Decision 112/2022: Communications about a planning application
Public authority: Scottish Borders Council
Case Ref: 202100758
Summary
The Council was asked for communications relating to a specified planning application. The Council disclosed the communications, but withheld some information, on the grounds that it was the personal data of third parties. The Commissioner found that the Council had partially breached the EIRs in responding to the request. This was because some of the information it had originally withheld was not personal data and some information was not disclosed in full. As the Council disclosed this information to the Applicant during the investigation, the Commissioner did not require the Council to take any action in relation to these breaches.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment)
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definitions of “the data protection principles”, “data subject”, “environmental information” (paragraphs (a) and (c)) “personal data” and “the UK GDPR”) and (3A) (Interpretation); 5(1) and (2)(b) (Duty to make available environmental information on request); 11(2)(a), (3A)(a) and (7) (Personal data)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 22 March 2021, the Applicant made a request for information to Scottish Borders Council (the Council). The information requested was:
… all communications pertaining to Planning and Building Control regarding the development of the land south of St Leonards with respect to planning application 10/00067/FUL within the period from 1 January 2016 to the present day.
2. On 19 April 2021, the Council responded and provided the Applicant with a set of documents with some personal data redacted under regulation 11(2) of the EIRs.
3. On 20 April 2021, the Applicant contacted the Council and expressed dissatisfaction with the disclosed information, arguing that it was incomplete and that some communications were missing. The Applicant also argued that the redaction of personal data had not been done assiduously.
4. The Council responded to the Applicant on 20 April 2021, acknowledging that it had excluded duplicates from the original disclosure, and provided him with another set of documents, including duplicates.
5. On 21 April 2021, the Council contacted the Applicant and asked him to delete the response it had provided to him, noting that it had mistakenly disclosed information to him that should not be in the public domain.
6. The Applicant confirmed that he had deleted this email on 22 April 2021 and asked the Council to provide him with the complete information he had requested, as a matter of urgency.
7. The Council provided the Applicant with an updated response on 23 April 2021. It disclosed the information he had requested, but withheld some information under regulation 11(2) of the EIRs, on the grounds that it was third party personal data which was exempt form disclosure.
8. On 24 April 2021, the Applicant wrote to the Council, requesting a review of its decision on the basis that he did not accept that it had identified and disclosed all of the information captured by his request. He argued that the Council must hold records of telephone and video calls. The Applicant also expressed concern that the information in some documents had been edited rather than redacted.
9. The Council notified the Applicant of the outcome of its review on 20 May 2021. It maintained its position that it had identified all relevant information and, in relation to the suggestion that some documents had been edited rather than redacted, it noted that it had used “white block-out” as well as “black block-out” when redacting the documents.
10. On 21 June 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated he was dissatisfied with the outcome of the Council’s review because he did not accept that the Council had identified all information falling within the scope of his request and was not satisfied that the redactions made by the Council were necessary or required.
Investigation
11. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
12. On 30 June 2021, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant. The Council provided the information and the case was allocated to an investigating officer.
13. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. On 7 October 2021, the Council was invited to comment on this application and to answer specific questions. These related to its reasons for redacting information from the documents disclosed to the Applicant, along with evidence of the searches it had undertaken to identify relevant information.
Commissioner’s analysis and findings
14. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.
Handling in terms of the EIRs
15. The Council considered the Applicant's request under the EIRs, having concluded that the information requested was environmental information as defined in regulation 2(1) of the EIRs.
16. Where information falls within the scope of this definition, a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.
17. The information requested by the Applicant was related to a specified planning application and concerned land development.
18. The Commissioner has considered the terms of the request and the information captured by the request and he is satisfied that the information falls within the definition of environmental information set out in regulation 2(1), in particular, paragraphs (a) and (c) of that definition.
Section 39(2) of FOISA - Environmental information
19. The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs. In this case, the Commissioner accepts that the Council was entitled to apply this exemption to the information withheld under FOISA, given his conclusion that it is properly classified as environmental information.
