Decision 079/2021: Number of deaths in care homes

Public authority: Registrar General of Births, Deaths and Marriages for Scotland
Case Ref: 202001308

Summary

The Registrar General of Births, Deaths and Marriages was asked for information relating to the number of deaths that had occurred in care homes since March 2020.

The Registrar General originally withheld the information as personal data but, during the investigation, applied alternative exemptions.

The Commissioner investigated and found that the Registrar General was not entitled to withhold the information requested. He required the Registrar General to give the information to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) (Effect of exemptions); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2A), (5) (definitions of "the data protection principles", "data subject", "personal data", "processing" and "the UK GDPR") and (5A) (Personal information ); 39(1) (Health and safety)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) section 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 28 September 2020, the Applicant made a request for information to Registrar General of Births, Deaths and Marriages for Scotland (the Registrar General) for information, which included:

From the date March 16, 2020, to provide a breakdown of the number of confirmed Covid-19 deaths in Scotland by 1a) Individual care homes 1b) Care home provider.

From the date March 16, 2020, to provide a breakdown of the number of suspected Covid-19 deaths in Scotland by 2a) Individual care homes 2b) Care home provider.

2. The Registrar General responded on 2 October 2020. He stated he was unable to provide a breakdown of the deaths by individual care homes as disclosure of the data at this level might allow identification of deceased individuals and thus cause damage or distress to the living relatives of those individuals. As such, he stated the information was exempt from disclosure in terms of section 38(1)(b) (personal information) of FOISA. He further stated he did not hold the information regarding care home providers.

3. On 6 October 2020, the Applicant wrote to the Registrar General, requesting a review of his decision as he did not accept that section 38(1)(b) of FOISA was properly applied.

4. The Registrar General notified the Applicant of the outcome of his review on 29 October 2020. He upheld the original response without modification.

5. On 2 November 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Applicant believed the use of the personal data exemption to be erroneous and obfuscatory in nature, due to the political sensitivities of releasing such data.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 26 November 2020, the Registrar General was notified in writing that the Applicant had made a valid application. The Registrar General was asked to send the Commissioner the information withheld from the Applicant. The Registrar General provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Registrar General was invited to comment on this application and to answer specific questions, focusing on the application of section 38(1)(b) of FOISA.

9. In his submissions to the Commissioner, the Registrar General accepted that the information held was not exempt in terms of section 38(1)(b) of FOISA. The Registrar General provided submissions to the effect that he wished to apply sections 33(1)(b) (Commercial interests and the economy) and 39(1) (Health, safety and the environment) to withhold the information requested.

10. The Registrar General explained why he considered the information held to be exempt in terms of the exemptions claimed. He advised that he had received representations from relevant third parties and drew the Commissioner's attention to various submissions from three of those third parties, namely, the Care Inspectorate, Scottish Care and the Coalition of Care and Support Providers in Scotland, and to publications available online. These included examples of the large amount of media coverage the subject matter had received.

11. The Registrar General provided the Commissioner with the third party representations as evidence that the exemptions in sections 33(1)(b) and 39(1) of FOISA applied to the withheld information.

12. The Commissioner also received submissions from SOLACE (Society of Local Authority Chief Executives), supporting the submissions provided by the Registrar General.

13. The Registrar General advised the Commissioner that while he had invited representations from SOLACE, he did not receive any directly. He stated that he had received earlier representations from SOLACE via the Care Inspectorate, although these did not cover the above exemptions. He advised that he considered the content of the SOLACE letter complemented his own submissions.

14. During the investigation, the Registrar General was advised that other Scottish public authorities (four separate Councils) had also received the same request for information as was under consideration in this case. The Registrar General was advised that the Councils in question had all disclosed the information they held in response to the Applicant's request. The Registrar General was given the opportunity to comment on the disclosures by the Councils. The Registrar General commented that he had examined the other disclosures, confirming they did not alter his position. He remained of the view that section 33(1)(b) and 39(1) applied to the information he held.

