for consideration that is 
required by the Authority to make decisions in relation to a significant contract with implications for jobs and the economy

37. The Authority submitted that the Guarantee was a live agreement, and it was required to take decisions in relation to the management of the Guarantee.  It argued that release of information relating to the Guarantee, including the terms of the Guarantee, would inhibit substantially its ability to make such decisions in the public 
interest, by removing the private space required for it to do so.

38. The Authority considered that disclosure would also substantially prejudice its relationship with GFG.  In its view, disclosing the content of a live agreement to which GFG is party could negatively impact on GFG’s financial operations in a number of stated ways.  The Authority believed that GFG would likely consider that it had 
revealed sensitive details which were shared on a confidential basis in respect of the agreement, which would be detrimental to GFG and its ongoing relationship with the Authority.

The Applicant's submissions on section 30(c)

39. The Applicant disagreed that the exemption in section 30(c) was engaged.  In their view, disclosure of the withheld information would not result in the significant probability of substantial prejudice.

40. In respect of point (a) above, the Applicant submitted that the Authority had not substantiated the link between the specific information, disclosure and harm.  They argued that the Lochaber Smelter GRA was a novel, highly unusual agreement with a financing firm (Greensill Capital (UK) Ltd) which was not authorised and regulated by the Financial Conduct Authority, and which had subsequently collapsed into administration.  In their view, the unique nature of this agreement would not compromise negotiations in future guarantees.

41. In respect of point (b) above, the Applicant did not believe there was any requirement for the Authority to obtain the consent of the participating companies prior to disclosing information.  In their view, the participating companies will have engaged into the GRA knowing that the Authority was a public authority for the purposes 
of FOISA, and so information could be disclosed solely at the discretion of the Authority.  They argued that the agreement should contain a clause to that effect.

42. Following the issue of Decision 062/2023 and Decision 063/2023, the Applicant confirmed to the Commissioner that his position remained that section 30(c) was not engaged and that the public interest favoured disclosure of the information.  In particular, he noted:

  • unnecessary secrecy in government contracts was a breeding ground for 
    corruption, wrongdoing and the inefficient allocation of public resources;
  • Alcan was not a distressed company at the time of the acquisition by GFG.  The 
    financial distress that has subsequently arisen appeared to be the result of the high 
    level of debt used by GFG (including to fund this acquisition); and
  • GFG appeared to take an aggressive approach to withholding information about 
    their operations in the UK, including systematic non-compliance with laws and 
    regulations.
The Commissioner's views on section 30(c)

43. The Commissioner has considered the submissions from both parties along with the withheld information.  The Commissioner would stress that he has not simply accepted the information provided to him by the Authority at face value and without challenge.  He has also taken into account the age of the information as at the date when the Authority issued its review outcome (i.e. 21 June 2021).

44. The information in question comprises the Guarantee itself and the Guarantee Fee letter (both dated December 2016), the Amended and Restatement Agreement (ARA) (dated July 2020) and the COVID 19 Delay Agreement letter (dated December 2020).  Although the Commissioner recognises that the Guarantee and the Fee letter were more than four and a half years old by the time the Authority issued its review outcome, the Commissioner notes that the terms of the original Guarantee were still in force when the COVID 19 Delay Agreement letter was issued.  In light of this, the Commissioner considers the information requested to be relatively recent in relation to the date of the Authority’s review.

45. The Commissioner must consider the withheld information with regard to the circumstances at the time of the Authority’s review outcome.  Given the sensitivity of the information and the circumstances surrounding it, the Commissioner is limited in the reasoning he can set out in this Decision Notice.

46. By the date of the Authority’s review, the financial viability of the companies involved in the Lochaber Smelter Guarantee had changed considerably.  However, what remained constant was the existence of the Authority’s financial obligation in the event that the Guarantee was called-in.

47. The Commissioner has considered the information being withheld by the Authority, which relates to the terms of the Guarantee.  He is, however, unable to describe that information in any greater detail without revealing its nature.  The Commissioner is of the view that many of the arguments now put forward by the Authority for withholding this information under section 30(c) of FOISA were pertinent when the Authority issued its review outcome in June 2021 (i.e. when it withheld that same information under section 33(1)(b)).

48. While the Commissioner is not obliged to consider the information with regard to current circumstances, he is of the view that, given the changing circumstances regarding GFG’s financial situation in relation to the Guarantee, the sensitivity of this information, even continuing into the present, is something which he cannot 
ignore.  He recognises, however, that the level of sensitivity will not always be the same, say in a number of years’ time.