20. As there is a statutory right of access to environmental information available to the Applicant in this case, the Commissioner accepts, in all the circumstances, that the public interest in maintaining this exemption (and responding to the request under the EIRs) outweighs any public interest in disclosing the information under FOISA. Both regimes are intended to promote public access to information and there would appear to be no reason why (in this particular case) disclosure of the information should be more likely under FOISA than under the EIRs.
21. The Commissioner therefore concludes that the Council was correct to apply section 39(2) of FOISA and consider the Applicant's information request under the EIRs.
Regulation 5(1) of the EIRs - Duty to make environmental information available
22. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. This obligation relates to information that is held by the authority when it receives a request.
23. It is important to bear in mind that this obligation relates to information actually held by an authority when it receives the request, as opposed to information which an applicant believes the authority should hold.
24. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within the scope of the request. Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).
25. During the investigation, the Council reviewed the information it was withholding and it decided to disclose some of the information it had previously withheld under regulation 11(2) of the EIRs. In doing so, it provided the Applicant with a new set of documents that included this additional information.
26. The Council explained that the new set of documents disclosed to the Applicant contained information that had been wrongly withheld. The Council noted that the information that was disclosed included staff names and contact details, the name and contact details of an individual whose name was currently published on the Council’s planning portal and full disclosure of the Applicant’s own personal data, as it provided him with a response under data protection legislation as well as under the EIRs.
27. In his application to the Commissioner, the Applicant contended that the Council had not identified all of the information captured by his information request. He submitted that the Council had failed to provide him with any notes of telephone or video calls and he argued that these must be held. The Applicant also questioned the nature of the redactions, arguing that some information appeared to have been withheld on the grounds of embarrassment, and he raised concerns that some documents appeared to have been edited, rather than redacted.
28. In later correspondence, following the Council’s disclosure on 8 November 2021, the Applicant acknowledged that, while some additional documents had been provided to him, there were some documents, including photographs and drawings referred to in the text, which had not been included. The Applicant submitted that there were at least two pieces of correspondence that he had sent to a named individual at the Council (in relation to the planning application) that were not included in the documentation. The Applicant also reiterated his previous view that the Council must hold notes of phone or video calls even though none had been provided to him. He noted that, in this new set of documents, there had been changes made to the redactions carried out by the Council, but that there were inconsistencies in how these had been applied.
29. The Applicant also argued that there was information on the Council’s planning portal website which was not included in the information disclosed to him, and there were other documents or discussions referred to within the released information that was not included.
30. In order to ascertain whether all relevant information had been identified, the Council was asked to explain the steps it took to establish what information it held that fell within the terms of the Applicant's request.
31. The Council submitted that all officers within the Planning & Regulatory Services Department who had been involved in the planning application process were asked to search for all recorded information, including emails, that fell within the scope of the information request.
32. The Council provided the Commissioner with evidence of the searches undertaken, demonstrating who had carried out searches, what searches they had conducted, and what kind of information, if any, was identified.
33. The Council referred to the two pieces of correspondence that the Applicant claimed he had sent to a named individual at the Council, but which had not been in included in the documents disclosed to him. The Council noted that the two emails referred to by the Applicant were dated 7 February 2021 and 3 March 2021. It submitted that it carried out a search of the information disclosed to the Applicant and identified that the email dated 3 March 2021 was reproduced on pages 36 and 37 of the Building Standards Correspondence it had provided to the Applicant. The Council acknowledged there appeared to have been some formatting issues when reproducing the email, which may have led to difficulty in identifying it.
34. The Council submitted that its search of the disclosed information did not reveal the email of 7 February 2021 in full, but the main content was available on page 100 of the same document (Building Standards Correspondence). The Council acknowledged that, as the top and bottom of this email was missing, it was difficult to identify it from the information disclosed.
35. The Council asked all of its officers to conduct a secondary search of their mailboxes for any information that may have been missed. It provided the Commissioner with a copy of the emails uncovered from this second search, which included full copies of the 7 February 2021 and 3 March 2021 emails along with an attachment.
36. The Council subsequently disclosed full copies of these emails (and attachment) to the Applicant, along with an apology and an explanation for their diminished form in the original disclosure. In this email, the Council also advised the Applicant that this disclosure comprised all of the information it held that fell within the scope of his request.
