Decision 016/2019: Condition of a building

Public authority: Glasgow City Council
Case Ref: 201801903

Summary

The Council was asked whether a dangerous and defective building notice been issued to the owners of specified building and for any information on how the Council had "sought to encourage remaining owners to consent to repairs." The Council stated that it did not hold any such notice. It provided some correspondence while withholding some information as it believed disclosure of the personal data would breach the data protection principles.

An application was made to the Commissioner, questioning whether the Council held more information and whether the Council had correctly withheld some information. The Commissioner investigated and was satisfied that the Council had carried out appropriate searches and had correctly withheld personal data.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definitions of "the data protection principles", "the GDPR" and "personal data" and definitions (a) and (f) of "environmental information") and (3A) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(1), (2), (3) and (4)(a) (Exceptions from duty to make environmental information available); 11(2), (3)(A) and (7) (Personal data)

General Data Protection Regulation (the GDPR) Articles 4(11) (definition of "consent") (Definitions); 5(1)(a) (Principles); 6(1)(a) and (f) (Lawfulness)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and 10 (Terms relating to the processing of personal data); Schedule 20 (Transitional provisions etc - paragraph 61)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 19 January 2018, Mr E made a request for information to Glasgow City Council (the Council) ('the first request'). He referred to a specific building and asked "…has a dangerous and defective building notice been issued to the owners who previously expressed an unwillingness to pay?"

2. On 8 February 2018, Mr E sent the Council another request ('the second request') for information relating to the same building. He asked whether a named Council officer had "sought to encourage" remaining owners to consent to repairs. He stated that the named officer "has refused to disclose what form of encouragement he provided them, what questions he raised of them, or what inducements he provided to elicit their disagreement (Mr E's emphasis)." Mr E noted that he had asked the Council officer for this information under the Data Protection Act.

3. The Council responded on 15 February 2018. It informed Mr E that the specified property did not belong to the Council and the Council is not the landlord. Therefore, the Council had no remit for maintenance or upkeep of the building's fabric. The Council did not consider the building dangerous and stated that a dangerous building notice would not be served. The Council explained to Mr E how it had dealt with the various owners.

4. On 26 March 2018, Mr E wrote to the Council requesting a review of its decision on the basis that the Council "had not complied with its own Freedom of Information processes in replying to him" about the dangerous and defective building notice and what form of encouragement was provided to the other owners.

5. Having received no response to his requirement for review, Mr E made an application to the Commissioner on 30 May 2018. The Commissioner's Decision (Decision 097/2018 [1]) for that application required the Council to conduct a review by 6 August 2018.

6. The Council notified Mr E of the outcome of its review on 3 August 2018. The Council responded to Mr E under the EIRs. For the first request, the Council said it did not hold any recorded information as no Dangerous Building Notice had been served for the property: regulation 10(4)(a) of the EIRs therefore applied. For the second request, the Council provided its correspondence with the remaining proprietors, but with personal data redacted under regulation 11(2) of the EIRs.

7. On 2 November 2018, Mr E applied to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. Mr E stated he was dissatisfied with the outcome of the Council's review because he believed the Council held relevant information and that he should also have received the personal data which had been withheld.

Investigation

8. The application was accepted as valid. The Commissioner confirmed that Mr E made requests for information to a Scottish public authority and asked the authority to review its response to those requests before applying to him for a decision.

9. The Council was notified in writing that Mr E had made a valid application and was asked to send the Commissioner the information withheld from Mr E. The Council provided the information and the case was allocated to an investigating officer.

10. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions including justifying its reliance on any provisions of FOISA or the EIRs it considered applicable to the information requested.

11. The Council responded on 17 December 2018. The Council acknowledged that it generally releases personal data relating to officers at Grade 9 and above, and proposed to re-issue the documentation to Mr E to include more personal data of staff at this level. The Council did this on 18 January 2019, re-issuing the information with the inclusion of a Council officer's name. (The Commissioner has not considered this officer's personal data further in what follows.)

12. To assist his case, Mr E also provided comments to the Commissioner.

Commissioner's analysis and findings

13. In coming to a decision on this matter, the Commissioner considered all the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr E and the Council. He is satisfied that no matter of relevance has been overlooked.

FOISA or the EIRs?

14. Mr E has not disputed the Council's decision to handle the request under the EIRs. The Commissioner will consider the information in what follows solely in terms of the EIRs.

