Decision 007/2018: Scone and District Community Council and Perth and Kinross Council Recording of Development Management Committee meeting Reference No: 201701620 Decision Date: 16 January 2018 Summary The Council was asked for the recording of a Committee meeting that considered a planning application. The Council refused to provide the information as it considered it to be personal data, disclosure of which would breach the data protection principles. The Commissioner investigated and found that the Council had not been entitled to withhold the information on this basis. He required the Council to disclose the withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment)

Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation) (paragraphs (a), (c) and (f) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2) and (3)(a)(i) (Personal data)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I - the principles) (the first and second data protection principles) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 30 June 2017, Scone and District Community Council (SDCC) made a request for information to Perth and Kinross Council (the Council). It referred to planning application 16/02127/IPM (a proposed development at Scone North, Scone) which came before the Council's Development Management Committee on 24 May 2017, when the proceedings of the whole meeting were recorded. SDCC requested a copy of the recording of the proceedings, so that it could maintain a record of all matters associated with the planning application in question.

2. The Council acknowledged SDCC's request on 3 July 2017. It informed SDCC that, as the substance of the request was covered by the definition of environmental information contained in the EIRs, it fell to be properly considered under the EIRs. In doing so, the Council applied the exemption in section 39(2) (Health, safety and the environment) of FOISA.

3. The Council issued a full response on 14 July 2017. It refused to provide the information requested as it considered this to be excepted from disclosure under regulation 11(2) (Personal data) of the EIRs. The Council stated that disclosure would breach the first and second data protection principles contained in the DPA. The Council explained that the meeting had been recorded for training purposes and that attendees had been informed of this. It believed those who were filmed had no reasonable expectation or understanding that the recording would be disclosed into the public domain, and that such disclosure would be incompatible with the purpose for which the recording was made.

4. On 22 July 2017, SDCC wrote to the Council requesting a review of its decision. While acknowledging that attendees from Scone who made deputations were informed that the meeting was to be recorded, SDCC argued that no notice was given regarding the use of the recording. Given that the recording was announced in advance of it being made, SDCC did not believe disclosure would breach the first and second data protection principles.

5. The Council notified SDCC of the outcome of its review on 17 August 2017, upholding its decision in full, with further explanation.

6. On 6 September 2017, SDCC wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. SDCC stated it was dissatisfied with the outcome of the Council's review as it believed regulation 11 of the EIRs had been wrongly applied: it did not believe disclosure would breach the first and second data protection principles.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that SDCC made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

8. On 3 October 2017, the Council was notified in writing that SDCC had made a valid application. The Council was asked to send the Commissioner the information withheld from SDCC. The Council provided the information and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions, with particular reference to its application of regulation 11(2) of FOISA.

10. As the Council was withholding the information under the exception in regulation 11(2) of the EIRs, SDCC was also invited to comment on its legitimate interest in obtaining the information.

11. Both parties provided submissions to the Commissioner.

12. During the investigation, SDCC refined its request to that part of the recording where the meeting considered planning application 16/02127/IPM. Accordingly, in what follows, the Commissioner will consider whether the Council was correct to withhold that part of the recording under regulation 11(2) of the EIRs.

Commissioner's analysis and findings

13. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both SDCC and the Council. He is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

14. In this case, the Council informed SDCC that the information under consideration here was environmental, as defined in regulation 2(1) of the EIRs. The Council applied section 39(2) of FOISA to the withheld information.

15. Where information falls within the scope of the definition in regulation 2(1), a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.

16. Having considered the nature of the withheld information, the Commissioner is satisfied that it is all environmental information as defined within regulation 2(1) of the EIRs. SDCC has asked for the recording of a meeting which considered a major planning application for a proposed housing development. The Commissioner considers it would fall within paragraphs (a), (c) and (f) of the definition of environmental information (reproduced in Appendix 1). SDCC has not disputed the Council's decision to handle the request under the EIRs.

Section 39(2) of FOISA - Environmental information

17. The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs. In this case, the Council provided submissions solely in terms of the EIRs, on the basis that it was applying section 39(2) of FOISA. The Commissioner accepts that the Council was entitled to apply this exemption to the withheld information, given his conclusion that it is properly classified as environmental information.