49. Having considered all the arguments put to him, the Commissioner recognises that the majority of the information being withheld is sensitive.  Some of that information relates to potential works and production levels, and other information relates to ongoing prospects and obligations, including restrictions on what the parties to the GRA can do.  The Commissioner believes that disclosure of this information could 
increase the risk of harm to the businesses involved or risk the Guarantee being called-in, and that it could also lead to the prospect of entering into business with the Authority being less attractive.

50. In the Commissioner’s view, disclosure of the majority of the information would have a detrimental impact on the ability of the Authority, GFG and the other commercial companies involved in the Lochaber Smelter Guarantee, to continue in this arrangement in a competitive environment.  He believes that this, in turn, would impede the Authority’s ability to engage with businesses, in future similar arrangements, in the best interests of Scotland and its economy.  He also recognises that disclosure of this information could enhance the risk of the Guarantee being called-in.

51. The Commissioner is satisfied that, if the majority of the withheld information was disclosed, this would, or would be likely to, prejudice substantially the effective conduct of public affairs.  He therefore finds that the Authority was entitled to rely on the exemption in section 30(c) of FOISA to withhold this information.

52. However, for certain other information being withheld, the Commissioner does not take the same view.  He notes that some of this information has already been disclosed by the Authority under separate routes.  He therefore does not accept the Authority’s arguments, that disclosure of this particular information would lead to the substantial prejudice claimed by the Authority with regard to its ability to conduct its public affairs, or the ability of GFG to continue to operate effectively in a commercial context.

53. The Commissioner therefore finds that disclosure of certain information being withheld by the Authority would not result in the harm claimed.  He does not, therefore, accept that the exemption in section 30(c) of FOISA should be upheld in respect of that particular information.

54. Given that the Commissioner does not accept that the exemption applies to certain information being withheld under section 30(c), he is not required to consider the public interest test in section 2(1)(b) for that information.

55. As the Authority is not relying on any other exemption to withhold that information, he requires the Authority to disclose it to the Applicant.  (The information to be disclosed will be marked up on a copy of the withheld information to be provided to the Authority along with this Decision Notice.)

56. The Commissioner will now go on to consider the public interest test in respect of the remaining information for which he has found that the exemption in section 30(c) is engaged.

Public interest test – section 30(c)

57. Section 30(c) is subject to the public interest test required by section 2(1)(b) of FOISA.  As the Commissioner has found that the exemption in section 30(c) was correctly applied to some of the withheld information, he is now required to consider whether, in all the circumstances of the case, the public interest in disclosing that remaining withheld information is outweighed by the public interest in maintaining the exemption.

The Authority’s submissions on the public interest test – section 30(c)

58. The Authority recognised the public interest in disclosure, as part of an open, transparent and accountable government and to inform public debate.  It also recognised the public interest in the aluminium smelter complex, and in how the Authority works with companies such as GFG when public funds are involved.

59. However, given the importance of the smelter to Scotland, the Authority believed this was outweighed by the public interest in protecting GFG’s trust in its relationship with the Authority.  The Authority argued that it was of vital importance to Scotland and its people that it was able to intervene to protect jobs and the wider 
economy.  When this involves a guarantee such as this one, the Authority believed the public interest lay in protecting certain sensitive information to allow future interventions.  It submitted that, ultimately, the aim of this intervention was to protect jobs, and there was no public interest in disclosing information that would 
jeopardise such future action.  The Authority believed the public interest lay in protecting the interests of those employed within the Lochaber smelter business (circa 200 people), given its importance not only to those employees, but also to the wider economy of the local area.

60. The Authority also believed that the public interest in maintaining the private space necessary for it to make effective decisions also outweighed that in the release of the information.

The Applicant’s submissions on the public interest test – section 30(c)

61. The Applicant submitted a number of arguments in support of their position that the public interest favoured disclosure of the information.  In their view, there was a public interest:

  • In ensuring the Guarantee agreement and the Authority’s actions complied with all laws and regulations;
  • in ensuring the Scottish Parliament’s Finance and Constitution Committee was provided with complete and accurate information by the Authority, and that it provided effective independent scrutiny prior to approving the £586m contingent liability;
  •  in subjecting the financial guarantee to broad public scrutiny to increase the quality of the scrutiny over that achievable by a small number of politicians (lay people);
  • in disclosure, because of suspected fraud and money-laundering between two of the key parties (GFG and Greensill Capital (UK) Limited), because the Guarantee was not based on sound data, and because one of the key parties to the agreement (Greensill Capital (UK) Limited) was now in administration;
  • in ensuring the agreement was robust and at arm’s length, with no mutual reward between the Authority and other parties to the agreement, and that it provided value for money at all stages (from approval to delivery);
  • in disclosure, in order to evaluate relative spending priorities and to be able to independently monitor and measure approved project outcomes;
  • in disclosure, because of the financial size (£586m), the unusual term (25 years), the nature and the complexity of the agreement;
  • in understanding the Authority’s exposure to the GRA; and
  • in understanding the security and guarantees the Authority has obtained from GFG member companies for entering into the agreement and, specifically, whether they were adequate.

62. Separately, the Applicant made the following arguments (see paragraph 26) which were also relevant to the public interest test:

  • the guarantee did not directly support existing jobs;
  • the guarantee provided protection to Greensill and not GFG;
  • the funding enabled by the guarantee was not “last resort funding” in relation to the Lochaber complex;
  • the funding had not prevented the fragmentation of the Lochaber smelter complex;
  • there was no independent evidence to support the Authority’s assertion that the fee was at a commercial level; and
  • “secrecy” over high-value government contracts was a “red flag of potential fraud” and GFG was under investigation by the Serious Fraud Office.
The Commissioner's view on the public interest – section 30(c)

63. The Commissioner has taken account of all of the relevant submissions from both parties, together with the remaining withheld information in this case.  He is required to balance the public interest in disclosure of the information requested against the public interest in maintaining the exemption.  In the context of FOISA, the public interest should be considered as “something which is of serious concern and benefit to the public”.  As stated previously, due to the sensitivity of the information and the circumstances surrounding it, the Commissioner is limited in the reasoning he can set out in this Decision Notice.

64. As rehearsed above, the Commissioner has already accepted that disclosure of the remaining withheld information would, or would be likely to, cause substantial prejudice to the effective conduct of public affairs.

65. Taking into account the significant size of the Lochaber Smelter Guarantee and those potentially affected by the circumstances surrounding it, particularly were it to be called in, the Commissioner accepts that there is clear and substantial public interest in understanding the finer details of the Guarantee and any underpinning or 
associated information.  However, he recognises that this must be carefully balanced against any impact that disclosure of such detailed information (whether it be financial, commercial or otherwise) would have had - at the time when the Authority issued its review outcome - with regard to the Lochaber smelter, the Guarantee itself (underwritten by the Authority) and what the likely circumstances might be were the Guarantee to be called in.

66. The Commissioner considers there is a significant and substantial public interest in maintaining the exemption in relation to information which could adversely impact the ability of the parties involved to continue, as planned, with the Guarantee.  He recognises that, were circumstances to arise requiring the Guarantee to be called in, this would clearly impact the parties involved (including the Authority), the economy of the local area (and the wider Scottish economy) and the jobs of those individuals employed at the smelter and associated businesses, both directly and indirectly.

67. In the Commissioner’s view, there is also a substantial public interest in maintaining the exemption in relation to sensitive information which could adversely impact GFG’s current (and changing) financial situation and lead to the Guarantee being called in.  He recognises that such a situation could lead to a number of unwanted 
circumstances presenting themselves, for example job losses, the requirement for a new agreement to be drawn up or entered into by the Authority, and a reduction in crucial commercial information being provided by businesses to the Authority which would inhibit the Authority’s ability to take fully informed decisions and secure best value for public money.  Such circumstances would clearly impact on the Authority’s position 
with regard to its ability to effectively conduct its public affairs, and would not be in the public interest.

68. On balance, therefore, the Commissioner is of the view that the public interest in maintaining the exemption outweighs the public interest in disclosing the remaining information.

69. The Commissioner therefore finds that the Authority was entitled to withhold the remaining information requested under the exemption in section 30(c) of FOISA.

Section 38(1)(b) – Personal information

70. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the 
DPA 2018.

71. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.

72. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK 
GDPR.

73. The Commissioner must decide whether the Authority was correct to withhold some of the information requested under section 38(1)(b) of FOISA.

Personal data disclosed by Authority at start of investigation

74. As explained above, on 28 January 2022, the Authority disclosed some additional information to the Applicant.  This included some information which the Authority had originally withheld under the exemption in section 38(1)(b) of FOISA.

