Decision 204/2024: Correspondence relating to a cut sewage pipe and proposed remedial work

Authority:  Scottish Borders Council
Case Ref:  202400359

Summary

The Applicant asked the Authority for correspondence with the owners, agents and contractors of a specified property regarding a pipe that had been inadvertently cut and the proposed remedial work.  The Authority withheld the information on the basis that disclosure would prejudice the interests of the person providing the information, or that it was personal data.  During the investigation, the Authority changed its position and disclosed the information requested with the exception of some third-party personal data.  The Commissioner investigated and found that, while the Authority was entitled to withhold a small amount of third-party personal data, it had wrongly withheld the remainder of the information requested under the exceptions originally claimed.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner)

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant”, “the Commissioner”, “the data protection principles”, “data subject”, “personal data”, “the UK GDPR” and paragraphs (a), (b). (c) and (f) of “environmental information”) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(1), (2), (3), (5)(f) and (6) (Exceptions from duty to make environmental information available);11(1), (2)(a), (3A)(a) and (7) (Personal data); 17(1), (2)(a) and (b) (Enforcement and appeal provisions)

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and 14(a), (c) and (d) (Terms relating to the processing of personal data)

Background

1. On 10 August 2023, the Applicant made a request for information to the Authority.  Referring to an Enforcement Notice which, she understood, had been issued in relation to a pipe on a specified property which had been inadvertently cut, thereby meaning that the property’s sewage system was non-compliant, she asked the Authority for all emails and dialogue between [the specified property]/Agents/Contractors on the pipe being inadvertently cut and the proposed remedial work.

2. The Authority responded on 22 December 2023, apologising for the delay in responding.  It informed the Applicant that it had considered the request under the EIRs and had applied section 39(2) of FOISA.  The Authority confirmed that the information requested was contained within the Enforcement file 23/00052/SEC27 and withheld that information (variously) under:

• regulation 10(5)(f) of the EIRs on the basis that disclosure would prejudice the interests of the person(s) providing the information.  The Authority considered that the public interest lay in members of the public being able to take advice from its officers (particularly on regulatory matters) without fear that the communications would be released into the public domain, and that by doing so, works/activity undertaken would be compliant and safe.
•  regulation 11(2) of the EIRs as the information identified (or could potentially identify) an individual(s), and its disclosure would breach data protection legislation, specifically the first data protection principle.

3. On 5 January 2024, the Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that she was dissatisfied with the Authority’s decision because she did not agree with the reasons given by the Authority for withholding the information under regulation 10(5)(f).  She also believed that the public interest lay in full disclosure of the information to understand what had gone wrong and why the situation had been allowed to go unchecked and unmonitored for so long, given that it affected the health, welfare and livelihoods of people.  For the personal data being withheld, while the Applicant stated that some of this was known to her, she argued that this could be easily redacted.

4. The Authority notified the Applicant of the outcome of its review on 9 February 2024, fully upholding its original decision with modification.  For the information withheld under regulation 10(5)(f), the Authority believed there was no public interest in disclosing information which may lead to people being reluctant to contact its officers for advice on regulatory matters to ensure any work carried out was compliant, as this could have implications on the safety and compliance of any works or activities undertaken.  For the personal data being withheld, the Authority informed the Applicant that it was now also relying on regulation 11(1) to withhold personal data (in addition to regulation 11(2)) and reiterated its previous arguments for withholding the personal data.

5. On 29 February 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that she was dissatisfied with the outcome of the Authority’s review because:

• she believed that the Authority had failed to justify the use of regulation 10(5)(f) and that there was an overwhelming public interest in disclosure of the information withheld under that exception, and
• she was not looking for any personal data – neither that of any third parties, her own, nor those involved with the Enforcement Notice/Case surrounding her request - all of which, she believed, could be redacted.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.

7. On 11 April 2024, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These focused on the searches carried out by the Authority for the information requested, and on its justification for withholding the information (variously) under regulations 11(1), 11(2) and 10(5)(f) of the EIRs.  The Authority was also asked whether it considered the information requested related to emissions which, in terms of regulation 10(6) of the EIRs, could not be withheld under regulation 10(5)(f).