18. As there is a statutory right of access to environmental information available to SDCC in this case, the Commissioner accepts, in all the circumstances, that the public interest in maintaining this exemption (and responding to the request under the EIRs) outweighs any public interest in disclosing the information under FOISA.

19. The Commissioner therefore concludes that the Council was correct to apply section 39(2) of FOISA and consider SDCC's information request under the EIRs. In what follows, he will consider the information solely in terms of the EIRs.

Regulation 5(1) of the EIRs

20. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. This obligation relates to information that is held by the authority when it receives a request.

21. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds and which falls within the scope of the request. Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in any of regulations 6 to 12 applies.

22. Under regulation 10(3) of the EIRs, a public authority shall only make personal data (which is also environmental information) available in accordance with the provisions of regulation 11.

23. In its submissions, the Council confirmed that it wished to rely on regulation 11(2) in respect of the withheld information.

Regulation 11(2) - Personal data

24. Regulation 11(2) of the EIRs states that, to the extent that environmental information includes personal data of which the applicant is not the data subject, a public authority shall not make it available where either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies.

25. The Council's arguments in this case relate to those parts of the first condition that would apply, where making the information available would contravene any of the data protection principles. In order for a Scottish public authority to rely on this exception, it must show that:

(i) the information is personal data for the purposes of the DPA, and

(ii) making it available would contravene at least one of the data protection principles laid down in Schedule 1 to the DPA.

Is the withheld information personal data?

26. Personal data" are defined in section 1(1) of the DPA as:

"data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

27. The Council submitted that the recording contained information about identifiable, living individuals. It noted that SDCC had not questioned this.

28. The Commissioner has considered the submissions received from the Council on this point, together with the withheld information. It clearly identifies parties attending, in various capacities, the meeting which considered planning application 16/02127/IPM. In line with the Council's submissions, he is satisfied that the information comprises personal data. Living individuals can be identified from the data, to whom the data (in recording their activities) can be said to relate. It is therefore those individuals' personal data, as defined by section 1(1) of the DPA.

29. As indicated above, the Commissioner considers all of the withheld information to be the personal data of the individual(s) to whom they relate. In the circumstances, given the terms of the request and the actual information held, he does not consider it would be possible to disclose any of the withheld information without a real risk remaining that the individual(s) could be identified: consequently it would remain their personal data.

Would disclosure contravene any of the data protection principles?

30. In its submissions, the Council argued that disclosure of the withheld personal data in question would contravene the first and second data protection principles.

The first data protection principle

31. The first data protection principle requires that personal data are processed fairly and lawfully. The processing in this case would be the disclosure of the information into the public domain, in response to SDCC's request.

32. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met. The Council has confirmed, and the Commissioner is satisfied, that the personal data under consideration here are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for him to consider the conditions in Schedule 3.

33. The Council informed the Commissioner that those present consented to the meeting being recorded for the purpose of training for Councillors. The prospect of wider disclosure of the recording into the public domain was not raised with elected members, officers or members of the public in attendance. Consequentially, the Council considered that disclosure of the recording would breach the first data protection principle.

34. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, he must then consider whether disclosure of the information would be fair and lawful.

35. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

36. Condition 1 applies when the data subject (i.e. the individual to whom the data relate) has consented to the disclosure of the information. SDCC understood a number of those present at the meeting had given their consent to disclosure.

37. The Council submitted it had not asked any of the data subjects for their consent to disclosure of the information under the EIRs. It had considered this option, but had concluded that it would be unreasonable to do so in the circumstances.

38. To support its position on this point, the Council provided the Commissioner with a copy of its Standing Orders, paragraph 13 of which prohibits the recording of proceedings. In this instance, the Council explained, the Standing Orders were suspended temporarily to permit the recording for the purpose of training new Councillors. The Council submitted that this was documented at point 294 of the minute of the meeting[1] published on its website.

