Decision 161/2024: Records relating to pigeons trapped by netting
Authority: South Lanarkshire Council
Case Ref: 202400464
Summary
The Applicant asked the Authority for information regarding pigeons being trapped by netting in July and August 2020. The Authority informed the Applicant that it did not hold any relevant information. The Commissioner investigated and found that the Authority had failed to comply with the EIRs by informing the Applicant that it did not hold any relevant information. As, by the close of the investigation, all of the information falling within the scope of the request was identified and provided to the Applicant, other than a small amount of personal data correctly withheld by the Authority, the Commissioner did not require it to take any action.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner)
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”, “the data protection principles”, “data subject”, paragraphs (a) and (c) of the definition of “environmental information”, “personal data” and “the UK GDPR) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(1) and (4)(a); (Exceptions from duty to make environmental information available); 11(2), (3A)(a) and (7) (Personal data); 17(1), (2)(a) and (b) (Enforcement and appeal provisions)
General Data Protection Regulation (the GDPR) Articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and 14(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 2 August 2023, the Applicant made the following request for information to the Authority:
“Please send me the full [Authority] records regarding pigeons being trapped by netting in July 2020 and August 2020.”
2. The Authority failed to respond to the Applicant’s information request.
3. On 6 September 2023, the Applicant wrote to the Authority requesting a review in respect of its failure to respond.
4. The Authority notified the Applicant of the outcome of its review on 4 October 2023. The Authority responded in terms of the EIRs and stated that, in terms of regulation 10(4)(a), it held no relevant information. The Authority explained that it held information showing that one pigeon had been trapped over the relevant period, but not by netting.
5. On 31 March 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because:
- he considered that the Authority did hold information relevant to his request
- the Authority had failed to provide the information relating to the one pigeon it stated had been trapped.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 4 April 2024, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application.
8. The case was subsequently allocated to an investigating officer.
9. The Authority was invited to comment on this application and to answer specific questions. These related to how the Authority established that it held no recorded information which would fulfil the Applicant’s request, to the press article he referred to in his application to the Commissioner and to the personal data that it withheld from the information it identified and disclosed to the Applicant during the investigation.
Commissioner’s analysis and findings
10. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Application of the EIRs
11. The information requested appears to fall clearly within the scope of the definition of environmental information contained in regulation 2(1) of the EIRs.
12. The Applicant made no comment on the Authority’s application of the EIRs in this case, and the Commissioner will consider the request in what follows solely in terms of the EIRs.
Regulation 5(1) – Duty to make environmental information available
13. Regulation 5(1) of the EIRs requires a Scottish public authority which holds the information to make it available when requested to do so by any applicant. This obligation relates to information that is held by the authority when it receives a request.
14. On receipt of a request for environmental information, the authority must ascertain what information it holds falling within the scope of the request. Having done so, regulation 5(1) requires the authority to make the information available, unless a qualification in regulation 6 to 12 applies (regulation 5(2)(b)).
15. Under the EIRs, a Scottish public authority may refuse to make environmental information available if one or more of the exceptions in regulation 10 applies.
Regulation 10(4)(a) – Information not held
16. Regulation 10(4)(a) of the EIRs states that a Scottish public authority may refuse to make information available to the extent that it does not hold the information when it received the request.
17. The standard of proof to determine whether a Scottish public authority holds the information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority.
18. The Commissioner also considers, where appropriate, any reasons offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner’s role is to determine what relevant information is (or was, at the time the request was received) held by the public authority.
The Applicant’s submissions
19. In his application to the Commissioner, the Applicant referred to an article in the Glasgow Times from 25 July 2020 containing the following quotation from an employee of the Authority’s Roads and Transportation Services: “On July 21 we were alerted to pigeons being caught in pest control netting…”
20. The Applicant stated that he therefore believed that the Authority held information relevant to his request; specifically, that it held information relating to correspondence between its Roads and Transportation Services and the Glasgow Times and that it also held internal records relating to this.