9. During the investigation, the Authority changed its position and confirmed that it no longer wished to rely on regulation 10(5)(f) to withhold any information.  It also confirmed that it had mistakenly relied on regulation 11(1) as none of the information being withheld comprised the Applicant’s own personal data.  For the information withheld under regulation 11(2), the Authority confirmed that it was no longer withholding some of the information previously withheld, but that it was continuing to withhold 
some other third-party personal data under that exception.

10. On 10 June 2024, the Authority disclosed the majority of the information requested to the Applicant.  It withheld a small amount of third-party personal data under regulation 11(2) and some other information which, it considered, did not fall within the scope of the request.

Commissioner’s analysis and findings

11. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Handling in terms of EIRs

12. The Authority considered the Applicant’s request under the EIRs, having concluded that the information requested was environmental information as defined in regulation 2(1) of the EIRs.

13. Where information falls within the scope of this definition, a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.

14. The Authority submitted that most of the information / requests handled by Planning, Enforcement etc. were environmental, where the purpose was to deal with the built environment.  The Commissioner accepts the request falls within this description and, in the circumstances, is satisfied that the information requested by the Applicant falls within the definition of environmental information set out in regulation 2(1), in particular paragraphs (a), (b), (c) and (f) of that definition.

Section 39(2) of FOISA – Environmental information

15. The Authority confirmed that it wished to continue to rely upon section 39(2) of FOISA.  The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs.  In this case, the Commissioner accepts that the Authority was entitled to apply this exemption to the information withheld under FOISA, given his conclusion that it is properly classified as environmental information.

16. As there is a statutory right of access to environmental information available to the Applicant in this case, the Commissioner accepts, in all the circumstances, that the public interest in maintaining this exemption (and responding to the request under the EIRs) outweighs any public interest in disclosing the information under FOISA.  Both regimes are intended to promote public access to information and there would appear to be no reason why (in this particular case) disclosure of the information should be 
more likely under FOISA than under the EIRs.

17. The Commissioner therefore concludes that the Authority was correct to apply section 39(2) of FOISA and consider the Applicant’s information request under the EIRs.

Regulation 5(1) of the EIRs – Duty to make environmental information available

18. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.  This obligation relates to information that is held by the authority when it receives a request.

19. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within the scope of the request.  Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).

The information held by the Authority

20. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities.  In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority.  He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information.  While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority, which falls within the scope of the request under consideration.

The Applicant’s submissions on the information held

21. Following receipt of the information disclosed to her by the Authority on 10 June 2024, the Applicant informed the Commissioner that, in her view, the Authority had failed to justify what it meant by some information falling outwith the scope of her request.  She believed that, if it was in the file, it should be released.

22. The Applicant further argued, with explanation, that documents surrounding inspectors reports, additional photographs and information going back as far as November 2022 were missing from the information disclosed to her.  In addition to these, she believed that the Authority had withheld many other documents.

The Authority’s submissions on the information held

23. The Authority confirmed that the Enforcement Case was opened on 11 July 2023.  It explained that the “inadvertently cut pipe” had been brought to its attention in an email dated 28 June 2023 from the property owner’s solicitor confirming that the pipe had been cut, and that this was the trigger for the Enforcement Case being raised.  The Authority explained that the Enforcement Case had been opened to deal with works that had been carried out without a warrant, i.e. a change in method of wastewater discharge, and the timespan was from registration on 28 June 2023 to 31 August 2023 (works inspected of reinstated drain on 3 August 2023).

24. The Authority further explained that the pipe in question (i.e. the one which had been inadvertently cut) was the discharge from the property’s private treatment plant, containing treated effluent, serving the property to the burn, as licensed by the Scottish Environment Protection Agency.  The Authority confirmed that it was not aware of when the pipe had been cut and had only been made aware of this in the email from the property owner’s solicitor.  The Authority confirmed that the “inadvertently cut pipe” was the issue that led to the Enforcement Case being opened.

