Decision 034/2015: Mr Z and Dumfries and Galloway Council Building works at a property Reference No: 201401885 Decision Date: 16 March 2015 Summary On 13 February 2014, Mr Z asked Dumfries and Galloway Council (the Council) for a variety of information concerning work carried out at a residential property. The Council responded by disclosing some information but withholding other information under the EIRs. Following a review, Mr Z remained dissatisfied and applied to the Commissioner for a decision. During the investigation, the Council disclosed most of the withheld information but continued to withhold a document which was an internal communication. It also continued to withhold some information on the grounds that it was personal data and disclosure would breach the data protection principles. The Commissioner investigated and found that the public interest test favoured disclosure of the information in the internal communication. She also found that the Council correctly withheld the personal data.

  Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a) and (c) of definition of "environmental information"); 5(1), (2)(a) and (2)(b) (Duty to make available environmental information on request); 10(1), (2), (3) and (4)(e) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (3)(b) (Personal data)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (the data protection principles, Part 1: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

  Background

1. On 13 February 2014 Mr Z made a request for information to the Council. He listed a number of items he required, all relating to building warrants and associated compliance issues in respect of a specified residential property.

2. The Council responded on 16 June 2014, under the EIRs. It supplied some information to

Mr Z. It also explained to Mr Z why it considered some of the information to be personal data (which it was withholding under regulation 11(2) of the EIRs) and some to be internal communications (withheld under regulation 10(4)(e)). The Council did not consider it to be in the public interest to disclose the withheld information in the internal communications. It also apologised for aspects of its handling of the request.

3. On 19 June 2014 Mr Z wrote to the Council requesting a review of its decision. He was dissatisfied that the response was late and was dissatisfied with the apology. He also considered the information supplied to him was incomplete. He gave details of what he thought ought to have been provided to him.

4. The Council notified Mr Z of the outcome of its review on 17 July 2014. It decided to disclose more information, previously withheld under regulation 10(4)(e), but continued to withhold information under both the exceptions applied originally. It confirmed that it had carried out additional searches but had located no further information. In this connection, it explained that some emails would have been deleted due to the passage of time.

5. On 22 July 2014 Mr Z wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. Mr Z stated he was dissatisfied with the outcome of the Council's review because he believed the response was incomplete. He questioned whether the deletion of records had been in accordance with FOISA, noting the time taken to respond to the request in the first instance. He also challenged the Council's decision to continue withholding some information.

  Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Z made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 5 August 2014, the Council was notified in writing that Mr Z had made a valid application. The Council was asked to send the Commissioner the information withheld from him. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of the EIRs it considered applicable to the information requested.

  Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both

Mr Z and the Council. She is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

10. It is apparent from the Council's correspondence with both Mr Z and the Commissioner that any information falling within the scope of the request would be environmental information, as defined in regulation 2(1) of the EIRs. Having considered the terms of the request and this correspondence, the Commissioner is satisfied that it would fall within either paragraph (a) of the definition of environmental information contained in regulation 2(1) (as information on the state of the elements of the environment) or paragraph (c) of that definition (as information on measures affecting or likely to affect those elements). Mr Z has not disputed this and the Commissioner will consider the information in what follows solely in terms of the EIRs. 

Regulation 5(1) of the EIRs

11. Regulation 5(1) of the EIRs (subject to the various qualifications contained in regulations 6 to 12) requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant

Has all relevant information been identified?

12. In his application to the Commissioner, Mr Z explained why he thought more information should have been supplied to him. He indicated the types of documents he expected to have been provided, suggesting that this might include information in particular complaints files. During the investigation, the Council was required to provide details of the searches it had conducted and explain why it considered these to be capable of identifying all the information Mr Z requested. It was also asked to provide further details of the deletion of emails.

13. The Council submitted that Mr Z's perception of its building control function differed from the reality, with the result that much of the information he expected to be held was not in fact held. In the Council's view, he expected an outcome it was unable to assist with. It submitted that nothing had been destroyed following receipt of the request and given the nature of its role in the matter, the project file was relatively small.

14. Although the actual response was delayed, the Council submitted that the relevant searches were undertaken between 6 and 8 March 2014 (i.e. within the 20 working days allowed for responding to the request). Further searches were carried out at the review stage.

15. The Council did not consider the complaints files identified by Mr Z to fall within the scope of this request, as the complaint in question related to the "building control personnel dealing with this case". Having considered the terms of the request, the Commissioner accepts this as a reasonable conclusion.

16. The Council explained it had searched its paper file systems. It indicated that the information contained in these was limited, and typically duplicated records in its electronic building standards database. The electronic database was the main repository for the type of information Mr Z described in his request, and it was also searched. The Council explained that anything deemed a record (and therefore of significant relevance to the case) would be filed here. In addition, all staff involved in the case searched their own email files.

17. The Council confirmed there was no authorisation process governing the deletion of building standards emails and that it was possible for IT staff to recover emails up to three months after deletion. It explained that the professional staff involved were experienced and aware of when they needed to transfer information of any significance to the database described above. Staff were also required to undertake regular "housekeeping" exercises in their email files. In the circumstances, the Council was satisfied that relevant information was transferred to the database as a matter of routine. Given the nature of its role, it was satisfied that the record for this case contained everything it would expect.