21. The Applicant also noted that the Authority’s review outcome stated that “records have been searched with the outcome that one pigeon was trapped during that period”. The Applicant stated that the records relating to this “were not provided as requested”.
The Authority’s submissions
22. The Authority located relevant information during the investigation and disclosed it to the Applicant (subject to a small amount of information withheld as personal data). This was after the investigating officer had drawn the Authority’s attention to the press article referred to by the Applicant. The Authority stated that it had no knowledge of the Glasgow Times article until the investigating officer had referred to it.
23. The Authority explained that searches had originally been carried out by Environmental Services as that service had responsibility for dealing with matters relating to the subject matter of the request.
24. The Authority further explained that all pest control services go through Environmental Services who use a contractor to deliver the service. The Authority stated that a single system is used to record information of this nature and there is a code built into the system for various animals and pests. The Authority stated that it had searched by the code for “pigeon/pigeons” within the relevant time period which had identified eight records, with only one record involving pigeon trapping.
25. For the single record it identified involving pigeon trapping, the Authority stated that it had contacted the relevant contractor who had confirmed that no netting was involved. The Authority considered that this information therefore fell outwith the scope of the request, which specified pigeons “being trapped by netting”.
26. After being made aware of the Glasgow Times article, the Authority undertook further searches and identified an email chain that included the quotation in the article provided by an employee of the Authority’s Roads and Transportation Services. The Authority disclosed this email chain to the Applicant (subject to a small amount of information withheld as personal data).
27. The Authority explained that it had not previously contacted its Roads and Transportation Services or its Public Relations department in relation to the request because neither service had responsibility for trapping pigeons, trapped pigeons or pest control.
28. After the investigating officer asked further questions regarding the searches undertaken, the Authority identified and disclosed to the Applicant further emails (subject to a small amount of information withheld as personal data) related to the email chain it had already disclosed to him. The Authority explained that these emails had been located by an employee of the Authority’s Public Relations department after a search of his personal email inbox.
29. The Authority noted that the press enquiry had been made during the height of the pandemic when press officers had been working remotely with no remote access to the Authority’s internal recording system. The Authority confirmed that the Public Relations department held no further relevant information.
30. The Authority also noted that the employee of the Authority’s Roads and Transportation Services quoted in the Glasgow Times article had retired some time ago and that his email account had been permanently deleted, along with folders of his correspondence previously held by the Authority on a shared drive. The Authority confirmed that the Roads and Transportation Services held no further relevant information.
31. The Authority reiterated that Environmental Services would normally hold records of any complaint received relating to pigeons being trapped by netting. Had it been aware of the Glasgow Times article and the information potentially being held by Network Rail, the Authority explained that it would have referred to this in its review outcome and provided Network Rail’s contact details to the Applicant by way of advice and assistance.
32. The Authority confirmed that, as it had located relevant information and provided it to the Applicant, it was no longer relying on regulation 10(4)(a) of the EIRs.
The Commissioner's view
33. The Commissioner notes that the Applicant’s request specified “pigeons trapped by netting”. The Commissioner is therefore satisfied that the record the Authority had referred in its review outcome relating to a pigeon that had not been trapped by netting did not fall within the scope of the Applicant’s request.
34. Having considered the nature of the information requested, the explanations provided by the Authority and the terms of the request, the Commissioner accepts, on balance, that (by the close of the investigation) the Authority had identified, located and provided all of the information it held falling within the scope Applicant's
request.
35. While the Applicant believes that further information may be held, the Commissioner is satisfied that is not the case. Whether a public authority should hold information which it does not hold is not a matter for the Commissioner to decide.
36. The Commissioner also notes that the Authority suggested that it is possible that Network Rail (on whose behalf the contractor was working) might hold further information of interest to the Applicant.
37. As the Authority disclosed relevant information during the investigation, the Commissioner must find that the Authority was not entitled to rely on the exception in regulation 10(4)(a) of the EIRs.
38. The Commissioner can also only conclude that the information should have been disclosed to the Applicant at the time of asking. In failing to do so, the Authority failed to comply with regulation 5(1) of the EIRs.