75. In the absence of any detailed submissions from the Authority as to why this nformation was initially considered exempt from disclosure under section 38(1)(b), the Commissioner has no option but to find that disclosure of that information would not have met the tests required for section 38(1)(b) to be engaged.  Consequently, in this case, the Commissioner is not satisfied that this particular information was properly 
withheld under this exemption at review stage.

76. The Commissioner concludes, therefore, that the Authority had not been entitled to rely upon section 38(1)(b) of FOISA to withhold the information in question at review stage and, by doing so, breached Part 1 of FOISA.

Is the remaining withheld information personal data?

77. The first question that the Commissioner must address is whether the remaining information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual.  "Identifiable living individual" is defined in section 3(3) of the DPA 2018   see Appendix 1.  (This 
definition reflects the definition of personal data in Article 4(1) of the UK GDPR, also set out in in Appendix 1.)

78. Information which could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

79. In its submissions to the Commissioner, the Authority explained that the information in question comprised:

•    the names and direct contact details of Authority staff below SCS level and the 
equivalent from within third party organisations where the information was not publicly 
known;

  • the signatures of both senior staff and their more junior counterparts; and
  • one specific reference in the ARA.

80. As individuals could be directly identified from that information, the Authority considered this to be personal data, as defined by section 3(2) of the DPA 2018.

81. Having considered the remaining withheld information, it is clear to the Commissioner that it “relates to” identifiable living individuals.  It comprises the names and addresses of certain external witnesses to the Guarantee and the ARA, the signatures of all witnesses and parties to the Guarantee and the ARA, the name of an Authority staff member and one specific definition in the ARA.

82. The Commissioner therefore concludes that this particular information is personal data for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

83. The Authority stated that disclosure of this personal data would contravene the first data protection principle (Article 5(1)(a) of the UK GDPR).  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.

84. In terms of section 3(4)(d) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to a request.

85. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.

86. In its submissions, the Authority concluded that the only condition that would allow it to process the data, in order to answer the Applicant’s request, was condition 6(1)(f) (set out in full in Appendix 1).

87. The Commissioner agrees that this is the only condition which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

88. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).

89. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.

90. The tests which must be met before Article 6(1)(f) can be met are as follows:

(i) Does the Applicant have a legitimate interest in obtaining the personal data?

(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

91. In their submissions to the Commissioner, the Applicant stated they were seeking disclosure of personal data (here, names) of senior executives of private firms, and senior members of Authority staff (excluding signatures and email addresses).  They argued that this information would add context to the agreement.

92. In its submissions to the Commissioner, the Authority stated that it was not aware of any legitimate interest the Applicant would have in the personal data.  In addition, it did not believe that identifying the individuals would aid in the understanding of the withheld information.  It therefore did not consider that the Applicant had a legitimate interest in accessing the personal data being withheld.

93. Having considered the submissions from both parties, the Commissioner accepts that the Applicant has a personal legitimate interest in knowing the identities of the individuals to whom reference is made in the withheld information, with a view to understanding that information, and those involved, more completely.  The Commissioner also accepts that this legitimate interest would extend to the other members of the public in the West Highland area (and potentially to the rest of Scotland) with an interest in the Lochaber smelter agreement, given its importance to that community.  Consequently the Commissioner accepts that the Applicant has a legitimate interest in disclosure of this personal data.

Is disclosure of the personal data necessary?

94. Having accepted that the Applicant has a legitimate interest in the remaining withheld personal data, the Commissioner must consider whether disclosure of those personal data is necessary for the Applicant's legitimate interests.  In doing so, he must consider whether these interests might reasonably be met by any alternative means.

95. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 .

96. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to 
the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.

97. In its submissions to the Commissioner, the Authority acknowledged that, if the Applicant did have a legitimate interest in the withheld personal data, disclosure of the data would be necessary to achieve their legitimate interests.

98. Having considered the Applicant’s legitimate interests, the Commissioner accepts that disclosure of the information is necessary to in order to fulfil them.  The Commissioner is satisfied that disclosure of the remaining withheld personal data would provide the Applicant with information which would aid their understanding of the information disclosed, and the level of involvement of those individuals to whom the data related.

99. The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects than providing the remaining withheld personal data in full.  In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the information is 
necessary for the purposes of the Applicant's legitimate interests.

100. The Commissioner will now consider whether the Applicant’s legitimate interest in 
obtaining the remaining withheld personal data outweighs the rights and freedoms of the 
data subjects.

