Home Decisions

Decision 248/2024

Decision 248/2024: Information relating to Enforcement Case (alteration to sewage system)

Authority:  Scottish Borders Council
Case Ref:  202400347

Summary

The Applicant asked the Authority for all information and correspondence with the owners and agents of a specified property in respect of an Enforcement Notice/Case relating to an alteration to the property’s sewage system (a cut pipe).  The Authority withheld the information on the basis that disclosure would prejudice the interests of the person providing the information, or that it was personal data.  During the investigation, the Authority changed its position and disclosed the information requested with the 
exception of some personal data.  The Commissioner investigated and found that, while the Authority was entitled to withhold a small amount of personal data, it had wrongly withheld the remainder of the information requested under the exceptions originally claimed.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner)

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant”, “the Commissioner”, “the data protection principles”, “data subject”, “personal data”, “the UK GDPR” and paragraphs (a), (b), (c) and (f) of “environmental information”) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(1), (2), (3), (5)(f) and (6) (Exceptions from duty to make environmental information available); 11(1), (2)(a), (3A)(a) and (7) (Personal data); 17(1), (2)(a) and (b) (Enforcement and appeal provisions)

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and 14(a), (c) and (d) (Terms relating to the processing of personal data)

Background

1. On 11 December 2023, the Applicant made the following request for information to the Authority:

I refer to my previous request (EIR 2023-973) for all materials letters, emails, notes, etc both from and to the [Authority] and and the owners of [the specified property] and/or their Agents in respect of an Enforcement Notice published on your website which Enforcement Notice was also referenced as such in a letter from your [named individual], however, you now say the [Authority] hold no documentation in respect of an Enforcement Notice.

I now understand that this matter surrounding the alteration to the sewage system at [the specified property], apparently a cut pipe, has had a name change and is now being referred to as an Enforcement CASE.

In the light of this name change, I would like to make an FOI/EIR Request for the [Authority] to provide me with all documentation, materials, in whatever format, emails, notes, inspection details etc both from and to the [Authority] and the owners of [the specified property] and/or their Agents in respect of the Enforcement CASE and confirmation as to whether or not the reference number 23/00052/SEC27 remains the same, or whether the matter surrounding the non-compliant system, was provided with a new 
reference number or other identifying feature, when it was renamed an Enforcement CASE?

As you know, anything that is carried out on the sewage system at [the specified property] has a direct impact on our property and on our health and safety.  I cannot stress enough to the [Authority] just how serious this is and it is very dangerous to play games with peoples lives on the basis of semantics.

2. The Authority responded on 22 December 2023, explaining that it had considered the request under the EIRs and had applied section 39(2) of FOISA.  The Authority informed the Applicant that there was no name change and confirmed that no Enforcement Notice had been issued in respect of this case.  It explained that all information pertinent to the case was retained within file 23/00052/SEC27 with the exception of an Enforcement Notice, because a notice was never issued.  The Authority withheld the information in the Enforcement file 23/00052/SEC27 (variously) under:

  • regulation 10(5)(f) of the EIRs on the basis that disclosure would prejudice the interests of the person(s) providing the information.  The Authority considered that the public interest lay in members of the public being able to take advice from its officers (particularly on regulatory matters) without fear that the communications would be released into the public domain, and that by doing so, works/activity undertaken would be compliant and safe.
  • regulation 11(2) of the EIRs as the information identified (or could potentially identify) individuals and its disclosure would breach data protection legislation, specifically the first data protection principle.

3. On 28 December 2023, the Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that he was dissatisfied with the Authority’s decision because:

  • he believed he had been misled regarding the Enforcement Notice, as it appeared to him it was both an Enforcement Notice and an Enforcement Case;
  • he did not agree with the reasons given by the Authority for withholding the information under regulation 10(5)(f) and believed that the public interest lay in full disclosure of the information.  He stated that, by intimating that neighbours would be in fear of seeking advice from the Authority were the information to be disclosed, there was a plausible suspicion of wrong-doing over a long period of time.  In his view, the information should be disclosed to allow the full picture to be understood when it continued to seriously affect people’s health, their properties and access to the public road, and
  • for the personal data being withheld, while the Applicant stated that some of this was known to him, he argued that this could be easily redacted.