39. As the Commissioner has found that the Authority was not entitled to rely on the exception in regulation 10(4)(a) of the EIRs, he is not required to go on to consider the application of the public interest test.
Regulation 11(2) – Personal data
40. The Authority relied on the exception in regulation 11(2) for withholding some information from what it disclosed to the Applicant following his application to the Commissioner. Here, the Commissioner will consider the information which remained withheld under this provision at the close of the investigation.
41. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
42. The Authority submitted that the redacted information constituted personal data, disclosure of which in response to this request would breach the first data protection principle in Article 5(1) of the UK GDPR ("lawfulness, fairness and transparency".)
Is the withheld information personal data?
43. The first question the Commissioner must address is whether the information is personal data in terms of section 3(2) of the DPA 2018.
44. "Personal data" is defined in section 3(2) of the DPA as "any information relating to an identified or identifiable individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
45. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus. An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
46. In its submissions, the Authority explained that the information it had redacted under regulation 11(2) of the EIRs contained the names and contact details of individual employees. As such, it met the criteria to be classed as personal data, as defined in the DPA 2018.
47. Having considered the Authority's submissions and the withheld information, the Commissioner accepts that living individuals can be identified from the data and that, in the circumstances, the data relate to them. The Commissioner is therefore satisfied that the redacted information is personal data as defined in section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
48. Article 5(1)(a) of the UK GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."
49. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". For the purposes of the EIRs, personal data are processed when made available in response to a request. This means that the personal data can only be made available if doing so would be both lawful (i.e. it would meet one of the conditions for lawful processing in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Article 6(1)(f) of the UK GDPR
50. Among other questions, therefore, the Commissioner must consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
51. The Commissioner has looked at condition 6(1)(f) as the only one which might potentially apply in the circumstances.
Condition (f): legitimate interests
52. Condition (f) states that the processing will be lawful if it is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
53. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
54. The tests which must be met before Article 6(1)(f) can apply are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would making the personal data available be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the Applicant have a legitimate interest in obtaining the personal data?
55. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
56. In his submissions to the Commissioner, the Applicant submitted that trapping and leaving pigeons to suffer and die is a criminal offence under the Wildlife and Countryside Act 1981. The Applicant explained that he therefore had a legitimate interest in receiving the personal data so that it can be passed to the appropriate authorities to investigate and possibly prosecute.
57. The Applicant explained that there had been numerous media reports of pigeons being trapped under railway bridges by netting installed by Network Rail, but the reporting had failed to stop this. The Applicant stated that he therefore had a legitimate interest in receiving the personal data to put an end to what he described as “appalling and needless animal cruelty”.
58. The Authority submitted that the Applicant’s legitimate interest had been met through the information already disclosed to him in response to his request. The Authority explained that it did not believe that the Applicant had a legitimate interest in the names or contact details of employees of the Authority who had dealt with a press enquiry in July 2020.
59. As rehearsed earlier, the Commissioner is satisfied that the Authority has now provided all of the relevant information it holds to the Applicant (subject to a small amount of information withheld as personal data). This information relates to how the Authority responded to a media enquiry relating to pigeons being trapped, with the withheld personal data relating to those employees involved in responding to the media enquiry and to other third parties.
60. The Commissioner can see that there would be a legitimate interest in understanding how the Authority responded to being made aware of pigeons being trapped in netting. However, he does not consider there is a legitimate interest in the disclosure of the withheld information in this case.
61. Disclosure of the personal data in question would not add anything to the Applicant’s understanding of the information already provided by the Authority, nor would it assist him in referring his concerns to the appropriate authorities.
62. The Commissioner also notes that the Authority advised the Applicant that further information of interest to him may be held by Network Rail. The Applicant, when providing submissions on his legitimate interest in the withheld personal data, specifically stated he is concerned with netting installed under railway bridges by Network Rail.
63. In the circumstances, therefore, the Commissioner concludes that the Applicant does not have a legitimate interest in receiving the personal data withheld in this case. He therefore finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied. Accordingly, he accepts that making the personal data available would be unlawful.
