Decision 024/2018: Mr Daniel Henderson and North Lanarkshire Council Contaminated land reports - names and professions of peer reviewers Reference No: 201702011 Decision Date: 27 February 2018 Summary The Council was asked for the names and professions of staff of an external organisation contracted by the Council to conduct peer reviews of land contamination reports. The Council responded by stating that it was withholding the names requested as personal data and that it did not hold details of the individuals' professions. Following investigation, the Commissioner accepted this.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a) and (c) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(1), (2), (3) and 4(a) (Exceptions from duty to make environmental information available); 11(2), (3) and (4) (Personal data)

Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 5 September 2017, Mr Henderson made a request for information to North Lanarkshire Council (the Council). He referred to a previous meeting with the Council regarding the standard of service provided by the Council in dealing with possible land contamination issues. Mr Henderson made reference to reports submitted to the Council in relation to contaminated sites, which would then be the subject of peer review carried out on the Council's behalf. Mr Henderson stated that if third-party consultant called WSP was involved, he was seeking:

"… a note of the names and professions of the individuals involved. Anonymity is unacceptable and from now on we will be demanding full disclosure - indeed please now provide us with the details (names/professions) of all of the WSP staff who have undertaken Peer Review or any other work in respect of all of the Phase 1 studies we have submitted to NLC."

2. The Council responded on 5 September 2017 and answered a number of points Mr Henderson had raised in his correspondence.

3. On 6 October 2017, Mr Henderson wrote to the Council, requesting a review on the basis that (amongst other things) it had failed to provide the information referred to in paragraph 1 above. He also raised other points, arising out of earlier communications with the Council.

4. Following clarification of certain points by the Council, Mr Henderson wrote to the Council on 17 October 2017 and confirmed he wished a review in relation to the request of 5 September 2017. He provided the Council with a list of contaminated land studies undertaken by his company in the Council's area, confirming that it was peer review work on these studies he was interested in (where undertaken by WSP).

5. The Council notified Mr Henderson of the outcome of its review on 3 November 2017. It informed him that it was withholding the names of relevant WSP staff under regulation 11 of the EIRs, as disclosure would contravene the data protection principles. It also confirmed that it did not hold information on the professions of the staff concerned, applying regulation 10(4)(a) of the EIRs.

6. On 10 November 2017, Mr Henderson wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. Mr Henderson stated he was dissatisfied as the Council had failed to provide the information requested. He stated that he had a legitimate interest in receiving the information and that disclosure would be fair and lawful.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that Mr Henderson made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

8. On 7 December 2017, the Council was notified in writing that Mr Henderson had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr Henderson. The Council provided the information and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions, with particular reference to the provisions of FOISA and the EIRs it considered applicable to the information requested.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Henderson and the Council. He is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

11. It is clear that any information falling within the scope of the request would be environmental information, as defined in regulation 2(1) of the EIRs. The information in question concerns environmental studies connected with the development of land and, as such, the Commissioner is satisfied that it would fall within either paragraph (a) or paragraph (c) of the definition of environmental information in regulation 2(1) of the EIRs (reproduced in Appendix 1 to this decision).

12. Mr Henderson has not disputed the Council's decision to deal with the request under the EIRs and the Commissioner is content to consider Mr Henderson's application in what follows solely in terms of that regime.

Regulation 5(1) of the EIRs

13. Regulation 5(1) of the EIRs (subject to the various qualifications contained in regulations 6 to 12) requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. It is important to bear in mind that this obligation relates to information actually held by an authority when it receives the request, as opposed to information an applicant believes the authority should hold, but which is not in fact held.

14. Under the EIRs, a Scottish public authority may refuse to make environmental information available if one or more of the exceptions in regulation 10 apply and, in all the circumstances of the case, the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.

Regulation 10(4)(a) of the EIRs

15. Regulation 10(4)(a) of the EIRs provides that a Scottish public authority may refuse to make environmental information available to the extent that it does not hold that information when an applicant's request is received. The exception in regulation 10(4)(a) is subject to the public interest test in regulation 10(1)(b) of the EIRs and so can only apply if, in all the circumstances of the case, the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.

16. During the investigation, the Council provided submissions to the effect that the peer review reports provided by WSP did not contain the names or professions of the WSP staff who were responsible. It advised that the staff names were provided separately, but not the professions or qualifications of the staff.

17. The Council provided the Commissioner with submissions describing the enquiries it conducted to ascertain whether the professions of the individuals who conducted the review were held by the Council, concluding that the information was not held.

18. Having considered all relevant submissions and the terms of the request, the Commissioner accepts, on the balance of probabilities, that the Council does not (and did not, at the time it received the request from Mr Henderson) hold the professions of the relevant WSP staff. The enquiries conducted by the Council were adequate and proportionate in the circumstances.

19. As noted in paragraph 15, the exception in regulation 10(4)(a) is subject to the public interest test. In the circumstances, the Commissioner does not consider there to be any conceivable public interest in requiring that any information be made available. He therefore concludes, in all the circumstances of this case, that the public interest in making the requested information available is outweighed by that in maintaining the exception in regulation 10(4)(a) of the EIRs.