15. "Environmental information" is defined in regulation 2(1) of the EIRs (paragraphs (a) and (f) of the definition are reproduced in full in Appendix 1). Where information falls within the scope of this definition, a person has a right to access the information under the EIRs, subject to qualifications and exceptions.

16. The Council submitted that definition of "environmental information" in paragraph (f) of regulation 2(1) of the EIRs includes information on the conditions of "built structures". The Council considered that the information sought by Mr E in relation to a Dangerous Building Notice, and correspondence in relation to repairs to that building, could reasonably be considered environmental information as it related to the condition of a "built structure". The Council also commented that, in reaching this view, it had considered the Commissioner's guidance and previous decisions, in particular Decision 218/2007 Professor A D Hawkins and Transport Scotland [2] which confirmed that the definition of what constitutes environmental information should not be viewed narrowly.

17. The Commissioner has considered the information covered by Mr E's request, and is satisfied that it is environmental information as defined in regulation 2(1) of the EIRs. Given the terms of the request, the Commissioner is satisfied that the information it covers would be environmental information, as defined in regulation 2(1) of the EIRs (paragraphs (a) and (f)).

18. The Commissioner agrees that the information would fall within definition (f) of "environmental information" contained in regulation 2(1) of the EIRs. It relates to the condition of a built structure inasmuch as it may be affected by the state of the elements of the environment referred to in paragraph (a).

19. In terms of regulation 5(1) of the EIRs, a Scottish public authority that holds environmental information is required make it available when requested to do so. This obligation is subject to various other provisions in terms of regulation 5(2)(b), including the exceptions in regulation 10. A Scottish public authority is required to interpret these exceptions restrictively (regulation 10(2)(a)) and apply a presumption in favour of disclosure (regulation 10(2)(b)). All of the exceptions are subject to the public interest test in regulation 10(1)(b).

Regulation 10(4)(a) - Information not held

20. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. This obligation relates to the information held by an authority when it receives a request. The Council applied the exception in regulation 10(4)(a) of the EIRs to Mr E's first request, which asked whether a dangerous and defective building notice had been issued. The exception in regulation 10(4)(a) of the EIRs applies to information which is requested, but which is not held, by the Scottish public authority.

21. The Council explained that, following receipt of Mr E's first request, it responded that no dangerous and defective building notice had been served in respect of the property. A Council officer dealing with the request had had a telephone discussion with Mr E about his concerns. The officer was aware that a Dangerous Building Notice was not required for the property. In the circumstances, the Council was satisfied that it did not hold the information requested and, when responding to Mr E's request for review, gave notice of this in terms of regulation 10(4)(a) of the EIRs.

22. The Council explained that Dangerous Building Notices are served in terms of section 29 of the Building (Scotland) Act 2003. These notices are a matter of public record and the Council publishes standard lists of all properties subject to a Notice [3]. The Council confirmed there was, and is, no record of a Notice in respect of the property Mr E specified.

23. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining this, the Commissioner will consider the scope, quality, thoroughness and results of the searches carried out by the public authority. He will also consider, where appropriate, any reason offered by the public authority to explain why the information is not held.

24. The Commissioner accepts that the Council has conducted an adequate and proportionate appraisal of whether it holds the requested information. The Commissioner notes that the official involved in establishing whether relevant information was held had experience and knowledge of the subject matter of the request and, accordingly, there was less likelihood of relevant information being overlooked. Also (and the Commissioner attributes weight to this) such a notice is required to be published. No such notice is published for the property.

25. In all the circumstances, therefore, the Commissioner is satisfied, that the Council does not (and did not, at the time it received the request from Mr E) hold any information falling within the scope of the first request. If the Council did hold any further relevant information, the Commissioner is satisfied that it would have been found by the searches carried out.

26. The Commissioner's remit here extends only to the consideration of whether the Council actually held the information requested and whether it complied with the EIRs in responding to Mr E's request. The Commissioner cannot comment on the Council's decision that a dangerous or defective building notice was not required for the property.

27. The exception in regulation 10(4)(a) is subject to the public interest test in regulation 10(1)(b) of the EIRs and can only be upheld if, in all the circumstances, the public interest in maintaining the exception outweighs the public interest in making the information available. The Commissioner is satisfied that the Council does not (and did not) hold the information in question. Consequently, he does not consider there to be any conceivable public interest in requiring that the information be made available. The Commissioner therefore concludes that the public interest in making the requested information available is outweighed by that in maintaining the exception in regulation 10(4)(a) of the EIRs.