64. Given that the Commissioner has found that the processing (i.e. making the information available, in response to the Applicant's request) would be unlawful, he is not required to go on to consider separately whether disclosure of the personal data would be necessary to fulfil any legitimate interest, or consider the data subject's interests or fundamental rights and freedoms, and balance them against any legitimate interest in disclosure.
65. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the GDPR being met, the Commissioner must conclude that making the withheld personal data available would be unlawful and would breach the data protection principle in Article 5(1)(a) of the GDPR. Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs.
Decision
The Commissioner finds that the Authority failed to comply with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.
The Commissioner finds that the Authority was not entitled to rely on the exception in regulation 10(4)(a) of the EIRs and inform the Applicant that it held no recorded information which would fulfil his request.
However, the Commissioner finds that the Authority was entitled to withhold, under regulation 11(2) of the EIRs, a small amount of personal data from the information it made available to the Applicant following his application.
Given that the Authority has now disclosed the recorded information held by it which fulfils the Applicant’s request (except that correctly withheld as personal data under regulation 11(2) of the EIRs), the Commissioner does not require the Authority to take any action in response to this failure, in response to the application under
consideration here.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Cal Richardson
Deputy Head of Enforcement
9 August 2024
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(2) The person who makes such a request is in this Part and in Parts 2 and 7 referred to as the “applicant.”
…
(6) This section is subject to sections 2, 9, 12 and 14.
…
47 Application for decision by Commissioner
(1) A person who is dissatisfied with -
(a) a notice under section 21(5) or (9); or
(b) the failure of a Scottish public authority to which a requirement for review was made to give such a notice.
may make application to the Commissioner for a decision whether, in any respect specified in that application, the request for information to which the requirement relates has been dealt with in accordance with Part 1 of this Act.
(2) An application under subsection (1) must -
(a) be in writing or in another form which, by reason of its having some permanency, is capable of being used for subsequent reference (as, for example, a recording made on audio or video tape);
(b) state the name of the applicant and an address for correspondence; and
(c) specify –
(i) the request for information to which the requirement for review relates;
(ii) the matter which was specified under sub-paragraph (ii) of section 20(3)(c);
and
(iii) the matter which gives rise to the dissatisfaction mentioned in subsection (1).
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations –
“the Act” means the Freedom of Information (Scotland) Act 2002;
“applicant” means any person who requests that environmental information be made available;
“the Commissioner” means the Scottish Information Commissioner constituted by section 42 of the Act;
“the data protection principles” means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section of that Act):
…
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form
on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas,
biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
…
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
…
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);
…
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(1) and (14) of that Act); and
…
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
…
(b) is subject to regulations 6 to 12.
…
10 Exceptions from duty to make environmental information available
(1) A Scottish public authority may refuse a request to make environmental information available if-
(a) there is an exception to disclosure under paragraphs (4) or (5); and
(b) in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception.
(2) In considering the application of the exceptions referred to in paragraphs (4) and (5), a Scottish public authority shall-
(a) interpret those paragraphs in a restrictive way; and
(b) apply a presumption in favour of disclosure.
…
(4) A Scottish public authority may refuse to make environmental information available to the extent that
(a) it does not hold that information when an applicant's request is received;
…
11 Personal data
…
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -
(a) the first condition set out in paragraph (3A) is satisfied, or
…
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations –
(a) would contravene any of the data protection principles, or
…
(7) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public
authorities) were omitted.
17 Enforcement and appeal provisions
(1) The provisions of Part 4 of the Act (Enforcement) including schedule 3 (powers of entry and inspection), shall apply for the purposes of these Regulations as they apply for the purposes of the Act but with the modifications specified in paragraph (2).
(2) In the application of any provision of the Act by paragraph (1) any reference to -
(a) the Act is deemed to be a reference to these Regulations;
(b) the requirements of Part 1 of the Act is deemed to be a reference to the requirements of these Regulations;
…
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) “Data subject” means the identified or identifiable living individual to whom the data relates
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided –
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