The data subjects' interests or fundamental rights and freedoms

101. The Commissioner must balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms.  In doing so, it is necessary for him to consider the impact of disclosure.  For example, if the data subjects would not reasonably expect that the information would be disclosed to the 
public under FOISA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure.  Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first 
data protection principle.

102. The Commissioner's guidance on section 38 of FOISA  notes factors that should be taken into account in balancing the interests of parties.  He notes that much will depend on the reasonable expectations of the data subjects.  These are some of the factors public authorities should consider:

  • Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life 
    or finances)?
     Would the disclosure cause harm or distress?
  • Whether the individual has objected to the disclosure.
Does the information relate to public or private life?

103. In its submissions to the Commissioner, the Authority explained that it had a general approach of disclosing information about senior members of staff, where it released details of those within SCS roles, but withheld those details for more junior members of staff.  It stated that it applied that principle equally to employees of 
third party organisations where the individual did not have a public profile.104. The Authority submitted that the roles of the individuals involved, and the specific nature and responsibilities of their posts, did not justify disclosure in this case.  In the Authority’s view, it would be unfair to disclose the details of those holding roles below SCS level.  It argued that the more junior staff concerned had a greater right to expect privacy and would not expect their personal data to be processed in this way.  The Authority stated it did not consider such processing necessary for the purpose of meeting the request.

105. The Commissioner acknowledges that the remaining withheld information relates to the individuals' public lives, in that it identifies them as individuals connected in some way to the Guarantee, or to the parties to the Guarantee.  However, he also acknowledges that, by association, the information also relates to their private lives.

106. In the circumstances, the Commissioner concludes that the remaining withheld information relates to both the private and public lives of the data subjects.

Would disclosure cause harm or distress to the data subjects and have the individuals objected to the disclosure?

107. In its submissions, the Authority argued that disclosure would not inform public debate, facilitate scrutiny of its actions, or add to the Applicant’s understanding of the matter to which the request related.  As the individuals in question held roles below SCS level, the Authority considered these more junior staff had a greater right to expect privacy.  It therefore believed the Applicant’s legitimate interest was overridden by the privacy rights of the data subjects in this case.

108. With regard to one specific entry in the ARA, the Authority argued that the individual, to whom this information related, would have an expectation of privacy with regard to their own personal circumstances, and the impact of disclosure of this information would be contrary to any legitimate interests of a third party.

109. The Commissioner has considered the harm or distress that might be caused by disclosure of the remaining withheld personal data.  He notes that disclosure of any information under FOISA – although in response to an information request made by a specific applicant – effectively places that information into the public domain.  As such, he must consider the effects of publicly disclosing any personal data under FOISA.

110. In respect of the specific definition in the ARA which the Authority withheld under section 38(1)(b), the Commissioner has considered the Authority’s arguments that the fundamental rights and freedoms of the data subject, to whom the data related, overrode any legitimate interest the Applicant may have.  He has also taken account of all relevant submissions, together with the personal data itself.

111. The Commissioner is not persuaded that the harm or distress claimed by the Authority applies to this particular information.  Having taking into account the personal circumstances of the individual to whom that information relates, together with how the information relates to the Guarantee, the Commissioner cannot accept that disclosure of that information, in response to the Applicant’s request, would equate to an unwarranted intrusion into that individual’s private life.

112. Accordingly, the Commissioner does not accept that the Authority has sufficiently evidenced that disclosure of that particular withheld personal data would cause the harm or distress to the data subject claimed by the Authority, or that the data subject had objected to disclosure.

113. For the remainder of the personal data withheld, the Commissioner recognises that it records the involvement of those individuals in relation to the Guarantee.

114. For the withheld personal data which relates to a member of the Authority’s staff, the Commissioner acknowledges that this individual’s role could be considered to be more junior.  He therefore accepts that this individual would have no expectation that their name would be disclosed into the public domain, in response to a request under FOISA, and recognises their right to privacy in this regard.

115. For the remaining withheld information, which records the names and addresses of certain external witnesses to the Guarantee and the ARA, and the signatures of all witnesses and parties to the Guarantee and the ARA, the Commissioner accepts that these individuals would, likewise, have no expectation that their personal data would be publicly disclosed in response to a request under FOISA, and he again recognises their 
right to privacy in this regard.

Balance of legitimate interests

116. After carefully balancing the legitimate interests of the data subjects against those of the Applicant, the Commissioner finds that, for the specific reference in the ARA withheld under section 38(1)(b), the balance of legitimate interests falls in favour of the Applicant.