Regulation 11(2) of the EIRs - Personal information

28. In relation to Mr E's second request, the Council disclosed communications after redacting information that the Council regarded as personal information. The correspondence included information which is Mr E's own personal data; this was disclosed to Mr E under section 7 of the Data Protection Act 1998 (the DPA 1998). As noted, during the Commissioner's investigation, the Council disclosed the personal data of an employee at Grade 9 or above, in terms of the EIRs, but continued to withhold the remaining personal data in the correspondence.

29. Mr E's second request was made on 8 February 2018. Therefore, some information provided to Mr E in terms of the DPA 1998, on 11 May 2018, does not fall within the scope of his request of 8 February 2018 as it was not held by the Council at that date.

Data Protection Act 2018 (Transitional provisions)

30. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amended regulation 11(2) of the EIRs and also introduced a set of transitional provisions, which set out what should happen where a public authority dealt with an information request before the EIRs were amended on 25 May 2018 but where the matter is being considered by the Commissioner after that date.

31. In line with paragraph 61 of Schedule 20 of the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018, the Commissioner must consider the law as it was before 25 May 2018 when determining whether the authority dealt with the request in accordance with the EIRs.

32. The Council responded to Mr E's request on 18 February 2018, but did not issue its review response until 3 August 2018. In this decision, the Commissioner is considering the Council's position as set out in its review response, which post-dates 25 May 2018. The Commissioner will therefore consider whether the Council was entitled to apply the exception in regulation 11(2) of the EIRs as amended by the DPA 2018.

Regulation 11(2) - personal data

33. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.

34. Regulation 11(2) states that public authorities can only make third party personal data available if one of three conditions is satisfied. The first condition (regulation 11(3A)) is that disclosure would not contravene any of the data protection principles in Article 5(1) of the GDPR. In this case, the Council argued that the information was personal data and that disclosure would breach the data protection principle in Article 5(1)(a) of the GDPR.

Is the withheld information personal data?

35. The first question for the Commissioner is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 - see Appendix 1.

36. In the second part of his request, Mr E asked about approaches made by a named Council employee to other owners to encourage them to consent to repairs. The information withheld from the disclosed correspondence includes names, addresses, email addresses and telephone numbers of staff from third party organisations, Council officers and members of the public.

37. The information which has been redacted consists of information such names, addresses, and contact details and the Commissioner accepts that living individuals can be identified from the information, either directly by their names or indirectly, by reference to their relationship to the specific building together with other details in the information already in the public domain.

38. Information will "relate to" a living individual if it is about them, is linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

39. Given the subject matter of the request, the information clearly relates to individuals. The Commissioner is therefore satisfied that the information which has been redacted is personal data.

Which of the data protection principles would be contravened by disclosure?

40. The Council argued that disclosure of the personal data would breach the data protection principle in Article 5(1)(a) of the GDPR. This requires personal data to be processed lawfully, fairly and in a transparent manner in relation to the data subject. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.

Lawful processing: Articles 6(1)(a) and (f) of the GDPR

41. Among other questions, therefore, the Commissioner must consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the GDPR would allow the personal data to be disclosed.

42. The Council took the view that there are no conditions in Article 6 that apply in the circumstances of this case.

43. As noted, Article 5(1) of the GDPR states that personal data should be processed lawfully, fairly and in a transparent manner in relation to the data subject. The Commissioner must therefore consider if disclosure (the processing of the personal data) would be fair, lawful and transparent. In considering lawfulness, he must consider whether any of the conditions in Article 6 to the GDPR would allow the data to be disclosed.

44. The Commissioner considers conditions (a) and (f) of Article 6(1) of the GDPR to be the only conditions which could possibly apply in this case.

Condition (a): consent

45. Condition (a) would allow the Council to disclose the personal data if a data subject has consented to the processing of his or her personal data for one or more specific purposes.

46. "Consent" is defined in Article 4 of the GDPR as -

"… any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."

47. The Council submitted that none of the data subjects have consented to their personal data being released into the public domain. The 14 individuals whose personal data was contained in the disclosed documents consist of employees of the Council, employees of a third party organisation and members of the public. The Council had not specifically sought the consent of these individuals to disclose their personal data to Mr E, nor did the Council have explicit consent from any of the individuals. The Council noted that in his request for information, Mr E did not request personal data of individuals: he sought information on "the encouragement" given to owners in relation to proposed repairs. It submitted that the content of the correspondence had been provided to him, albeit with personal data removed.