37. The Council submitted that it could not identify any missing drawings or photographs as highlighted by the Applicant, and that multiple photographs and drawings were included in its response. The Council indicated that the correspondence provided in its response was collated from officers in five separate sections of its Planning Department: Enforcement Officer, Planning Officer, Building Standards Officer, Roads Planning Officer, and Tree Officer.
38. The Council explained that officers dealing with the application received intense levels of correspondence from a few people in regard to the application. They advised that every time they responded to a query, they received an immediate reply to that. This caused the high volume of information which was released. The Council stated that it had conducted a second search for information but this had not unearthed any missing material.
39. The Applicant did not provide the Commissioner with specific examples of the information that was published on the Council’s planning portal but omitted from the documents provided to him. However, the Commissioner would note that the EIRs are not generally used to access information that is already publicly available (such as that published on a Council website), and requests for such information would usually be excepted from disclosure under regulation 6(1)(b) of the EIRs.
40. With regard to the documents or material referred to in the disclosed communications, but not provided to the Applicant, and the drawings and photographs that the Applicant thinks was omitted from the Council’s response, the Commissioner again notes the Applicant’s concerns, but he must advise that the standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities.
41. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.
42. It is clear that the Council’s handling of the Applicant’s request was poor in parts. The initial searches omitted some documents, information was over-redacted and the way that the information was collated and presented resulted in key parts of some emails being accidentally cut off. The Commissioner can understand why the Applicant is questioning the thoroughness of the Council’s searches and the completeness of the disclosure.
43. However, the Commissioner notes that, during the investigation, the Council addressed these mistakes and overall he is satisfied, on the balance of probabilities, that the Council has now identified and disclosed all of the information it holds that falls within the scope of the request.
44. As the Council has acknowledged that it wrongly withheld some information under regulation 11(2) of the EIRs, and it failed to disclose the entirety of some emails, the Commissioner must find that it failed to comply with the requirements of regulation 5(1) of the EIRs, when it withheld information that it later disclosed.
Regulation 10(4)(a) - Information not held
45. Regulation 10(4)(a) of the EIRs states that a Scottish public authority may refuse to make environmental information available to the extent that it does not hold that information when the request is received.
46. As noted above, the standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities.
47. In its submissions the Council stated that it did not hold any record of video or telephone calls that fell within the scope of the Applicant’s information request, and it applied regulation 10(4)(a) of the EIRs to this information.
48. In his requirement for review and his submissions to the Commissioner, the Applicant contended that it was beyond credibility that a public authority, professionally managed, could allow their officers to fail to record notes of conversations that could involve giving advice regarding a planning development. The Applicant noted that the planning application had taken 18 years to come to fruition, and he argued that, as there may be a need to refer back at any time in future years, an accurate contemporaneous record would be essential. The Applicant submitted that, as memories will fade and staff changes will occur throughout the years, due diligence in record keeping is essential and is one of the responsibilities of the Council as Data Custodians.
49. The Council provided the Commissioner with details of the searches and enquiries it undertook to ascertain what information it held falling within the scope of the Applicant's request. These included searches of relevant electronic and paper records, and consultation with relevant staff. The Council provided supporting evidence confirming the outcome of its searches.
50. The Council explained that it does not record telephone or video conversations. It submitted that, while some staff have the functionality to record Teams meetings, it is not Council policy that these meetings are recorded as business as usual. The Council noted that an element of trust is placed on Council officers to ensure that any points raised during video or telephone communications are appropriately actioned and recorded within the relevant system, such as Uniform, which is used widely across Regulatory Services, including Planning.
51. Having considered all relevant submissions and the terms of the request, the Commissioner accepts that the Council has taken adequate, proportionate steps with a view to identifying and locating the information falling within the scope of the Applicant's request, including the existence of any notes of telephone or video calls. The Commissioner notes that the evidence provided by the Council included emails from individual staff confirming that no record of telephone or video communications was held. If the Council did hold any further relevant information, the Commissioner is satisfied that it would have been found by the searches carried out.