4. The Authority notified the Applicant of the outcome of its review on 9 February 2024, fully upholding its original decision with modification.  For the information withheld under regulation 10(5)(f), the Authority believed there was no public interest in disclosing information which may lead to people being reluctant to contact its officers for advice on regulatory matters to ensure any work carried out was compliant, as this could have implications on the safety and compliance of any works or 
activities undertaken.  For the personal data being withheld, the Authority informed the Applicant that it was now also relying on regulation 11(1) to withhold personal data (in addition to regulation 11(2)) and reiterated its previous arguments for withholding the personal data.

5.    On 2 March 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because:

  • he believed that the Authority had failed to justify the use of regulation 10(5)(f) and that there was an overwhelming public interest in disclosure of the 
    information withheld under that exception;
  • he queried why the Authority was withholding his own personal data under regulation 11(1), and
  • for the third party personal data withheld under regulation 11(2), while he was not looking for any personal data relating to the owners of the property or their 
    agents, he did wish to see their designations, in addition to the names and/or designations of Authority staff (but not their respective email addresses).


Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.

7. On 25 March 2024, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These focused on the searches carried out by the Authority for the information requested, and on its justification for withholding the information (variously) under regulations 11(1), 11(2) and 10(5)(f) of the EIRs.  The Authority was also asked whether it considered the information requested related to emissions (which, in terms of regulation 10(6) of the EIRs, would mean it could not be withheld under regulation 10(5)(f)).

9. During the investigation, the Authority changed its position and confirmed that it no longer wished to rely on regulation 10(5)(f) to withhold any information.  For the Applicant’s own personal data being withheld under regulation 11(1), while the Authority maintained that this exception applied, it confirmed it would be happy to disclose this information solely to the Applicant under Data Protection legislation.  For the information withheld under regulation 11(2), the Authority confirmed that it was no longer withholding some of the information previously withheld, but that it was continuing to withhold some other third party personal data under that exception.

10. On 10 and 12 June 2024, the Authority disclosed the majority of the information requested to the Applicant, including the Applicant’s own personal data (which it disclosed solely to him under Data Protection legislation).  It continued to withhold a small amount of personal data under regulations 11(1) and (2) and some other information which, it considered, did not fall within the scope of the request.

Commissioner’s analysis and findings

11. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Handling in terms of EIRs

12. The Authority considered the Applicant’s request under the EIRs, having concluded that the information requested was environmental information as defined in regulation 2(1) of the EIRs.

13. Where information falls within the scope of this definition, a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.

14. The Authority submitted that most of the information / requests handled by Planning, Enforcement etc. were environmental, where the purpose was to deal with the built environment.  The Commissioner accepts the request falls within this description and, in the circumstances, is satisfied that the information requested by the Applicant falls within the definition of environmental information set out in regulation 2(1), in particular paragraphs (a), (b), (c) and (f) of that definition.

Section 39(2) of FOISA – Environmental information

15. The Authority confirmed that it wished to continue to rely upon section 39(2) of FOISA.  The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs.  In this case, the Commissioner accepts that the Authority was entitled to apply this exemption to the information withheld under FOISA, given his conclusion that it is properly classified as environmental information.

16. As there is a statutory right of access to environmental information available to the Applicant in this case, the Commissioner accepts, in all the circumstances, that the public interest in maintaining this exemption (and responding to the request under the EIRs) outweighs any public interest in disclosing the information under FOISA.  Both regimes are intended to promote public access to information and there would appear to be no reason why (in this particular case) disclosure of the information should be 
more likely under FOISA than under the EIRs.

17. The Commissioner therefore concludes that the Authority was correct to apply section 39(2) of FOISA and consider the Applicant’s information request under the EIRs.

Regulation 5(1) of the EIRs – Duty to make environmental information available

18. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.  This obligation relates to information that is held by the authority when it receives a request.

19. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within the scope of the request.  Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).

The information held by the Authority

20. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities.  In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority.  He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information.  While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority, which falls within the scope of the request under consideration.

The Applicant’s submissions on the information held

21. Following receipt of the information disclosed to him by the Authority on 10 and 12 June 2024, the Applicant wrote to the Authority, copying his correspondence to the Commissioner.  The Applicant informed the Authority that, in his view, it had failed to justify what it meant by some information falling outwith the scope of his request.  He believed that, as the information formed part of the Enforcement Notice/Case file, withholding it would not show completeness or transparency of the situation.

22. The Applicant further argued that recent recorded inspection notes would exist, none of which seemed to have been provided.