39. The Council submitted that the recording of meetings for the purpose of training Councillors had been previously discussed with all elected members. The Council meeting the previous week had been recorded and the matter had been raised at the pre-Agenda meeting.

40. The Council explained that members of the public attending the meeting had been asked verbally to give specific consent to the recording for training purposes. In this regard, the Council provided the Commissioner with a sample of the consent form these individuals had been asked to complete. The Council admitted, however, that the form signed did not match the verbal explanation given when seeking consent. The Council further explained that officers present were not asked for consent as they were bound by the decision of the Committee to permit the recording.

41. In the circumstances, the Council considered it would be unreasonable to seek to extend the attendees' consent beyond the original purpose (i.e. for the training of Councillors), since wider disclosure would be contrary to the Committee's original decision.

42. The Council believed the appropriate course of action would be to seek Committee approval to a change of purpose, and thereafter seek the officers' and attendees' consent to disclosure. The Council considered this approach and decided it was unreasonable, given that the meeting was held in public and, in particular, that SDCC representatives were present there.

43. In its submissions to the Commissioner, SDCC agreed that attendees at the meeting were asked if they objected to the meeting being recorded, and there had been no objections. It argued, however, that no mention had been made at the time that the recording was being made "for training purposes only", and that this could be ascertained by listening to the recording of the meeting.

44. The Commissioner has fully considered the submissions on this point made by both parties, along with the withheld information. He has viewed the relevant part of the recording which covers attendees being asked to give their consent to the recording being made, and has taken account of the supporting evidence provided by the Council, namely its Standing Orders and the sample consent form.

45. While it may well be the case that attendees were informed verbally of the recording's purpose, the Council has been unable to provide the Commissioner with any recorded evidence to support this position. The consent form completed by members of the public contains no information about the recording's purpose, and neither does the recording itself, despite the entry at point 294 of the published minute of the meeting which states that "…the Committee agreed to record the meeting for training purposes". However, the Commissioner notes that the matter of training for new Councillors was discussed at an early stage of the meeting, and the Council's Standing Orders stipulate that meetings are not recorded unless the Council decides otherwise. In the circumstances, the Commissioner considers it is reasonable to accept that training was the intended purpose of the recording, but that not all those present were informed of that purpose.

46. The Commissioner is satisfied that while consent to the recording taking place was sought from, and given by, attendees, this did not extend to giving consent to disclosure of the information under the EIRs.

47. In considering the data subjects' consent to the disclosure of their personal data under the EIRs, the Commissioner must be satisfied that this consent was specific to the circumstances, fully informed and freely given. The data subject must be fully aware of the implications of public disclosure of their personal data under the EIRs, which is - effectively - a disclosure "to the world". In this case, having considered the submissions he has received, the Commissioner is satisfied that the Council did not seek or obtain consent from the data subjects to disclosure of their personal data under the EIRs.

48. Accordingly, the Commissioner is not satisfied that condition 1 is met in this case.

49. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only other one which might permit disclosure of the information to SDCC. In any event, neither SDCC nor the Council has argued that any other condition would be relevant.

50. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

51. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does SDCC have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for SDCC's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

52. There is no presumption in favour of disclosure of personal data under the general obligation laid down by regulation 5(1) of the EIRs. The legitimate interests of SDCC must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to SDCC.

Does SDCC have a legitimate interest in obtaining the personal data?

53. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is merely inquisitive. In the Commissioner's guidance on personal data[2], published on his website, it states:

"In some cases, the legitimate interest might be personal to the requester - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

54. In its submissions to the Commissioner, SDCC explained it was a statutory consultee of planning applications and, as such, it represented constituents in the area. The Council's Committee meeting which considered the planning application was held during normal working hours and so many constituents could not attend. SDCC stated it had been asked by constituents to describe the events which led to the approval of a development it described as unpopular. Having access to the recording would allow SDCC to make accurate statements about this.

55. The Council informed the Commissioner that, while it had not asked SDCC if it had a legitimate interest in obtaining the information, it considered it did so. The Council accepted that SDCC had a specific interest in matters discussed at the meeting.

56. The Commissioner has considered all the relevant submissions he has received on this point, along with the withheld personal data.