25. The Authority submitted that its staff knew where information was located that related to the Enforcement Case.  It explained, with supporting evidence, that searches of the Authority’s Uniform system (which holds basic information) and IDOX system (the service’s filing system) had been undertaken.  While the Authority accepted that it held a significant amount of data relating to the property in question, and that discussions had been ongoing for a significant number of years, it submitted that it had considered all information relating to the Applicant’s request and confirmed that it had nothing further to consider or to disclose to the Commissioner.

26. The Authority accepted that some information (in document 4), originally considered to fall outwith scope, did in fact fall within scope and would be disclosed to the Applicant.  This information was included in the Authority’s partial disclosure of information to the Applicant on 10 June 2024.

27. For some other information identified by the Authority which, it considered, did not fall within scope, the Authority explained that some of this information (document 3 and part of document 4) related to a matter which had occurred prior to the Enforcement Case being raised.  This was background information and played no part in the Enforcement Case or had any bearing on the actions taken by the Authority.  In addition, some other information (documents 9 and 10) related to an individual navigating the Authority’s website.  While these documents were available within the IDOX file, the Authority submitted that they did not fall within the scope of the Applicant’s request.  The Authority explained that, in the interests of completeness, it had provided the Commissioner with this information in evidence of what information was retained within the file.

The Commissioner’s views on the information held

28. The Commissioner has carefully considered the submissions from both parties, together with the information identified and the supporting evidence and explanation of searches.  Having done so, the Commissioner is satisfied that the searches carried out by the Authority would have been capable of identifying any relevant information.  While the Commissioner notes that the Applicant believes the Authority must hold more information, the Commissioner is satisfied, on the balance of probabilities, that no 
further in-scope information relating to the Applicant’s request is held by the Authority.

29. Turning to the out of scope information, the Commissioner notes that the Authority has explained why some of the information identified does not relate to the Enforcement Case.  He notes that it either relates to a separate prior issue and is background information prior to the Enforcement Case being opened, or to an enquiry by a member of the public, and played no part or had any bearing on the Authority’s actions in the Enforcement Case.  Having considered the information in question, the Commissioner is satisfied that it does not fall within the scope of the Applicant’s request.

Regulation 10(5)(f) – Interests of the person who provided the information

30. Under the EIRs, a public authority may refuse to make environmental information available if one or more of the exceptions in regulation 10 applies, but only if (in all the circumstances) the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.

31. At both initial response and review stages, the Authority withheld some information under regulation 10(5)(f) of the EIRs.  Regulation 10(5)(f) provides that a Scottish public authority may refuse to make environmental information available to the extent that its disclosure would, or would be likely to, prejudice substantially the interests of the person who provided that information, where that person –

(i) was not under, and could not have been put under, any legal obligation to supply the information;

(ii) did not supply it in circumstances such that it could, apart from the EIRs, be made available, and

(iii) has not consented to its disclosure.

32. As stated above, during the investigation, the Authority withdrew its reliance on regulation 10(5)(f) of the EIRs to withhold any information originally withheld under that exception.  It informed the Commissioner that it accepted that the information requested contributed to emissions, and therefore the majority of the content could not be withheld from the public domain.  The Authority further explained that, while the reasons outlined for withholding the information at review stage remained relevant, 
it had not considered the information from an ”emissions” perspective and accepted, for that reason, that the information was in the public interest and should have been disclosed.

33. Having considered the Authority’s submissions regarding its decision to withdraw reliance on regulation 10(5)(f), the Commissioner has no option but to find that disclosure of the information would not have had the substantially prejudicial impact required for regulation 10(5)(f) of the EIRs to be engaged.  Consequently, in this case, the Commissioner is not satisfied that the information requested was properly withheld under this exception when the Authority issued its review outcome.  Having reached this conclusion, he is not required to consider the public interest test in regulation 10(1)(b) of the EIRs.

34. The Commissioner concludes, therefore, that the Authority had not been entitled to rely upon regulation 10(5)(f) to withhold the information in question and, by so doing, breached regulation 5(1) of the EIRs.

35. As the Authority has disclosed to the Applicant all of the information found to have been wrongly withheld under regulation 10(5)(f), the Commissioner does not require the Authority to take any further action in this regard.