The Authority’s submissions on the information held

23. The Authority confirmed that the Enforcement Case was opened on 11 July 2023.  It explained that the “inadvertently cut pipe” had been brought to its attention in an email dated 28 June 2023 from the property owner’s solicitor confirming that the pipe had been cut, and that this was the trigger for the Enforcement Case being raised.  The Authority explained that the Enforcement Case had been opened to deal with works that had been carried out without a warrant, i.e. a change in method of wastewater discharge, and the timespan was from registration on 28 June 2023 to 31 August 2023 (works inspected of reinstated drain on 3 August 2023).

24. The Authority further explained that the pipe in question (i.e. the one which had been inadvertently cut) was the discharge from the property’s private treatment plant, containing treated effluent, serving the property to the burn, as licensed by the Scottish Environment Protection Agency.  The Authority confirmed that it was not aware of when the pipe had been cut and had only been made aware of this in the email from the property owner’s solicitor.  The Authority confirmed that the “inadvertently cut pipe” was the issue that led to the Enforcement Case being opened.

25. The Authority submitted that its staff knew where information was located that related to the Enforcement Case.  It explained, with supporting evidence, that searches of the Authority’s Uniform system (which holds basic information) and IDOX system (the service’s filing system) had been undertaken.  While the Authority accepted that it held a significant amount of data relating to the property in question, and that discussions had been ongoing for a significant number of years, it submitted that it had considered all information relating to the Applicant’s request and confirmed that it had nothing further to consider or to disclose to the Commissioner.

26. The Authority accepted that some information (in document 4), originally considered to fall outwith scope, did in fact fall within scope and would be disclosed to the Applicant.  This information was included in the Authority’s partial disclosure of information to the Applicant on 10 June 2024.

27. For some other information identified by the Authority which, it considered, did not fall within scope, the Authority explained that some of this information (document 3 and part of document 4) related to a matter which had occurred prior to the Enforcement Case being raised.  This was background information and played no part in the Enforcement Case and had no bearing on the actions taken by the Authority.  In addition, some other information (documents 9 and 10) related to an individual navigating the Authority’s website.  While these documents were available within the IDOX file, the Authority submitted that they did not fall within the scope of the Applicant’s request.  The Authority explained that, in the interests of completeness, it had provided the Commissioner with this information in evidence of what information was retained within the file.

The Commissioner’s views on the information held

28. The Commissioner has carefully considered the submissions from both parties, together with the information identified and the supporting evidence and explanation of searches.  Having done so, the Commissioner is satisfied that the searches carried out by the Authority would have been capable of identifying any relevant information.  While the Commissioner notes that the Applicant believes the Authority must hold more information, the Commissioner is satisfied, on the balance of probabilities, that no 
further in-scope information relating to the Applicant’s request is held by the Authority.

29. Turning to the outwith scope information, the Commissioner notes that the Authority has explained why some of the information identified does not relate to the Enforcement Case.  He notes that it either relates to a separate prior issue and is background information prior to the Enforcement Case being opened, or to an enquiry by a member of the public, and played no part or had any bearing on the Authority’s actions in the Enforcement Case.  Having considered the information in question, the 
Commissioner is satisfied that it does not fall within the scope of the Applicant’s request.

Regulation 10(5)(f) – Interests of the person who provided the information

30. Under the EIRs, a public authority may refuse to make environmental information available if one or more of the exceptions in regulation 10 applies, but only if (in all the circumstances) the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.

31. At both initial response and review stages, the Authority withheld some information under regulation 10(5)(f) of the EIRs.  Regulation 10(5)(f) provides that a Scottish public authority may refuse to make environmental information available to the extent that its disclosure would, or would be likely to, prejudice substantially the interests of the person who provided that information, where that person –

(i) was not under, and could not have been put under, any legal obligation to supply the information;

(ii) did not supply it in circumstances such that it could, apart from the EIRs, be made available, and

(iii) has not consented to its disclosure.

32. As stated above, during the investigation, the Authority withdrew its reliance on regulation 10(5)(f) of the EIRs to withhold any information originally withheld under that exception.  It informed the Commissioner that it accepted that the information requested related to emissions, and therefore the majority of the content could not be withheld from the public domain.  The Authority further explained that, while the reasons outlined for withholding the information at review stage remained relevant, it 
had not considered the information from an ”emissions” perspective and accepted, for that reason, that the information was in the public interest and should have been disclosed.