117. For that information, the Commissioner cannot identify any reason why its disclosure, in the context of the request under consideration here, could prejudice the rights and freedoms or legitimate interests of the data subject to whom it relates.

118. The Commissioner does not accept that there would be a degree of distress caused to the data subject by the disclosure of this information, sufficient to override the legitimate interests of the Applicant.  In all the circumstances, he concludes that condition (f) could be met in this case and that disclosure of the information would therefore be lawful.

119. Accordingly, the Commissioner does not accept that the Authority was entitled to rely on section 38(1)(b) to withhold this particular personal data (i.e. the specific reference in the ARA).

120. For the remainder of the withheld personal data, the Commissioner has balanced the competing interests set out above.  Having done so in this case, in relation to this particular information, the Commissioner finds that the legitimate interest in transparency is outweighed by the prejudice to the rights and freedoms of the data 
subjects that would result from disclosure.  He therefore finds that the balance of legitimate interests falls in favour of the data subjects for the remaining withheld personal data and that the requirements of condition (f) cannot be met here.

121. In the absence of a condition which would permit disclosure of the remaining withheld personal data, the Commissioner must conclude that disclosure would be unlawful.

122. The Commissioner notes that the Applicant confirmed, in their submissions, that they did not wish to receive signatures.  He also notes that the majority of the names of the witnesses and parties to the GRA have already been disclosed to the Applicant by the Authority in its previous disclosures in this case.  In the Commissioner’s view, this goes some way to satisfying the Applicant’s request, insofar as it seeks the 
disclosure of personal data.

Fairness

123. Given that the Commissioner has determined that the processing of certain of the personal data (i.e. the specific reference in the ARA) would be lawful, and bearing in mind his reasons for reaching that conclusion, he can identify no reason for finding that its disclosure would be other than fair.

124. For the remainder, given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of that personal data would otherwise be fair.

Conclusion on the data protection principles

125. For the personal data found to have been correctly withheld, the Commissioner finds that disclosure of this information would breach the first data protection principle and that this particular information is therefore exempt from disclosure (and was properly withheld) under section 38(1)(b) of FOISA.

126. For the remaining withheld personal data (i.e. the specific reference in the ARA), the Commissioner is satisfied that this particular information has been wrongly withheld under section 38(1)(b) given that it can be disclosed without breaching the data protection principles in Article 5(1) of the UK GDPR.  The Commissioner requires the Authority to disclose this information to the Applicant.  This will be indicated on a marked-up copy of the withheld information to be provided to the Authority along with this Decision Notice.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that, by the end of his investigation, the Authority partially complied with Part 1 by correctly withholding some information (variously) under the exemptions in section 30(c) and section 38(1)(b) of FOISA.

However, the Commissioner also finds that the Authority failed to comply with Part 1 (and, in particular, section 1(1)) by incorrectly withholding some information (variously) under the exemptions in section 30(c) and section 38(1)(b) of FOISA.

The Commissioner therefore requires the Authority to provide the Applicant with the information which the Commissioner has found to have been incorrectly withheld under the exemptions in section 30(c) and section 38(1)(b) of FOISA by 19 January 2024.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

David Hamilton
Scottish Information Commissioner

5 December 2023 

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption –

…

(e) in subsection (1) of section 38 –

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied.

…

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

…

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

33 Commercial interests and the economy

(1) Information is exempt information if-

…

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in –

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

…

“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public 
authorities) were omitted.

…

47 Application for decision by Commissioner

(1) A person who is dissatisfied with -

(a) a notice under section 21(5) or (9); or

(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.

may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.

(2) An application under subsection (1) must -

(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);

(b) state the name of the applicant and an address for correspondence; and

(c) specify –

    (i) the request for information to which the requirement for review relates;

    (ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c); and

    (iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).

…

UK General Data Protection Regulation

Article 4 Definitions

For the purpose of this Regulation:

1 ‘personal data’ means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more 
factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person:

    …

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

    a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)

    …

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

    …

    f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

…

Data Protection Act 2018

3    Terms relating to the processing of personal data

    …

    (2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

    (3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –

        (a) an identifier such as a name, an identification number, location data or an online identifier, or

        (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

    (4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –

        …

        (d) disclosure by transmission, dissemination or otherwise making available,

        …

(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) 
Act 2018 (and see section 205(4)).

…

(14)    In Parts 5 to 7, except where otherwise provided –

    (a) references to the UK GDPR are to the UK GDPR read with Part 2;

    …

(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;

(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.

…