52. As mentioned above, the Commissioner can only consider whether information is actually held by the Council, not what information an applicant believes it should hold.
53. Having considered all the relevant submissions, the Commissioner accepts that the Council has now provided the Applicant with all of the information it held at the time of the request. He is of the view that the searches carried out by the Council to identify any information were robust and thorough.
The public interest
54. The exception in regulation 10(4)(a) of the EIRs is subject to the public interest test in regulation 10(1)(b) and so can only apply if, in all the circumstances of the case, the public interest in maintaining the exception outweighs that in making the information available. The question of whether or not a public authority holds information is a factual one, determined on the balance of probabilities. If a public authority does not hold the information, then there is no meaningful public interest test that can be undertaken.
55. In this case, for the reasons set out above, the Commissioner is satisfied that the Council does not hold any further information captured by the information request, including any record of video or telephone calls. Consequently, he accepts that there is no conceivable public interest in requiring the disclosure of such information and finds that the public interest in making information available is outweighed by that in maintaining the exception.
Regulation 11(2) of the EIRs - personal data
56. The Council submitted that the information it had redacted was third party personal data, as it comprised the personal data of the individual it had been corresponding with. As such, the information was considered excepted from disclosure under regulation 11(2) of the EIRs.
57. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in the UK GDPR or in the DPA 2018 (regulation 11(3)(A)(a)).
58. The Council submitted that disclosure would breach the data protection principle in Article 5(1)(a) of the UK GDPR.
59. In his submissions to the Commissioner, the Applicant specifically drew the Commissioner’s attention to a sentence which the Council had redacted under section 11(2) of the EIRs, but which he had previously seen in an unredacted form. He argued that it was not clear why this particular sentence had been redacted, but he expressed concern that the Council had withheld this sentence because the author of the email had asked it to.
Is the withheld information personal data?
60. Personal data are defined in section 3(2) of the DPA 2018 which, read with section 3(3), incorporates the definition of personal data in Article 4(1) of the UK GDPR:
"… any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"
61. The Council's view was that the withheld information related to living individuals and, as its disclosure would identify these individuals, the information must be considered personal data in line with section 3 of the DPA 2018.
62. Having considered the information being withheld, the Commissioner accepts that the information is personal data as it comprises names, contact details, signatures, personal descriptors (including references to the location of their home address) of individuals that would enable someone to identify those living individuals. The information clearly relates to the individuals in question.
63. In addition, the Commissioner has considered the specific sentence which the Applicant has challenged. The Commissioner is satisfied that the withheld sentence contains the views of the author and that it also identifies a third party, by way of geographical location. In the Commissioner’s view, given that it clearly relates to the third parties, the information contains the personal data of third parties.
Would disclosure contravene one of the data protection principles?
64. Article 5(1)(a) of the GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject". The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". In the case of the EIRs, personal data are processed when disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Articles 6(1)(f) of the UK GDPR
65. Among other questions, therefore, the Commissioner must consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
66. The Council was of the view that there was no condition in Article 6 which would allow the personal data to be disclosed. In reaching this conclusion, it considered the application of condition (f) in Article 6(1).
Condition (f): legitimate interests
67. Condition (f) states that processing would be lawful if it "… is necessary for the purposes of the legitimate interests to be pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child".
68. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
69. The tests which must be met before Article (6)(f) can be apply are as follows.
a) Does the Applicant have a legitimate interest in obtaining the personal data?
b) If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
c) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject(s)?
Does the Applicant have a legitimate interest in obtaining the personal data?
70. There is no definition within the DPA 2018 of what constitutes a "legitimate interest ", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on the Personal Data exception in regulation 11 it states:
"In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."
71. The Council acknowledged that the Applicant did have a legitimate interest in the requested information.
72. The Applicant argued that the public (of which he is part) have a right to comment on planning applications which may affect their community, and that there is a clear and legitimate interest in the disclosure of all documents that have a bearing on the processing and approval of any planning application.