33. Having considered the Authority’s submissions regarding its decision to withdraw reliance on regulation 10(5)(f), the Commissioner has no option but to find that disclosure of the information would not have had the substantially prejudicial impact required for regulation 10(5)(f) of the EIRs to be engaged.  Consequently, in this case, the Commissioner is not satisfied that the information requested was properly withheld under this exception when the Authority issued its review outcome.  Having reached this conclusion, he is not required to consider the public interest test in regulation 10(1)(b) of the EIRs.

34. The Commissioner concludes, therefore, that the Authority was not entitled to rely upon regulation 10(5)(f) to withhold the information in question and, by so doing, breached regulation 5(1) of the EIRs.

35. As the Authority has disclosed to the Applicant all of the information found to have been wrongly withheld under regulation 10(5)(f), the Commissioner does not require the Authority to take any further action in this regard.

36. The Commissioner cannot stress enough the importance of giving full and proper consideration to the tests which require to be met for an exception under the EIRs (or an exemption under FOISA) to apply, when considering requests under both FOISA/the EIRs.  He would urge the Authority, and indeed all Scottish public authorities, to ensure that, when responding to information requests, thorough consideration is given to whether any applicable test of substantial prejudice can actually be met in the 
circumstances.  

37. In this case, it appears likely that such consideration would not only have resulted in earlier disclosure of the information to the Applicant, but also a saving in staff time and effort.  The Commissioner acknowledges that the history of matters relating to sewage at the property in question means that relations between all concerned are challenging – but that makes it all the more important, surely, that due care is taken to ensure that information requests in this area are handled appropriately from the outset.  Information requests, by themselves, are unlikely to resolve matters at the specified property: appropriate handling of information requests (a standard the Commissioner would always expect in any case) may at least, however, help ensure they do not get any worse.

Regulation 11(1) of the EIRs – Personal data of the Applicant

38. Regulation 10(3) of the EIRs makes it clear that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.  The exception in regulation 11(1) of the EIRs provides that, to the extent that environmental information requested includes personal data of which the Applicant is the data subject, then the duty to make it available under regulation 5(1) shall not apply to those personal data.

39. Regulation 11(1) essentially prohibits public authorities from making an applicant's personal data available in response to an EIRs request.  This is because individuals have a separate right to make a request for their own personal data under the UK GDPR (or, as appropriate, under the DPA 2018).  This route is more appropriate for individuals accessing their personal data, as it ensures that the data are disclosed only to that individual and not into the public domain.

40. Regulation 11(1) does not deny individuals a right to access information about themselves, but ensures that the right is exercised under the correct legislation (the UK GDPR/DPA 2018) and not under the EIRs.

41. Personal data are defined in section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual.  "Identifiable living individual" is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)

42. In its review outcome, the Authority stated that it was withholding some personal data under regulation 11(1).

43. Following his application to the Commissioner, the Applicant queried the fact that the Authority was withholding his own personal data.  He was not aware that his personal data would be included in the information held in the Enforcement Notice/Case and stated that he would like to see that information.

44. In its submissions to the Commissioner, the Authority confirmed that some information comprised the Applicant’s own personal data, which it intended to disclose solely to him under Data Protection legislation.

45. The Commissioner has considered the information withheld by the Authority under regulation 11(1) of the EIRs and is satisfied that it is the Applicant’s personal data: the Applicant can be identified from the information and the information focusses on, and is biographical in relation to, him.  Consequently it relates to the Applicant.  The Commissioner is therefore satisfied that the information is excepted from disclosure under regulation 11(1) of the EIRs.

46. The Commissioner notes that the Authority disclosed this information solely to the Applicant under Data Protection legislation, when disclosing the information to him on 10 and 12 June 2024.

Regulation 11(2) of the EIRs – Third party personal data

47. As stated above, in terms of regulation 10(3) of the EIRs, a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.  Regulation 11(2), read in conjunction with regulation 11(3A)(a), provides that personal data of which the applicant is not the data subject (applying the relevant definitions in section 3 of the DPA 2018) shall not be made available where its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.  There is no public interest to be considered where regulation 11(2) applies.

48. In order for a Scottish public authority to rely on this exception, it must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under the EIRs) would contravene at least one of the data protection principles in Article 5(1) of the UK GDPR.

Information disclosed during the investigation

49. As stated above, on 10 and 12 June 2024, the Authority partially disclosed to the Applicant the majority of the information originally withheld.  This included some information which the Authority had previously withheld under regulation 11(2).