Commissioner's analysis and findings

15. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Registrar General (including the third party representations referred to above). He is satisfied that no matter of relevance has been overlooked.

Section 38(1)(b) of FOISA - Personal information

16. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the Data Protection Act 2018 (the DPA)) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA. In terms of section 3(2) of the DPA 2018, "personal data" must relate to living individuals.

17. To rely on this exemption, the Registrar General must show that the information withheld is personal data for the purposes of the DPA and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.

18. As mentioned above, during the investigation the Registrar General withdrew his application of section 38(1)(b) of FOISA, accepting that it did not apply. In the absence of submissions from the Registrar General as to why the information was initially considered to be so exempt from disclosure, the Commissioner must conclude that the information in question was not properly withheld under section 38(1)(b) of FOISA and to that extent was incorrectly withheld by the Registrar General. In withholding the information under this exemption, the Registrar General breached section 1(1) of FOISA.

19. The Commissioner will consider whether the Registrar General is entitled to withhold the information under any of the exemptions now claimed. He will deal with each in turn.

Section 33(1)(b) - Commercial interests and the economy

20. The Registrar General submitted that the numbers of deaths requested by the Applicant were exempt from disclosure under section 33(1)(b) of FOISA. This provides that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). Section 33(1)(b) of FOISA is set out in full in Appendix 1. This is a qualified exemption and is therefore subject to the public interest test in section 2(1)(b) of FOISA.

21. There are certain elements which an authority needs to demonstrate are present when relying on this exemption. In particular, it needs to identify:

• whose commercial interests would (or would be likely to) be harmed by disclosure;
• the nature of those commercial interests; and
• how those interests would (or would be likely to) be prejudiced substantially by disclosure.

22. The prejudice must be substantial, in other words of real and demonstrable significance. Where the authority considers the commercial interests of a third party would (or would be likely to be) harmed, it must make this clear: generally, while the final decision on disclosure will always be one for the authority, it will assist matters if the third party has been consulted on the elements referred to above.

23. In his submissions to the Commissioner, the Registrar General submitted that the representations and related evidence received from the key care sector stakeholders evidenced that disclosure would prejudice substantially the commercial interests of relevant care homes/providers. He stated that there is a significant risk that the media will not appropriately contextualise the requested information prior to its publication, and that the breakdown of COVID-19-related deaths by individual care provider / care home is likely to be highly misleading when presented out of context. He stated that such inaccurate and out-of-context data would, or would be highly likely, to:

• damage the reputation of the care homes/providers
• lead to residents being removed based on inaccurate information
• reduce attractiveness of the homes/providers to prospective residents
• lead to staff absence and reduced ability to recruit staff effectively
• lead to the reduction of charitable donations for homes and providers.

24. The Registrar General recognised that there must be a genuine link between disclosure and the harm caused. He submitted that, based upon the representations and related evidence received from key care sector stakeholders, he considered disclosure of the requested information, broken down by reference to individual care services/homes, would result in substantial prejudice to the commercial interests of such care services /homes and that such prejudice would be of real and demonstrable significance, rather than simply marginal. He stated he considered there would be a genuine link between disclosure and the harm and that such harm would not simply be a remote or hypothetical possibility.

25. The Registrar General submitted that the representations and supporting evidence received showed that adverse media reporting had damaged public confidence in the care home sector, leading to difficulties in staff retention and recruitment, difficulties for some care providers in remaining financially viable, and some providers withdrawing from the industry.

26. The Registrar General concluded that death data by service and its subsequent reporting by media without due regard to context and thus further damaging public confidence in the sector, would lead to slower recovery and cause more care homes to close. He submitted that this identified a real and substantial risk that care homes run by the voluntary sector would be lost altogether in Scotland.

27. Taking account of all of the submissions by the Registrar General in relation to the application of section 33(1)(b) of FOISA, and having taken a broad view, the Commissioner accepts that the information in question is commercial in nature.

28. As mentioned above, in order to rely on this exemption, an authority has to evidence why disclosure would, or would be likely to, prejudice substantially the commercial interests of any person.