73. Having considered the submissions from both the Council and the Applicant, the Commissioner accepts that the Applicant was pursuing a legitimate interest in seeking to understand actions taken by the Council, in so far as they relate to the specified planning application. As such, the Applicant has a legitimate interest in the information requested.
Is disclosure of the personal data necessary?
74. Having accepted that there is a legitimate interest in the withheld personal data, the Commissioner must consider whether disclosure of the personal data is necessary for those legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means.
75. The Commissioner has considered this carefully in the light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner (2013) UKSC 55, In this case, the Supreme Court stated (at paragraph 27):
"… A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less."
76. As the Supreme Court confirmed, "necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities need to consider whether the disclosure is proportionate as a means and fairly balanced as to ends, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
77. The Council was of the view that the Applicant's legitimate interests did not outweigh the interests or fundamental rights and freedoms of the data subject.
The Applicant outlined the information necessary to meet its legitimate interest.
78. Having considered the Applicant's legitimate interests, the Commissioner is not satisfied that disclosure of the withheld personal data is necessary to achieve the Applicant's legitimate interests. In coming to this conclusion, the Commissioner has taken into account the comments made by the Council, the information disclosed already and the description of information the Applicant explained was needed meet his legitimate interests.
79. The Commissioner notes that the information redacted under regulation 11(2) is minimal and in no way does it render any of the correspondence unintelligible, nor does it shield the names of the organisations that are corresponding. The Commissioner considers that the key content of each email has been left intact. He acknowledges that individual names, contact details and personal identifiers (such as comments relating to where individuals live, etc) have been withheld, but he is satisfied that this in no way affects the sense of what has been disclosed or its ability to meet the legitimate interests identified by the Applicant.
80. As the Commissioner is satisfied that the Applicant's legitimate interests can be met without requiring the disclosure of the withheld personal data, he finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied in this case. Accordingly, he accepts that disclosure of the personal data would be unlawful.
Interests or fundamental rights and freedoms of the data subject
81. Given that the Commissioner has concluded that the processing was unlawful, he is not required to go on to consider separately the data subject's interests or fundamental rights and freedoms, and balance them against the legitimate interests in disclosure or to go on to consider whether disclosure would otherwise be fair.
82. In the circumstances of this case, in the absence of a condition of Article 6(1) of the UK GDPR being met, the Commissioner must conclude that disclosure of the withheld personal data would be unlawful and would therefore breach the data protection principle in Article 5(1)(a) of the UK GDPR. Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs.
Decision
The Commissioner finds that Scottish Borders Council (the Council) partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.
The Commissioner finds that by correctly withholding third party personal data under regulation 11(2) of the EIRs, the Council complied with the EIRs.
However, by wrongly withholding some information under regulation 11(2) and by initially failing to provide the Applicant with all of the information he had requested, the Council failed to comply with regulation 5(1) of the EIRs.
Given that the Council has now disclosed this information to the Applicant, the Commissioner does not require the Council to take any action in respect of these failures, in response to the Applicant’s application.
Appeal
Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
27 October 2022
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that –
…
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
…
39 Health, safety and the environment
…
(2) Information is exempt information if a Scottish public authority-
(a) is obliged by regulations under section 62 to make it available to the public in accordance with the regulations; or
(b would be so obliged but for any exemption contained in the regulations.
…
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations –
…
“the data protection principles” means the principles set out in –
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section of that Act):
…
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
…
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
…
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);
…
“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act); and
…
(3A) In these Regulations, references to the UK GDPR and the Data Protection Act 2018 have effect as if in Article 2 of the UK GDPR and Chapter 3 of Part 2 of that Act (exemptions for manual unstructured processing and for national security and defence purposes) -
(a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and
(b) the references to personal data held by such an authority were to be interpreted in accordance with paragraph (2) of this regulation.
…
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
…
(b) is subject to regulations 6 to 12.
…
11 Personal data
…
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -
(a) the first condition set out in paragraph (3A) is satisfied, or
…
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations –
(a) would contravene any of the data protection principles, or
…
(7) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to –
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as –
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) "Data subject" means the identified or identifiable living individual to whom the data relates.
…
(10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