50. In its submissions to the Commissioner, the Authority explained that, at the material times when it had considered the Applicant’s request and request for review, it was of the view that the content of the information was exempt from disclosure under regulation 10(5)(f).  As such, it believed it would have been meaningless to release any personal data, e.g. names of staff, dates etc. into the public domain.  However, on reflection, it confirmed that it was happy to disclose the file (including some information previously withheld under regulation 11(2)), subject to the continued redaction of the remaining personal data.

51. The Commissioner has considered the Authority’s submissions on the application of regulation 11(2) at review stage.  In the absence of any submissions explaining why the personal data, now disclosed, had been properly withheld under that exception at that time, the Commissioner has no option but to find that the Authority was not entitled to rely on regulation 11(2) to withhold, at review stage, the third party personal data which it has since disclosed to the Applicant.

52. The Commissioner will now go on to consider whether the Authority was correct to withhold the remaining third party personal data under regulation 11(2).

Is the remaining withheld information personal data?

53. The first question the Commissioner must address is whether the remaining withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual.  "Identifiable living individual" is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)

54. Information that could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

55. The Authority submitted that the information related to identifiable living individuals and included, for example, the names of third parties such as neighbours, and the names and contact details of staff, both internal and external.

56. The Commissioner has considered the submissions received on this point, together with the remaining withheld information.  It clearly “relates to” identifiable living individuals.  Living individuals can be identified from the data, to whom the data can be said to relate.  It is therefore those individuals' personal data, as defined by section 1(1) of the DPA.

57. The Commissioner is therefore satisfied that the remaining withheld information is personal data for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

58. The Authority stated that disclosure of the remaining third party personal data would contravene the first data protection principle (Article 5(1)(a)).  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.

59. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of the EIRs, personal data are processed when disclosed in response to a request.  Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.

60. The Commissioner must now consider if disclosure of the remaining third party personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

61. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).

62. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA or the EIRs.

63. The tests which must be met before Article 6(1)(f) can be met are as follows:

(i) Does the Applicant have a legitimate interest in obtaining the personal data?

(ii) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

64. Following his application to the Commissioner, the Applicant clarified that he was raising no dissatisfaction with any personal data relating to the owners of the property or their agents.  He confirmed he was happy for names to be redacted in the information requested, but not designations.  He subsequently clarified that it would be useful to see any names and/or designations of Authority staff who had contributed to the Enforcement Notice/Case and the work carried out, but not necessarily their 
respective email addresses as, in the main, he might already hold these.

65. The Authority acknowledged that the Applicant had a legitimate interest in obtaining the information and stated that it would release as much information as possible into the public domain [as per its disclosure to the Applicant on 10 and 12 June 2024].

66. Having considered all relevant submissions, the Commissioner is satisfied that the Applicant does have a legitimate interest in the withheld information, at the level requested.

Is disclosure of the personal data necessary?

67. Having accepted that the Applicant has a legitimate interest in the remaining withheld third party personal data, the Commissioner must consider whether disclosure of those personal data is necessary for the Applicant's legitimate interests.  In doing so, he must consider whether these interests might reasonably be met by any alternative means.

68. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.  In this case, the Supreme Court stated (at paragraph 27):

A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim.  Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.

69. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.

70. In its submissions to the Commissioner, the Authority stated that it did not believe disclosure of the remaining personal data was necessary to achieve the Applicant’s legitimate interests.

71. The Commissioner considers that disclosure of the remaining third party personal data is necessary to achieve the Applicant's legitimate interests.  He notes that the Authority has already disclosed some of the information, originally withheld at review stage under regulation 11(2), which, in his view, takes the Applicant some way towards satisfying his legitimate interest.  However, he notes that the detail of the remaining withheld personal data might well be considered relevant to the Applicant’s legitimate 
interest and would be quite appropriate matters for transparency and accountability in this context.  The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interests which would interfere less with the privacy of the data subjects than providing the remaining withheld information in full.  In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the remaining personal information is necessary for the purposes of the Applicant's legitimate interests.

72. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the remaining withheld information outweighs the rights and freedoms of the data subjects.

The data subjects' interests or fundamental rights and freedoms

73. It is necessary to balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms.  In doing so, it is necessary to consider the impact of disclosure.  For example, if the data subjects would not reasonably expect that the information would be disclosed to the public under the EIRs in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure.  Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

74. The Commissioner's guidance on regulation 11 of the EIRs notes factors that should be taken into account in balancing the interests of parties.  He notes that, although no longer applicable in the UK, Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects.  These are some of the factors public authorities should consider:

(i) Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?