29. As indicated above, where an authority is claiming disclosure would, or would be likely to, prejudice substantially the commercial interests of a third party, the Commissioner would expect that the third party is consulted and their views obtained. In this case, there are a number of third parties.

30. As mentioned above, the Registrar General provided the Commissioner with the submissions he had received from relevant third parties, namely, the Care Inspectorate, Scottish Care and the Coalition of Care and Support Providers in Scotland. He explained that the adverse reporting in the media had damaged public confidence in the care home sector, which had led to difficulties in staff retention, difficulties for some care providers in remaining financially viable and some providers withdrawing from the industry.

31. On the question of harm, the Commissioner must be persuaded by the submissions he has received from the Registrar General. In his view, these do not explain how the disclosure of the requested information would have had, or would have been likely to have (at the time the Registrar General responded to the Applicant's request or his requirement for review), a substantially prejudicial impact on the commercial interests of the care services. The Commissioner notes that the Registrar General's submissions are partly based on the submissions received from third parties, and he has considered the submissions in detail. The Commissioner acknowledges the challenges being encountered by the service providers during the Covid-19 pandemic, and the resulting commercial difficulties. He also acknowledges the press coverage that has been drawn to his attention and again notes the difficulties that the care sector as a whole, and individual care providers, are experiencing.

32. In relation the actual information being withheld in this case, however, the Commissioner considers the submissions provided by the Registrar General are speculative in nature. The Commissioner would emphasise that he can only consider the information actually sought by the Applicant, and whether disclosure of that would be the catalyst to cause the harm claimed. The question to answer is how disclosure of the information being withheld in this case would lead to the substantial prejudice required for this exemption to be engaged.

33. The Commissioner has considered all of the submissions made by the Registrar General regarding the difficulties service providers, and care homes in particular, have faced since the appearance of Covid-19. The Commissioner has to consider whether disclosure of the information requested would exacerbate those problems, to the extent that disclosure itself would, or would be likely to, prejudice the relevant commercial interests substantially.

34. Taking account of the submissions received from the Registrar General in relation to the actual information under consideration here (as opposed to wider consideration of the problems facing the care industry), and the information already in the public domain at that time, the Commissioner does not believe he has any option but to find that the Registrar General has not evidenced the required substantial prejudice for section 33(1)(b) of FOISA to be engaged.

35. It is for the Registrar General to provide the required evidence of harm, not for the Commissioner to go out and find it. Consequently, in this case, the Commissioner is not satisfied that the information requested was properly withheld under this exemption. Having reached that conclusion, the Commissioner is not required to consider the public interest test in section 2(1)(b) of FOISA.

36. For completeness however, the Commissioner will consider the public interest test, as he would be required to do if he were to accept that section 33(1)(b) was engaged.

Public interest submissions by the Registrar General

37. In this case, the Registrar General advised the Commissioner that he recognised the public interest in the arrangements for the provision of care services in Scotland and the levels of care provided, particularly in the context of the Covid-19 pandemic.

38. He also identified a very strong competing public interest in safeguarding the physical and mental health of care services staff, residents and the families of relevant deceased individuals; ensuring the continued provision of safe and effective care services; preserving the effectiveness and integrity of the care sector; ensuring the public has access to properly considered, verified and contextualised information on the Covid-19 pandemic which is sufficient, complete, accurate and not misleading; and ensuring the public has access to such sufficient, complete, accurate and not misleading information in order to ensure informed public debate and discourse.

39. The Registrar General concluded that the public interest strongly favoured the application of the exemption and non-disclosure of the information in this instance.

Public interest submissions by the Applicant

40. The Applicant submitted that release of the information was overwhelmingly in the public interest. He pointed out that care home deaths had been the subject of intense public and political scrutiny and argued that the full data should be available to be scrutinised by the public. He submitted that it was exactly this type of data that Freedom of Information laws were designed to help unearth and provide a crucial and necessary route towards full accountability and transparency. In the era of the Covid-19 pandemic, he believed the principles of accountability and transparency should be upheld.