18. The Council remained of the view that all relevant emails had been located and provided.

19. Having considered all relevant submissions, the Commissioner accepts that the Council took adequate, proportionate steps to establish what information it held falling within the scope of the request. She accepts, on balance, that any information relevant to the request was capable of being identified using the searches described by the Council.

20. The Commissioner has no locus to comment on whether more information should have been held by the Council, the question she must consider in this case is: had what was held located and treated appropriately under the EIRs? She is satisfied it was.

21. The Commissioner must now consider the Council's application of regulations 10(4)(e) and 11(2).

Regulation 10(4)(e) of the EIRs (internal communications)

22. Under the EIRs, a Scottish public authority may refuse to make environmental information available if one or more of the exceptions in regulation 10 apply and, in all the circumstances of the case, the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available. The authority must interpret each exception in a restrictive way and apply a presumption in favour of disclosure.

23. Under regulation 10(4)(e), a Scottish public authority may refuse to make environmental information available to the extent that it involves making available internal communications. In order for information to fall within the scope of this exception, it need only be established that the information is an internal communication. Only if the Commissioner decides that a document is an internal communication will she be required to go on and consider the public interest test.

24. The withheld information under consideration is contained in document 13. This document consists of an email which shows clearly the respondent's and the sender's details, confirming it comprises internal communications within the Council. The Commissioner is satisfied that exception 10(4)(e) applies to the withheld information.

The public interest test

25. Mr Z commented in detail on the effects of the works on his own property and the associated insurance claim he had made to the Council. He highlighted what he perceived as difficulties in dealing with the Council, which he believed reinforced the need to scrutinise all the relevant recorded information it held.

26. In favour of disclosure, the Council said it considered the importance of demonstrating openness and transparency in how it arrived at decisions. Disclosure would also show the accountability of the officers involved and evidence the considerations taken into account by staff in their contribution to given circumstances (including relevant risks, issues and solutions). Ultimately, in the Council's view, this related to making the best decision for the public purse.

27. In support of withholding the information, the Council identified the likely inhibiting effect of disclosure on its staff sharing their views in writing. This was important to the decision-making process and, in situations such as this, there was a need to consider all relevant risks, issues and solutions, openly and frankly. It submitted that document 13 contained blunt but honest options, intended to handle the situation in question with a view to reaching the best decision for the public purse.

28. In considering the public interest test, the Commissioner is mindful that regulation 10(2)(b) requires Scottish public authorities to apply a presumption in favour of disclosure. There is, clearly, a public interest in understanding how the Council handles issues of this kind, given their potential impact on the public purse.

29. The Commissioner must consider the content of the information and the context in which it was created. It is written by a senior official of the Council, following the conclusion of a formal process. Views are expressed firmly, but also in a measured and considered fashion. In the circumstances, the he Commissioner does not believe an officer of this seniority would be dissuaded by disclosure, at least to the degree the Council suggests, from writing in this way in similar circumstances in the future.

30. Consequently, having weighed up all relevant submissions and other considerations, the Commissioner finds that the public interest in making this information available is not outweighed by that in maintaining the exception in regulation 10(4)(e). She therefore concludes that the Council was not entitled to withhold this information from Mr Z, although there may be arguments for withholding any personal data contained within it: the Commissioner goes on to consider this below.

Regulation 11(2) - Personal data

31. Where the environmental information requested in any given case includes personal data, the authority can only make those data available in accordance with regulation 11 of the EIRs.

32. The Council disclosed the names of employees to Mr Z but withheld the names and contact details of other individuals as their personal data, under regulation 11(2) of the EIRs. Regulation 11(2), as applied in this case, means that personal data cannot be made available where doing so would contravene any of the data protection principles in Schedule 1 to the DPA. Here, the Council considered disclosure would contravene the first data protection principle.

Is the withheld information personal data?

33. "Personal data" are defined in section 1(1) of the DPA as:

data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual

34. The Commissioner is satisfied that the redacted information is about living individuals, who can be identified from the information, and their activities. She is satisfied that it relates to those individuals. Consequently, the information is their personal data.

The first data protection principle

35. The first data protection principle states that the processing of personal data (in this case, making those data publicly available in response to a request made under the EIRs) must be fair and lawful. In particular, personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.

36. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA and does not consider any of the withheld information to fall into the categories listed there.

37. There are three separate aspects to the first data protection principle:

(i) fairness,

(ii) lawfulness and

(iii) the conditions in the schedules.

These three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be made available, it is likely that disclosure will also be fair and lawful.

38. The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be made available. If any of these conditions can be met, she must then consider whether the disclosure of these personal data would also be fair and lawful.

Can any of the conditions in Schedule 2 to the DPA be met?

39. The Council did not refer to condition 6 in Schedule 2 in its explanations of redacted personal data. The Commissioner has considered all of the conditions in Schedule 2 and takes the view that condition 6 is the only one which might be considered relevant in this case.

40. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individual(s) to whom the data relate).

41. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr Z pursuing a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

(iii) Even if the processing is necessary for Mr Z's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

Is Mr Z pursuing a legitimate interest of interests?

42. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In the Commissioner's published guidance on regulation 11(2)[1] of FOISA, it states:

In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

43. Mr Z highlighted the effect of the works on his own property in submitting that he had a legitimate interest. The Council has not challenged this and, having considered all relevant submissions, the Commissioner accepts that Mr Z is pursuing a legitimate interest in seeking the withheld personal data.

Is disclosure necessary for the purposes of these legitimate interests?

44. The Commissioner must now consider whether disclosure is necessary for the purposes of these legitimate interests. In doing so she must consider whether these interests might reasonably be met by any alternative means.

45. Mr Z complained that redaction made the disclosed information unintelligible. In the Commissioner's view, this is an exaggeration. The redactions could have been a little tidier, but they still leave a narrative which is largely coherent. The Commissioner has borne in mind that the emails relate to a situation with which Mr Z is broadly familiar.

46. Having considered what information was redacted, in the context of what has been disclosed to Mr Z, the Commissioner is not satisfied that the redacted personal data would contribute to any significant extent to Mr Z's understanding of the information as a whole. Consequently, she does not consider it necessary for the withheld personal data to be disclosed to meet Mr Z's legitimate interests. To a substantial extent, these have been met already.

47. The Commissioner has therefore concluded that condition 6 in Schedule 2 to the DPA is not met in this case. She also concludes, for the same reasons, that disclosure of the withheld information would be unfair.

48. Given these conclusions, the Commissioner finds that there is no condition in Schedule 2 which would permit disclosure of the personal data under consideration. In the absence of a condition permitting disclosure, that disclosure would be unlawful. Consequently, the Commissioner finds that disclosure would breach the first data protection principle and that the information is therefore excepted form disclosure (and properly withheld) under regulation 11(2) of the EIRs.

Other aspects of the Council's handling of the request

49. In his application, Mr Z indicated he was not satisfied with the Council's apology for its handling of the request. The Commissioner is satisfied that the Council has identified and located all of the information it held on receipt of Mr Z's request and which fell within the scope of that request. She is also satisfied that it was correct in its application of regulation 11(2) of FOISA, although not (in respect of the one item remaining withheld) in its application of regulation 10(4)(e).

50. Mr Z is clearly unhappy with the time taken to respond to his request. He said so in seeking a review. The Council acknowledged the failure (which was a failure to comply with regulation 5(2)(a) of FOISA) in its review outcome and provided an apology. In this regard, the review fulfilled its purpose and the Commissioner does not consider it necessary to revisit the matter. She has noted the failure, but cannot characterise it (in isolation) as in any sense systemic.

51. The review also fulfilled its purpose in taking a fresh look at the request, with the result that further searches were carried out and information previously withheld was disclosed to

Mr Z. The Commissioner notes Mr Z's unhappiness that he was supplied with blank sheets and duplicate documents. This was unfortunate, and potentially confusing. She would urge the Council to take care to ensure that it provides only the information the applicant has actually asked for, in as coherent a form as practicable. On the other hand, she cannot identify the oversights identified in this paragraph (on this one occasion) as failures to comply with either the EIRs or recognised good practice.

Decision The Commissioner finds that Dumfries and Galloway Council (the Council) partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by Mr Z. The Commissioner is satisfied that the Council took adequate steps to identify and locate all of the information it held and which fell within the scope of the request. She also finds that the Council was substantially correct in its decisions to withhold information from Mr Z under the EIRs. However, the Commissioner finds that the Council was not entitled to withhold the information in document 13 under regulation 10(4)(e) of the EIRs. She therefore requires the Council to disclose this information, subject to the redaction of any personal data, by 1 May 2015.

  Appeal

Should either Mr Z or Dumfries and Galloway Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

  Enforcement

If Dumfries and Galloway Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that Dumfries and Galloway Council has failed to comply. The Court has the right to inquire into the matter and may deal with Dumfries and Galloway Council as if it had committed a contempt of court.

Rosemary Agnew
Scottish Information Commissioner
16 March 2015

  Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

?

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

?

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

?

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

(a) shall be complied with as soon as possible and in any event no later than 20 working days after the date of receipt of the request; and

(b) is subject to regulations 6 to 12.

?

10 Exceptions from duty to make environmental information available-

(1) A Scottish public authority may refuse a request to make environmental information available if-

(a) there is an exception to disclosure under paragraphs (4) or (5); and

(b) in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception.

(2) In considering the application of the exceptions referred to in paragraphs (4) and (5), a Scottish public authority shall-

(a) interpret those paragraphs in a restrictive way; and

(b) apply a presumption in favour of disclosure.

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

(4) A Scottish public authority may refuse to make environmental information available to the extent that

?

(e) the request involves making available internal communications.

...

11 Personal data

?

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

?

  Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

...

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---

[1]