(ii) Would the disclosure cause harm or distress?

(iii) Whether the individual has objected to the disclosure.

75. The Authority submitted that Article 5(1)(a) of the GDPR would be contravened by disclosure of the personal data as the data subjects would not have any reasonable expectation that their identity would be publicly disclosed and they would, instead, have a reasonable expectation that their personal information would remain confidential unless they consented to its disclosure.  The Authority confirmed that the data subjects had also not consented to the disclosure of their personal data.  Therefore, considering the data subjects’ expectation of privacy, the Authority believed that disclosure of the information would be unwarranted as it would prejudice the rights of the data subjects to privacy.  In its view, disclosure would therefore be unfair and, in breaching the first data protection principle, would be unlawful.

Does the information relate to public or private life?

76. Disclosure under the EIRs is public disclosure; information disclosed under the EIRs is effectively placed into the public domain.

77. The Commissioner acknowledges that some of the remaining withheld information relates to the individuals' private lives, in that it identifies them as neighbours.  For the rest, which relates to internal and external staff, he acknowledges that it relates to the roles of these individuals in their corresponding organisations.

78. In the circumstances, the Commissioner concludes that the withheld information relates to both the private and public lives of the data subjects.

Would disclosure cause harm or distress to the data subjects and have the individuals objected to the disclosure?

79. The Commissioner has also considered the harm or distress that might be caused by disclosure.  He notes that disclosure of any information under the EIRs – although in response to a request made by a specific applicant – effectively places that information into the public domain.  As such, he must consider the effects of publicly disclosing any personal data under the EIRs.

80. The Commissioner has considered the relevant submissions from both parties, together with the personal data withheld.  He recognises that it records the involvement of those individuals in relation to the information.

81. The Commissioner notes the level of third party personal data that the Applicant clarified he wished to obtain.  He has also taken regard of the Authority’s submissions, noting that it has already disclosed the names of senior Authority staff, along with (where recorded) references to the organisations to whom the individuals (whose personal data continues to be withheld) are linked.  In his view, this goes some way to allowing the Applicant to understand the context of the information disclosed 
to him.

82. The Commissioner has considered what reasonable expectations these individuals would have in relation to disclosure of their personal data in response to the request under consideration here.  In his view, all of the individuals concerned would have a reasonable expectation that their personal data, as contained in the withheld information, would remain confidential.  He accepts, therefore, that these individuals would have no expectation that their personal details would be disclosed into the 
public domain in response to a request under the EIRs.

Balance of legitimate interests

83. The Commissioner has carefully balanced the legitimate interests of the data subjects against those of the Applicant.  He has concluded that the legitimate interest in the remaining personal data is overridden by the interests or fundamental rights and freedoms of the data subjects and that the requirements of condition (f) cannot be met here.  In the absence of a condition which would permit disclosure of the remaining withheld personal data, the Commissioner must conclude that disclosure would be unlawful.

84. Given that the Commissioner has concluded that the processing of the remaining third party personal data would be unlawful, he is not required to go on to consider whether disclosure of that personal data would otherwise be fair.

Conclusion on the data protection principles

85. The Commissioner finds that disclosure of the remaining third party personal data under consideration here would breach the first data protection principle and that this information is therefore exempt from disclosure (and was properly withheld) under regulation 11(2) of the EIRs.

Decision

The Commissioner finds that the Authority fully complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) and partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.

The Commissioner finds that, by relying on section 39(2) of FOISA and considering the Applicant’s request under the EIRs, the Authority complied with Part 1 of FOISA.

He further finds that the Authority correctly withheld some personal data under regulations 11(1) and (2) of the EIRs.

However, the Commissioner also finds that the Authority failed to comply with the EIRs by wrongly withholding some information variously under regulations 10(5)(f) and 11(2) of the EIRs and, in doing so, failed to comply with regulation 5(1).

For the reasons set out in this decision notice, and given that the Authority has already disclosed to the Applicant the information found to have been wrongly withheld under regulations 10(5)(f) and 11(2) of the EIRs, the Commissioner does not require the Authority to take any action in respect of this failure in response to the Applicant’s application.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch
Head of Enforcement

7 November 2024