48. In the circumstances, the Commissioner is satisfied that condition (a) does not apply.

Condition (f): legitimate interests

49. Under condition (f), the disclosure of the personal data would be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

50. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.

51. The tests which must be met before Article 6(1)(f) can be met are as follows:

(i) Does Mr E have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure of the personal data necessary to achieve that legitimate interest?

(iii) Even if the processing is necessary to achieve that legitimate interest, is that overridden by the interests or fundamental rights and freedoms of the data subjects?

Does Mr E have a legitimate interest in obtaining the information?

52. There is no definition in the GDPR of what constitutes a "legitimate interest". The Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance[4] on section 38 of FOISA states:

In some cases, the legitimate interest might be personal to the requester, e.g. they might want the information in order to bring legal proceedings. For most requests, however, there are likely to be wider legitimate interests, such as scrutiny of the actions of public bodies or public safety.

53. The Council said that it had not specifically asked Mr E whether he has a legitimate interest in obtaining the personal data, commenting that his request did not specify that the information supplied should include personal data. The Council accepted that Mr E may have a legitimate interest in the information, as indicated in his application to the Commissioner where he states that he "requires such information to be made available to discourage a pattern of behaviour that is unlikely to change, unlikely to improve performance…".

54. In his application to the Commissioner, Mr E referred to "a non-disclosure agreement to prohibit releasing the name, job title and organisation of those working in partnership" and stated that any damage and distress caused by disclosure of this information would be outweighed by the public interest in disclosure. He believed that disclosure was necessary to "discourage a pattern of behaviour that is unlikely to change, unlikely to improve performance, unlikely to contribute to any corrective action taken and unlikely to engender openness, transparency and accountability where it matters by discussion on what must be done to repair the building, structure and drains to meet their obligations under the contract".

55. Mr E commented about the importance of information being disclosed given his deep concerns over environmental issues. He also commented that the redacted data may contain information that would assist his case and would be an "important to indicator of underlying intent in law."

56. Having considered the submissions from both the Council and Mr E, the Commissioner is satisfied that Mr E has a legitimate interest in obtaining some of the withheld personal data. He accepts that Mr E (and the general public) has a legitimate interest in information relating to the Council's compliance with its legal obligations and that there is a public interest in understanding the working of Scottish public authorities, which implies there is a legitimate interest in some level of scrutiny. Mr E also has a personal interest in the building in question and, personally, has a legitimate interest in being aware of the actions and communications of employees of the Council (and any third party organisations) in respect of that building. The Commissioner accepts that his legitimate interest would extend to the identities of individuals to whom reference is made in the correspondence.

57. However, the Commissioner is of the view that Mr E's legitimate interest does not, in the circumstances, extend to the personal data of other owners. The Commissioner agrees with the Council that it is not clear from the terms of his request whether Mr E actually required information about the identities of other owners. It is quite possible that Mr E already knows the identities of the other owners.

58. Mr E has not given any arguments as to why he should wish to receive personal data which identifies the other owners. Even if the Commissioner was to accept that Mr E intended to seek disclosure of their identities under FOISA, the Commissioner does not accept that Mr E could be said to be pursuing a legitimate interest in relation to this information. The Commissioner does not accept that disclosing the names of members of the public, or their contact details, renders the Council's process more accountable. Given the lack of evidence, the Commissioner does not accept that Mr E has demonstrated he has a legitimate interest in receiving this particular information under FOISA. As such, condition 6(1)(f) cannot be met for this personal data and disclosure would be unlawful.

Is the disclosure of the personal data necessary to achieve the legitimate interest?

59. Having accepted that Mr E has a legitimate interest in the personal data of Council employees and employees of another organisation, the Commissioner must consider whether disclosure of that personal data is necessary for Mr E's legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means. He must consider these questions in relation to circumstances existing at the time of the review.

60. The Commissioner has considered the submissions from both parties carefully and in the light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[5]. In that case, the Supreme Court stated (at paragraph 27 of the judgment):

"… A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less."

61. As the Supreme Court confirmed, "necessary" means "reasonably" rather than absolutely or strictly necessary. When considering whether disclosure would be necessary, public authorities need to consider whether the disclosure is proportionate as a means and fairly balanced as to ends, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subjects.