41. During the investigation, the Applicant drew the Commissioner's attention to the data disclosed by other authorities and submitted that there was a public interest in the disclosure of the information held by the Registrar General.

42. The Applicant submitted that the Covid-19 epidemic in Scotland was a national tragedy of unprecedented scale, and the scale of the tragedy - which had led to calls for a public inquiry into Covid-19 deaths in care homes - was and remained one of the main political talking points of the fallout from the pandemic. He submitted that releasing this data would add further nuance to discussion around the tragedy.

43. The Applicant submitted that Covid-19 had affected everyone and every aspect of life. The disclosure of information pertaining to care home Covid-19 deaths was demonstrably in the public's interest, as this would provide a clear and verifiable picture of the impact of the virus on Scotland's care homes (and, by extension, accountability and transparency in relation to the Scottish Government's handling of the crisis response).

44. The Applicant also considered it essential for this information to be released to enable a full understanding of Covid-19's impact on the care home sector. He believed it would help acknowledge the scale and reach of the disaster, enable recognition of the loss to families across the country and ensure maximum transparency around the issue, allowing for fully informed decision making on future solutions. He concluded that disclosure would contribute to debate on a matter of public interest.

45. The Applicant also drew attention to the Commissioner's guidance on the consideration of the public interest[1], and commented that if the argument in favour of non-disclosure is that the information may be misinterpreted, this should not be taken into account. He referred to paragraph 22 of the Commissioner's guidance which states:

Just because information is complex, or might be difficult for the requester to interpret, does not mean that the information should be withheld on public interest grounds. If a public authority is concerned that information might not be easily understood, or would be misinterpreted, there is nothing to stop the authority from explaining the information.

46. In addition, the Applicant submitted disclosure would "contribute to ensuring that any public authority with regulatory responsibilities is adequately discharging its functions" as a means to holding institutions to account.

Commissioner's conclusions

47. Having considered all of the public interest arguments provided by the Registrar General, the Commissioner is of the view that a number of the submissions are speculative. The Registrar General submitted that it was in the public interest to withhold the information on the basis that it is necessary to ensure the public has access to properly considered, verified and contextualised information which is sufficient, complete, accurate and not misleading in order to ensure informed public debate and discourse.

48. The Commissioner would consider that the information held by the Registrar General is factual - there being no evidence or suggestion otherwise.

49. As the Applicant has pointed out, the Commissioner has issued guidance on applying the public interest test under FOISA. The Commissioner considers that paragraph 22, as quoted above by the Applicant, is particularly relevant in this case, as is paragraph 21, which lists factors that should not be taken into account when applying the public interest test. These include the risk of the requester misinterpreting the information.

50. The Commissioner notes that, in his submissions, the Registrar General refers to the disclosure of "such inaccurate and out-of-context data" and the likelihood of it being "highly misleading when presented out of context". This is further reflected in the representation of a key stakeholder, who commented that disclosing statistics now, and without context, is simply likely to dent public confidence further, lead to slower recovery within the sector and cause more care homes to close.

51. The Commissioner acknowledges that, at times, information disclosed can be misinterpreted. The Commissioner does not readily accept, however, that disclosure of the information in this case would lead to any confusion or misinterpretation. As mentioned above, there is no suggestion that the information held by the Registrar General is inaccurate and, as outlined in the Commissioner's guidance, explanation as to the context of the information could be provided to the Applicant, thus negating the claim that disclosure would lead to misinterpretation or to the public drawing wrong conclusions.