36. The Commissioner cannot stress enough the importance of giving full and proper consideration to the tests which require to be met for an exception under the EIRs (or an exemption under FOISA) to apply, when considering requests under both FOISA and the EIRs.  He would urge the Authority, and indeed all Scottish public authorities, to ensure that, when responding to information requests, thorough consideration is given to whether any applicable test of substantial prejudice can actually be met in the 
circumstances.  In this case, it appears likely that such consideration would not only have resulted in earlier disclosure of the information to the Applicant, but also a saving in staff time and effort.

Regulation 11(1) of the EIRs – Personal data of the Applicant

37. The exception in Regulation 11(1) of the EIRs provides that, to the extent that environmental information requested includes personal data of which the Applicant is the data subject, then the duty to make it available under regulation 5(1) shall not apply to those personal data.

38. This exception exists in the EIRs as individuals have a separate right to make a request for their own personal data under the UK GDPR/DPA 2018.  This route is more appropriate for individuals accessing their personal data, as it ensures the data are disclosed only to that individual and not into the public domain.

39. Regulation 11(1) does not deny individuals a right to access information about themselves, but ensures that the right is exercised under the correct legislation (the UK GDPR/DPA 2018) and not under the EIRs.

40. In its review outcome, the Authority stated that it was withholding some personal data under regulation 11(1).

41. As stated above, early in the investigation, when providing the withheld information to the Commissioner, the Authority conceded that it had mistakenly used the exception in regulation 11(1) in its review outcome.  It confirmed, with an apology, that the information withheld from the Applicant did not contain any of her personal data, and that this had been an oversight on its part in not fully checking the review response provided.

42. Having considered the Authority’s submissions on the application of regulation 11(1) at review stage, the Commissioner has no option but to find that the Authority was not entitled to rely on this exception to withhold any information when it issued its review outcome.

Regulation 11(2) of the EIRs – third-party personal data

43. In terms of regulation 10(3) of the EIRs, a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.  Regulation 11(2), read in conjunction with regulation 11(3A)(a), provides that personal data of which the applicant is not the data subject (applying the relevant definitions in section 3 of the DPA 2018) shall not be made available where its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.  There is no public interest to be considered where regulation 11(2) applies.

44. In order for a Scottish public authority to rely on this exception, it must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under the EIRs) would contravene at least one of the data protection principles in Article 5(1) of the UK GDPR.

Information disclosed during the investigation

45. As stated above, on 10 June 2024, the Authority partially disclosed to the Applicant the majority of the information originally withheld.  This included some information which the Authority had previously withheld under regulation 11(2).

46. In its submissions to the Commissioner, the Authority explained that, at the material times when it had considered the Applicant’s request and request for review, it was of the view that the content of the information was exempt from disclosure under regulation 10(5)(f).  As such, it believed it would have been meaningless to release any personal data, e.g. names of staff, dates etc. into the public domain.  However, on reflection, it confirmed that it was happy to disclose the file (including some 
information previously withheld under regulation 11(2)), subject to the continued redaction of the remaining personal data.

47. The Commissioner has considered the Authority’s submissions on the application of regulation 11(2) at review stage.  In the absence of any submissions explaining why the personal data, now disclosed, had been properly withheld under that exception at that time, the Commissioner has no option but to find that the Authority was not entitled to rely on regulation 11(2) to withhold, at review stage, the personal data which it has since disclosed to the Applicant.

48. The Commissioner will now go on to consider whether the Authority was correct to withhold the remaining personal data under regulation 11(2).

Is the remaining withheld information personal data?

49. The first question the Commissioner must address is whether the remaining withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual.  "Identifiable living individual" is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)

50. Information that could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

51. The Authority submitted that the information related to identifiable living individuals and included, for example, the names of third parties such as neighbours, and the names and contact details of staff, both internal and external.

52. The Commissioner has considered the submissions received on this point, together with the remaining withheld information.  It clearly “relates to” identifiable living individuals.  Living individuals can be identified from the data, to whom the data can be said to relate.  It is therefore those individuals' personal data, as defined by section 1(1) of the DPA.

53. The Commissioner is therefore satisfied that the remaining withheld information is personal data for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

54. The Authority stated that disclosure of the remaining personal data would contravene the first data protection principle (Article 5(1)(a)).  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.

55. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of the EIRs, personal data are processed when disclosed in response to a request.  Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.

56. The Commissioner must now consider if disclosure of the remaining personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

57. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).

58. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA or the EIRs.

59. The tests which must be met before Article 6(1)(f) can be met are as follows:

(i) Does the Applicant have a legitimate interest in obtaining the personal data?

(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

60. In her application to the Commissioner, the Applicant stated that she was not seeking any third-party personal data which, she believed, could be redacted.  She clarified that she was dissatisfied with the Authority’s “blanket refusal” of her request without justifying use of the exceptions claimed, and not offering a redaction of the information considered to be personal data.

61. In her submissions to the Commissioner, the Applicant reiterated that she was not interested in knowing anyone’s names, which could be redacted, but argued that redaction had to be carried out so that it was possible to understand the content of any document, and to be able to understand how the works covered under the Enforcement Case/Notice were compliant with building regulations and authorisations, and the building warrant and SEPA authorisation that were issued in 2015 or altered since.  She 
argued that this directly affected her and the public because of the flooding situation and the direct harm to health in negotiating a sewage flooded road.

62. The Applicant submitted that this issue not only affected her and her family, but also the public as a whole, who should be allowed to traverse the public road (which had no pavements and no sewers) without having to negotiate flooding of the road with sewage and surface water from the property in question, which, she believed, was putting everyone at risk.  As well as a serious public health risk, the Applicant argued that there was also a considerable environmental issue where the discharges from the property in question contaminate water and harm wildlife.  She believed the information should be made public so that people could be aware and analyse for themselves what was happening, in order to protect themselves.

63. During the investigation, the Applicant made further submissions in similar terms.  She argued that being able to see what work had been carried out or altered on the sewage system of the property in question under the Enforcement Notice/Case, would provide insight on whether or not the sewage disposal system had been made compliant.  This would allow people to judge whether they could exercise their right to access the road and their homes without having to negotiate sewage flooding.  In her view, if this 
involved the release of third-party personal information to establish and ensure the safety of the public, then that must take precedence.

64. The Authority acknowledged the legitimate interest of the Applicant in obtaining the information and stated that it would release as much information as possible into the public domain [as per its disclosure to the Applicant on 10 June 2024].

65. Having considered all relevant submissions, the Commissioner is satisfied that the Applicant does have a legitimate interest in the withheld information, at the level requested, for the reasons she has explained.

Is disclosure of the personal data necessary?

66. Having accepted that the Applicant has a legitimate interest in the remaining withheld personal data, the Commissioner must consider whether disclosure of those personal data is necessary for the Applicant's legitimate interests.  In doing so, he must consider whether these interests might reasonably be met by any alternative means.

67. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.  In this case, the Supreme Court stated (at paragraph 27):

A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim.  Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.

68. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.

69. In its submissions to the Commissioner, the Authority stated that it did not believe disclosure of the remaining personal data was necessary to achieve the Applicant’s legitimate interests.

70. The Commissioner considers that disclosure of the remaining personal data is necessary to achieve the Applicant's legitimate interests.  He notes that the Authority has already disclosed some of the information originally withheld under regulation 11(2) at review stage which, in his view, takes the Applicant some way towards satisfying her legitimate interest.  However, he notes that the detail of the remaining withheld personal data might well be considered relevant to the Applicant’s legitimate interest and would be quite appropriate matters for transparency and accountability in this context.  The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects than providing the remaining withheld information in full.  In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the remaining personal information is necessary for the purposes of the Applicant's legitimate interests.

71. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the remaining withheld information outweighs the rights and freedoms of the data subjects.

The data subjects' interests or fundamental rights and freedoms

72. It is necessary to balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms.  In doing so, it is necessary to consider the impact of disclosure.  For example, if the data subjects would not reasonably expect that the information would be disclosed to the public under the EIRs in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure.  Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

73. The Commissioner's guidance on regulation 11 of the EIRs notes factors that should be taken into account in balancing the interests of parties.  He notes that, although no longer applicable in the UK, Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects.  These are some of the factors public authorities should consider:

(i) Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?

(ii) Would the disclosure cause harm or distress?