57. The Commissioner accepts that SDCC has a legitimate interest in the withheld information, as disclosure would provide some transparency about the matters discussed by the individuals involved when considering the planning application in question. Given that the Council considered the application to be a major planning application (as stated in the Council's published minute of the meeting), this is - at least potentially - a matter of wider public interest, a point which the Commissioner is satisfied is relevant in this case for the purposes of determining whether SDCC has a legitimate interest.

58. The Commissioner acknowledges that making the recording available would help those who could not attend the meeting acquire a better understanding of what was discussed and determined there. In all the circumstances, therefore, he accepts that SDCC has a legitimate interest in obtaining the withheld personal data.

Is disclosure necessary to achieve those legitimate interests?

59. The Commissioner must now go on to consider whether disclosure of the withheld personal data would be necessary to meet the legitimate interest he has identified above. As already indicated, this will include consideration of whether the legitimate interest might be met by alternative means which interfere less with the privacy of the data subjects.

60. In its submissions to the Commissioner, SDCC referred to the Scottish Government website[3] which describes the primary purpose of community councils as "…to ascertain and express the views of the community to the local authority and other public bodies". To comply with this, SDCC submitted, it required access to all public information relating to its area, in order to credibly inform its constituents and allow them to arrive at informed opinions, which SDCC could then represent. Given the meeting in question was an open public meeting, SDCC believed the information requested fell into this category.

61. Furthermore, as this was a public meeting where elected public servants made decisions affecting the lives of constituents, SDCC believed Councillors should be prepared to stand by their decisions and be accountable for them.

62. In its submissions, the Council confirmed that the meeting had been open to the public and that no part of the meeting had been held in private. However, it questioned the necessity of disclosure of the recording to meet SDCC's legitimate interests, given the attendance of its representatives at the meeting, and noting that Council meetings are not normally recorded. It argued that, on any other occasion, SDCC would have had to rely completely on the recollection of attendees at the meeting, in conjunction with any related media reports and/or the published minute of the meeting.

63. In this case, the Commissioner has carefully considered all relevant submissions he has received, along with the withheld information. He has also examined the minute of the meeting published on the Council's website. It is clear to the Commissioner, having viewed the relevant part of the recording, that a number of points discussed at the meeting are not included in the minute. While it is not for the Commissioner to comment on what level of detail ought to be minuted, it is a matter of fact that there is further information in the recording that is not otherwise publicly available.

64. It does not appear to the Commissioner to be relevant what the position might be if the recording did not exist. If that were the case, the request would not have been made and none of the issues rehearsed up to this point would arise. In the circumstances of this particular case, as opposed to those surrounding some other meeting to which the present request does not relate, the non-existence of the recording is a hypothetical situation which the Commissioner is not required to address. The recording does exist and it is on that basis that the Commissioner must consider SDCC's legitimate interest and whether disclosure of the recording is necessary to meet that legitimate interest.

65. In the circumstances, the Commissioner accepts that the legitimate interest in transparency he has identified above cannot be met in full without disclosure of the withheld personal data. To that extent, disclosure is necessary to meet the legitimate interests he has identified.

Would disclosure nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

66. The Commissioner must now therefore go on to consider the interests of the data subjects, and whether disclosure would be unwarranted by reason of prejudice to their rights and freedoms or legitimate interests. As noted above, this involves a balancing exercise between the legitimate interests of SDCC and those of the data subjects. Only if the legitimate interests of SDCC outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

67. The Council submitted that officers present had expressed disquiet at the thought of the recording being disclosed. Consequently, the Council considered that disclosure of the personal data was likely to be an unwarranted prejudice to their rights and freedoms.

68. In its submissions, SDCC stated that attendees at the meeting were all asked if they had any objection to the meeting being recorded. It argued that no mention was made of this being for "training purposes only" at that time, as could be ascertained by listening to the recording. SDCC submitted that no objections to the recording were raised.

69. SDCC could not comprehend why proceedings of a public meeting should be categorised as excepted from disclosure under regulation 11 of the EIRs, where the information had already been shared at the meeting.