52. In considering the public interest, the Commissioner has also given consideration to a report by Amnesty International on the protection of older people in care homes during the pandemic[2], which (at page 44) states:

In late August 2020 the CQC [the Care Quality Commission, which regulates health and social care services in England], in response to freedom of information requests by The Guardian newspaper, refused to make public which care homes or providers recorded the most coronavirus fatalities, reportedly citing fears that the information could negatively impact the commercial viability of care home providers.[3]

COVID-19-related deaths are not necessarily a direct indicator of the quality of the care in a given care home. There are a range of other factors associated with COVID-19 transmission in care homes, including notably the level of community transmission, the testing regime, the movement of staff between and within care homes, the implementation of IPC [infection prevention and control] measures, access to and correct use of PPE [personal protective equipment], and transmission of the virus from those entering the homes from hospitals or other settings. However, the absence of the above-mentioned data deprives those who have lost loved ones of information related to their deaths, whilst also depriving older people and their relatives of necessary information to make an informed decision when choosing a care home or care home provider. Crucially, such lack of transparency also impedes accountability for decisions taken by the relevant officials and bodies and hampers efforts to ensure lessons are learned and failures are not repeated, and that people's human rights are respected, protected and upheld.

53. The Commissioner considers there is a strong public interest in disclosure of the information, to ensure that older people and their relatives have the necessary information to make an informed decision when choosing a care home or care home provider. He considers that to deny those individuals the access to this relevant information would indeed be a lack of transparency, which is not in the public interest. The Commissioner therefore concludes, that, even if section 33(1)(b) of FOISA were considered to be engaged, the public interest would favour the disclosure of the information in this case.

54. The Commissioner therefore concludes that the Registrar General was not entitled to withhold the information in terms of section 33(1)(b) of FOISA.

Section 39(1) - Health, safety and the environment

55. Section 39(1) of FOISA states that information is exempt information if its disclosure under FOISA would, or would be likely to, endanger the physical or mental health or the safety of an individual. This is a qualified exemption and is subject to the public interest test in section 2(1)(b) of FOISA.

56. The Commissioner's briefing on section 39(1)[4] notes that the exemption does not contain the usual harm test. Instead of the "substantial prejudice" test found in various other exemptions contained in Part 2 of FOISA, this exemption refers to the "endangerment" of health or safety. The briefing also notes that the test of "endangerment" is less demanding than the "substantial prejudice" test applied in other exemptions.

57. The Commissioner's considers the term "endanger" is broad enough to apply where there is a (direct or indirect) threat to the safety of a person which would foreseeably arise in the future, as well as immediate harm, since the exemption does not specify that any threat should be imminent before it applies. There must, however, be a genuine link between disclosure and the threat. The Commissioner believes that, for endangerment to be considered likely, there must be some well-founded apprehension of danger, such that the prospect of harm could be regarded as a distinct possibility.

58. The Registrar General submitted that he had taken cognisance of the content of the Commissioner's briefing on the application of section 39(1) and submitted that he considered there to be extensive and compelling evidence demonstrating a real possibility that disclosure of the requested information would, or would be highly likely to, endanger the physical and/or mental health or the safety of a range of individuals - being the families of relevant deceased individuals, the care home employees of the care services providers and/or care home in which such deceased individuals died or where they resided or received care, and other residents in such care homes.

59. The Registrar General submitted that there was clear evidence of actual instances of such endangerment and a realistic prospect or degree of likelihood of such endangerment continuing, and indeed increasing, as a direct consequence of disclosure of the requested information.

60. The Registrar General drew attention to submissions received from relevant third parties, including the Care Inspectorate, Scottish Care, the Coalition of Care and Support Providers in Scotland, and relevant publications. He explained that staffing levels within the care service were low, absences could be linked to Covid-19-related anxiety and the low level of staffing in care services was leading to risks to the health and safety of residents.

61. The Registrar General referred the Commissioner to previous examples of media coverage, and third party submissions, to show that previous disclosures of numbers of deaths had led to anxiety amongst staff, residents and family members.

62. The Registrar General provided submissions to the effect that, having considered all of the representations received, he had concluded that disclosure would :

• Have a serious and adverse direct impact upon the mental health of staff and lead to additional absences, which would directly and materially adversely impact upon the physical and mental health and safety of care service residents.
• Identify care service employees and lead to mental and physical abuse.
• Lead to reduction in visiting permitted by relatives to care services, directly impacting the mental health of care service residents and their families.
• Materially adversely impact upon the mental health of employees of care services and, due to the already poor mental health across the sector, could be linked to physical self-harm and suicide.