(iii) Whether the individual has objected to the disclosure.

74. The Authority submitted that Article 5(1)(a) of the GDPR would be contravened by disclosure of the personal data as the data subjects would not have any reasonable expectation that their identity would be publicly disclosed and they would, instead, have a reasonable expectation that their personal information would remain confidential unless they consented to its disclosure.  The Authority confirmed that the data subjects had also not consented to the disclosure of their personal data.  Therefore, 
considering the data subjects’ expectation of privacy, the Authority believed that disclosure of the information would be unwarranted as it would prejudice the rights of the data subjects to privacy.  In its view, disclosure would therefore be unfair and, in breaching the first data protection principle, would be unlawful.

Does the information relate to public or private life?

75. Disclosure under the EIRs is public disclosure; information disclosed under the EIRs is effectively placed into the public domain.

76. The Commissioner acknowledges that some of the remaining withheld information relates to the individuals' private lives, in that it identifies them as neighbours.  For the rest, which relates to internal and external staff, he acknowledges that it relates to the roles of these individuals in their corresponding organisations.

77. In the circumstances, the Commissioner concludes that the withheld information relates to both the private and public lives of the data subjects.

Would disclosure cause harm or distress to the data subjects and have the individuals objected to the disclosure?

78. The Commissioner has also considered the harm or distress that might be caused by disclosure.  He notes that disclosure of any information under the EIRs – although in response to a request made by a specific applicant – effectively places that information into the public domain.  As such, he must consider the effects of publicly disclosing any personal data under the EIRs.

79. The Commissioner has considered the relevant submissions from both parties, together with the personal data withheld.  He recognises that it records the involvement of those individuals in relation to the information.

80. The Commissioner notes the Applicant’s statement, in her application, that she was not looking for any third-party personal data.  He has also taken regard of the Authority’s submissions, noting that it has already disclosed the names of senior Authority staff, along with (where recorded) references to the organisations to whom the individuals (whose personal data continues to be withheld) are linked.  In his view, this goes some way to allowing the Applicant to understand the context of the information 
disclosed to her.

81. The Commissioner has considered what reasonable expectations these individuals would have in relation to the disclosure of their personal data in response to the request under consideration here.  In his view, all of the individuals concerned would have a reasonable expectation that their personal data, as contained in the withheld information, would remain confidential.  He accepts, therefore, that these individuals would have no expectation that their personal details would be disclosed into the public domain in response to a request under the EIRs.

Balance of legitimate interests

82. The Commissioner has carefully balanced the legitimate interests of the data subjects against those of the Applicant.  He has concluded that the legitimate interest in the remaining personal data is overridden by the interests or fundamental rights and freedoms of the data subjects and that the requirements of condition (f) cannot be met here.  In the absence of a condition which would permit disclosure of the remaining withheld personal data, the Commissioner must conclude that disclosure would be unlawful.

83. Given that the Commissioner has concluded that the processing of the remaining personal data would be unlawful, he is not required to go on to consider whether disclosure of that personal data would otherwise be fair.

Conclusion on the data protection principles

84. The Commissioner finds that disclosure of the remaining personal data under consideration here would breach the first data protection principle and that this information is therefore exempt from disclosure (and was properly withheld) under regulation 11(2) of the EIRs.

Decision

The Commissioner finds that the Authority fully complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) and partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.

The Commissioner finds that, by relying on section 39(2) of FOISA and considering the Applicant’s request under the EIRs, the Authority complied with Part 1 of FOISA.

He further finds that the Authority correctly withheld some personal data under regulation 11(2) of the EIRs.

However, the Commissioner also finds that the Authority failed to comply with the EIRs by wrongly withholding some information variously under regulation 10(5)(f), regulation 11(1) and regulation 11(2) of the EIRs and, in doing so, failed to comply with regulation 5(1).

For the reasons set out in this decision notice, and given that the Authority has already disclosed to the Applicant the information found to have been wrongly withheld under regulations 10(5)(f) and 11(2) of the EIRs, the Commissioner does not require the Authority to take any action in respect of this failure in response to the Applicant’s application.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such 
appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch
Head of Enforcement

16 September 2024