70. The Commissioner has taken into account the submissions by both parties, and of his own briefing on personal information, published on his website[4]. In his briefing, the Commissioner notes a number of factors which should be taken into account in carrying out the balancing exercise referred to above. These include:

· whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

· the potential harm or distress that may be caused to the individual by disclosure;

· whether the individual has objected to the disclosure; and

· the reasonable expectations of the individual as to whether the information would be disclosed.

71. The Commissioner notes that those attending the meeting did so in relation to their public life (i.e. as a Council employee or elected members). He further notes that those making deputations were doing so in public, at a meeting which considered Council business (in this case planning applications). Indeed, all of those individuals are identified in the minute of the meeting published on the Council's website. As such, these individuals have all been publicly identified in connection to the matters discussed at the meeting, as set out in the minute.

72. The Commissioner also notes that the meeting was an open public meeting and that no part of the meeting was held in private. In essence, therefore, the information contained in the recording had already been made public. The information does not appear to identify members of the public not directly engaged in business at the meeting: even if any such individuals can be identified, they simply appear on the recorded footage and do not speak or take any other part in the meeting.

73. The Commissioner notes the Council's submissions that meetings are not normally recorded and that in normal circumstances, the recollections of those present at the meeting, subsequent media reporting or the minute of the meeting would have to be relied on for information on what was discussed or determined. In this case, however, the information exists in the form of the withheld recording, which contains a great deal more information than has been made available in the published minute. The recording exists and the Commissioner must consider the impact of its disclosure on the rights, freedoms or legitimate interests of the data subjects: as discussed above, he cannot simply dismiss the recording's relevance because it would not usually exist.

74. The Commissioner has considered the Council's submissions that those present would have had no expectation of wider disclosure of the information in question. However, it is a matter of fact that:

· the meeting was an open public meeting, which was simultaneously broadcast to members of the public in the Council's Civic Hall;

· the minute, although concise, is in the public domain and identifies those present and in attendance, and

· the planning application in question is described therein as a "major application".

75. Even if any of those present have expressed disquiet at the possibility of disclosure, the Commissioner needs to consider whether that disquiet should be considered reasonable in all the circumstances. Even if it were, it is simply one factor to be taken into account in the balancing exercise, bearing in mind the level it would be reasonable to ascribe to that disquiet (which no-one appears to be suggesting is in the region of distress or alarm).

76. Taking regard of all these factors, the Commissioner is of the view that the legitimate interest in disclosure outweighs any prejudice to the rights, freedoms and legitimate interests of the data subjects. He cannot see how these would be compromised in any way by disclosure of the withheld information. This was a public meeting relating to a public process, which was simultaneously relayed to members of the public outwith the meeting room. Elected members and officers were participating in a "professional" capacity and it is clear, from the recording, that the information recorded reveals nothing about any of them which could be regarded as private. Those making deputations were taking advantage of the statutory opportunity afforded to them to participate in this public process and, regardless of the intended purpose of the recording, the Commissioner does not consider any of those involved could be said to have a reasonable expectation that any record of the proceedings would be kept private. From the submissions provided, it is difficult to see why anyone involved should have a reasonable need to express disquiet at the prospect of disclosure.

77. On balance, therefore, the Commissioner is not satisfied that disclosure of the withheld personal data would be unwarranted by reason of prejudice to the data subjects' rights and freedoms or legitimate interests. He would therefore conclude that SDCC's legitimate interests should prevail and that the requirements of condition 6 can be said to be met in this particular case.

Fair and lawful processing

78. As indicated above, the Commissioner must be satisfied that disclosure would be fair and lawful, in addition to the application of any relevant Schedule 2 conditions, before concluding that disclosure would be consistent with the first data protection principle.

79. The Council submitted that disclosure would be unlawful, but only in the absence of a Schedule 2 condition permitting disclosure. As the Commissioner has found a Schedule 2 condition which would permit disclosure, he need not consider the question of lawfulness further.