62. The basis of the Council's belief was that disclosure of the information was not necessary to achieve Mr E's legitimate interest as he had received the information that he requested, with only names and contact details redacted. In relation to information sent to or from its staff and other third parties, sufficient information remained unredacted in the versions disclosed for Mr E to enable him to identify the department or section of the Council involved in the communication, allowing him to raise any concerns.

63. Mr E wishes to know whether a named Council officer "sought to encourage" other owners to consent to repairs and details of the encouragement or inducements offered to them. Disclosure of data identifying other officials would not have assisted Mr E's understanding of the processes followed and the communications that took place. The Council is correct to highlight that it has disclosed the actual content of the emails - with only a few redactions of personal data from the body of the emails - and sufficient identifying information for Mr E to identify the organisation or department that sent and received the information. The Commissioner is unable to accept that disclosure of the personal data is necessary to achieve the legitimate interest of understanding details of the encouragement or inducements offered to other owners and thereby to scrutinise how the Council has acted, or to raise any concerns with the Council about the subject matter of the correspondence or any actions by Council staff.

64. The above quote from the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner highlights the standard required: a measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim. In the light of the competing arguments from authority and applicant, the Commissioner believes Mr E's legitimate interests can be met in a way which would interfere less with the privacy of these data subjects than providing the withheld information - that is, is the least restrictive - and that is by the provision of the information in the redacted form as the Council has done. The Commissioner accepts that disclosure is not necessary to satisfy Mr E's legitimate interests in this case.

65. As disclosure has not been found necessary, condition (f) in Article 6(1) of the GDPR cannot be met. As no condition in Article 6(1) can be met, disclosure of the personal data would be unlawful.

Fairness

66. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider separately whether disclosure would otherwise be fair and transparent in relation to the data subject.

Conclusion on the data protection principles

67. For the reasons set out above, the Commissioner is satisfied that disclosure of the personal data would breach the data protection principle in Article 5(1)(a) of the GDPR. Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs

Decision

The Commissioner finds that Glasgow City Council (the Council) largely complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by Mr E.

The Commissioner finds that:

• the Council did not hold information and so correctly applied regulation 10(4)(a) and
• disclosure of third party data was not permitted by regulation 11(2) of the EIRs.

Appeal

Should either Mr E or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
8 February 2019

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

"the data protection principles" means the principles set out in -

(a) Article 5(1) of the GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

…

(f) the state of human health and safety, including the contamination of the food chain, where relevant, conditions of human life, cultural sites and built structures inasmuch as they are or may be affected by the state of the elements of the environment referred to in paragraph (a) or, through those elements, by any of the matters referred to in paragraphs (b) and (c);

"the GDPR" and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of the Act (see section 3(10), (11) and (14) of that Act);

"personal data" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

…

(3A) In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing) -

(a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations;

(b) the references to personal data held by such an authority were to be interpreted in accordance with paragraph (2) of this regulation.

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

10 Exceptions from duty to make environmental information available

(1) A Scottish public authority may refuse a request to make environmental information available if-

(a) there is an exception to disclosure under paragraphs (4) or (5); and

(b) in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception.

(2) In considering the application of the exceptions referred to in paragraphs (4) and (5), a Scottish public authority shall-

(a) interpret those paragraphs in a restrictive way; and

(b) apply a presumption in favour of disclosure.

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

(4) A Scottish public authority may refuse to make environmental information available to the extent that

(a) it does not hold that information when an applicant's request is received;

…

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -

(a) the first condition set out in paragraph (3A) is satisfied, or

(b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations -

(a) would contravene any of the data protection principles, or

…

(7) In determining, for the purposes of this regulation, whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

…

General Data Protection Regulation

Article 4 Definitions

For the purpose of this Regulation:

…

11 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

…

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

…

f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to-

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as

…

(d) disclosure by transmission, dissemination or otherwise making available,

…

(5) "Data subject" means the identified or identifiable living individual to whom personal data relates.

…

(10) "The GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

…

Schedule 2 - Transitional provision etc

61 Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Environmental Information (Scotland) Regulations 2004 ("the 2004 Regulations") before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with those Regulations.

(3) To the extent that the request was dealt with before the relevant time -

(a) the amendments of the 2004 Regulations in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with those Regulations, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with those Regulations as amended by Schedule 19 to this Act.

(4) In this paragraph -

"Scottish public authority" has the same meaning as in the 2004 Regulations;

"the relevant time" means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.

---