20. The Commissioner is satisfied, therefore, that the Council was entitled to apply regulation 10(4)(a) of the EIRs in informing Mr Henderson that it did not hold the professions of the WSP staff who conducted the peer reviews.

Regulation 11(2) of the EIRs - third party personal data

21. The Council submitted that the names requested by Mr Henderson were excepted from disclosure as personal data, under regulation 11(2) of the EIRs.

22. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) excepts personal data where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in Schedule 1 to the DPA (regulation 11(3)(a)(i)). The Council argued that disclosure of the information would breach the first data protection principle.

Is the information under consideration personal data?

23. The definition of "personal data" is contained in section 1(1) of the DPA and is set out below in Appendix 1. Having considered all relevant submissions received, the Commissioner is satisfied that a person's name is the most common way of identifying them. In the context of this particular request, he is satisfied that the names in question can be said to relate to the individuals concerned. As such, the Commissioner is satisfied that the names comprise those individuals' personal data.

The first data protection principle

24. The first data protection principle requires that personal data shall be processed fairly and lawfully. The processing in this case would be making the information available in the public domain, in response to Mr Henderson's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (the full text of the principle is set out in Appendix 1). A condition in Schedule 3 to the DPA will also require to be met if the data are sensitive personal data, as defined in section 2 of the DPA: the Commissioner is satisfied that this is not the case here.

25. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

26. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be made available. If any of these conditions can be met, he must then consider whether making the information available would be fair and lawful.

Can any of the conditions in Schedule 2 be met?

27. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit making the information available to Mr Henderson. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

28. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

a. Is Mr Henderson pursuing a legitimate interest or interests?

b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

c. Even if the processing is necessary for Mr Henderson's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

29. There is no presumption in favour of making personal data available under the general obligation laid down by regulation 5(1) of the EIRs. Accordingly, the legitimate interests of Mr Henderson must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit making the personal data available. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to make the personal data available to Mr Henderson.

Is Mr Henderson pursuing a legitimate interest or interests?

30. The Council submitted that the peer reviews are provided to the Council by WSP - not its employees, the individual authors - under the auspices of a consultancy contract. Responsibility for the veracity of the content lay with WSP, therefore, while the extent to which the advice was relied upon was entirely a matter for the Council.

31. The Council accepted that Mr Henderson would have a legitimate interest in the content of the peer review reports, insofar as the content might impact on him and his clients, but it did not consider this legitimate interest extended to the identities of the individual employees of WSP. Responsibility for any impact on him and his clients lay with WSP or the Council and not with those individuals.

32. In his submissions to the Commissioner, Mr Henderson stated that he, and the public, had a legitimate interest in knowing the names and professions of those who conducted peer reviews as those individuals are making judgements on the contaminated land studies he submitted and the recommendations within them. He considered the competence of the reviewers to be of critical importance, given that errors could result in unnecessary expense for his clients or, at worst, development of contaminated land without satisfactory remediation

33. Mr Henderson further submitted that disclosure would allow him to ascertain if the individuals were members of any relevant professional body, which may require them to comply with ethical and professional standards. Any failure to comply with those standards would mean that a complaint could be logged and investigated. He submitted that knowing the individuals acted on behalf of WSP was not sufficient. He expressed further concerns relating to the processes used by the Council.

34. The Commissioner acknowledges that Mr Henderson has provided his reasons for wishing the information in question, in that he is dissatisfied with the decision making processes within the Council, and in particular its acceptance of the peer reviews provided by a third party organisation.

35. Having considered the information, and all of the relevant submissions, the Commissioner accepts that disclosure might satisfy Mr Henderson's personal interest. However, any dissatisfaction he might have with the Council's processes in this area, including whatever use it makes of peer review, is a matter between him and the Council. To pursue any legitimate concerns he might have, the Commissioner does not believe he requires the names of WSP staff members. Consequently, he is not satisfied that any interest Mr Henderson might have in obtaining the personal data in question could be considered to amount to a legitimate interest in obtaining these personal data for the purposes of condition 6 of Schedule 2 of the DPA.

36. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit the personal data to be made available. In the absence of such a condition, it would be unlawful to make the personal data available. Consequently, the Commissioner finds that the Council would have breached the first data protection principle in making the data available, and so was entitled to withhold the data under regulation 11(2) of the EIRs.

Decision The Commissioner finds that North Lanarkshire Council complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr Henderson.

Appeal

Should either Mr Henderson or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

23 February 2018

 

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

…

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

…

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

10 Exceptions from duty to make environmental information available-

(1) A Scottish public authority may refuse a request to make environmental information available if-

(a) there is an exception to disclosure under paragraphs (4) or (5); and

(b) in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception.

(2) In considering the application of the exceptions referred to in paragraphs (4) and (5), a Scottish public authority shall-

(a) interpret those paragraphs in a restrictive way; and

(b) apply a presumption in favour of disclosure.

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

(4) A Scottish public authority may refuse to make environmental information available to the extent that

(a) it does not hold that information when an applicant's request is received;

…

 

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998[6] that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress) and; in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so; and

(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

(4) The second condition is that by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1) of that Act and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.

…

 
 

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.