80. The Council also argued that disclosure would be unfair. It considered the data subjects had no reasonable expectations that their personal data would be disclosed into the public domain. It would be unfair, in the Council's view, to breach those reasonable expectations. In essence, this argument has been considered already in relation to the application of condition 6 and the Commissioner does not find it necessary to consider it further at this point.

81. On the arguments he has received, therefore, the Commissioner is satisfied that disclosure of the withheld personal data would be both fair and lawful.

82. The Commissioner therefore finds, in the circumstances of this particular case, that disclosure of the withheld information (i.e. that part of the recording which considered planning application 16/02127/IPM) would not breach the first data protection principle.

The second data protection principle

83. The Council also argued that the second data protection principle would be breached by disclosure of the withheld personal data. The second data protection principle requires that personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

84. The Council submitted that, as the recording was made for the specified and declared purpose of training for elected members, it did not consider disclosure into the public domain to be a compatible, secondary purpose.

85. The Commissioner acknowledges that the interpretation provisions relating to the second principle (Part II of Schedule 1, paragraph 6) state that "the purpose or purposes for which the personal data are intended to be processed by any person to whom they are disclosed" should be taken into account in determining whether any disclosure of personal data is compatible with the purpose or purposes for which the data were obtained. On the other hand, the Commissioner also considers it appropriate to take into account what the UK Information Commissioner (the ICO) has to say on the relevance of the second principle to disclosures under Freedom of Information legislation, in her guidance: "Personal information (section 40 and regulation 13)"[5]:

We consider that a FOIA disclosure that complies with the DPA in other respects will not breach the second principle. The "specified and lawful purposes" are the public authority's business purposes, i.e. the purposes for which it obtains and processes data. Disclosure under FOIA is not a business purpose. A public authority does not have to specify, either when it obtains personal data or in its notification to the Information Commissioner as a data controller under the DPA, that the personal data may be disclosed under FOIA. Furthermore, the aim of FOIA is to promote transparency and confidence in public authorities. So, if disclosure would be fair and lawful under the first principle, and the information is not exempt under another FOIA exemption, then that disclosure cannot be incompatible with the public authority's business purposes.

86. Given the ICO's overarching responsibility for ensuring compliance with the DPA across the whole of the United Kingdom, the Commissioner must give considerable weight to this guidance. He has been given, and can identify, no particular reason why he should depart from it in this case. He has found that disclosure would be fair and lawful for the purposes of the first principle, bearing in mind the purpose for which the information was gathered and the likely impact of disclosure, and it is not suggested that any other EIRs exception would be applicable here. In all the circumstances, therefore, he is not satisfied that the Council was entitled to claim that the second data protection principle would be breached by disclosure of the withheld personal data.

87. As he is not satisfied that disclosure of the withheld personal data would breach either the first or the second data protection principle, the Commissioner must find that the Council was not entitled to withhold the information under regulation 11(2) of the EIRs.

Decision The Commissioner finds that Perth and Kinross Council (the Council) failed to comply with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by Scone and District Community Council (SDCC). The Council was not entitled to withhold the information requested under regulation 11(2) (Personal data) of the EIRs and, in so doing, failed to comply with regulation 5(1) of the EIRs. The Commissioner therefore requires the Council to disclose the withheld information to SDCC by 2 March 2018.

Appeal

Should either Scone and District Community Council or Perth and Kinross Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If Perth and Kinross Council (the Council) fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

16 January 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

…

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

…

39 Health, safety and the environment

…

(2) Information is exempt information if a Scottish public authority-

(a) is obliged by regulations under section 62 to make it available to the public in accordance with the regulations; or

(b) would be so obliged but for any exemption contained in the regulations.

…

The Environmental Information (Scotland) Regulations 2004

 

2 Interpretation

(1) In these Regulations -

…

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

…

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

(f) the state of human health and safety, including the contamination of the food chain, where relevant, conditions of human life, cultural sites and built structures inasmuch as they are or may be affected by the state of the elements of the environment referred to in paragraph (a) or, through those elements, by any of the matters referred to in paragraphs (b) and (c);

…

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

10 Exceptions from duty to make environmental information available-

…

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

…

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998[6] that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

…

 

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

…

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

…

---