63. The Registrar General also submitted that subsequent reporting by media, without due regard to context, and resultant exacerbation of Covid-19 stigma, could directly lead to a detrimental impact on mental health.

64. The Registrar General drew attention to the submissions he had received regarding disclosing information without context or further explanation, for example, that many of the deaths took place within the first wave of the pandemic, people being discharged into care home without testing, PPE being in short supply and staff not being trained initially in enhanced protection control measures needed to control the virus.

65. The Commissioner recognises the historical events surrounding the impact of the Covid-19 pandemic on care services and the consequent impact on staff and the public alike. He also acknowledges the media coverage, including those items drawn to his attention by the Registrar General and others, and the impact this has had on the industry, on individuals and on society as a whole. Clearly, these events and the media coverage have caused stress and anxiety in the various groups identified.

66. As mentioned above, however, before section 39(1) of FOISA can be engaged it has to be established that there is a sufficient link between disclosure of the withheld information and the required harm. It has to be established that disclosure - of the withheld information - would at least be likely to lead to the harm referred to by the Registrar General. That such harms may be present already is irrelevant, unless disclosure of this information is likely to have an impact of some significance on the harm in question.

67. The Commissioner has considered the submissions provided on this point. In his view, it does not follow that disclosure of the specific information requested in this case would result in the adverse impacts on the care services, staff members, residents and families claimed by the Registrar General. The Commissioner does not see how the provision of the information requested on its own can be correlated to the harm claimed by the Registrar General, and to make such a connection based on the disclosure of the information requested appears purely speculative.

68. In this case, therefore, the Commissioner is not persuaded by the arguments presented by the Registrar General. In his view, these arguments do not demonstrate why the actual information the Applicant is seeking here would be likely to have any material adverse impact on the established risk of endangerment to the health or safety of individuals. The authority needs to establish a link between disclosure and such endangerment: in all the circumstances of this case, the Commissioner does not find such a link to have been established.

69. Having concluded that disclosure of the withheld information in this case would not, and would not be likely to, endanger the physical or mental health or safety of any person, the Commissioner finds that the exemption in section 39(1) was incorrectly applied to the withheld information by the Registrar General. Having reached this conclusion, the Commissioner is not required to consider the public interest test in relation to this information.

70. The Commissioner acknowledges that any disclosure of similar information by other authorities was a matter for those authorities to decide. It is apparent, however, that those other authorities have not deemed it necessary to withhold similar information. This may reflect the strong public interest in disclosing information relative to this subject matter.

71. Given that the Commissioner has concluded that none of the exemptions applied by the Registrar General can be applied to the withheld information, he finds that the Registrar General was not entitled to withhold the information.

Decision

The Commissioner finds that the Registrar General of Births, Deaths and Marriages for Scotland (the Registrar General) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. The Commissioner finds that the information was incorrectly withheld under all the exemptions claimed, with the result that the Registrar General failed to comply with section 1(1) of FOISA.

The Commissioner therefore requires the Registrar General to provide the information requested to the Applicant by 28 June 2021.

Appeal

Should either the Applicant or the Registrar General wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Registrar General fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Registrar General has failed to comply. The Court has the right to inquire into the matter and may deal with the Registrar General as if he had committed a contempt of court.

Daren Fitzhenry
Scottish Information Commissioner
13 May 2021

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

…

33 Commercial interests and the economy

(1) Information is exempt information if-

…

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A);

…

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in -

(a) Article 5(1) of the UK GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"data subject" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

"personal data" and "processing" have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

…

the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

39 Health, safety and the environment

(1) Information is exempt information if its disclosure under this Act would, or would be likely to, endanger the physical or mental health or the safety of an individual.

…

United Kingdom General Data Protection Regulation

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -

…

(d) disclosure by transmission, dissemination or otherwise making available.

…

(subject to subsection 14(c ) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).

(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.

…

(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4).

---