Decision 049/2018: Mrs and Mrs R and Inverclyde Council Planning representations Reference No: 201702294 Decision Date: 10 April 2018  Summary The Council was asked for representations or comments it had received relating to a specific planning application. The Council withheld certain information on the basis that it was personal data. The Commissioner accepted that the Council correctly withheld the information.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a) and (c) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(1), (2) and (3)(a)(i) (Personal data)

Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 27 April 2017, in relation to a specific planning application, Mr and Mrs R made a request for information to Inverclyde Council (the Council). The information requested was:

"… copies … of any representations or comments received on the above planning application, with the exception of the comments sent in by ourselves."

2. The Council responded on 10 May 2017. The Council provided some information. It advised Mr and Mrs R it had removed personal data from the information disclosed, as it was considered to be their own personal data and the personal data of third parties. As such, the information redacted was considered excepted from disclosure in terms of regulation 11(1) and (2) of the EIRs.

3. On 30 May 2017, Mr and Mrs R wrote to the Council requesting a review of its decision, on the basis that more than half of the letter provided had been redacted and they wished all details of the letter to be made available.

4. The Council notified Mr and Mrs R of the outcome of its review on 27 June 2017. It confirmed that any information relating to them was considered excepted under regulation 11(1) of the EIRs. The Council noted that Mr and Mrs R had submitted a Subject Access Request (SAR) under the DPA, which had been responded to, and advised that any dissatisfaction with that response could be appealed to the UK Information Commissioner (the ICO).

5. The Council further advised that the definition of personal data included expressions of opinion about an individual and the remaining withheld information related to the writer of the letter of representation as an expression of their opinion. The Council stated that the individuals submitting the representations had a reasonable expectation of privacy and confirmed (with explanation) that the information was excepted from disclosure under regulation 11(2) of the EIRs.

6. On 18 December 2017, Mr and Mrs R wrote to the Commissioner. Mr and Mrs R applied to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. Mr and Mrs R stated they were dissatisfied with the outcome of the Council's review because they had not been advised which part of the letter constituted their own personal data, and disagreed with the application of regulation 11(2) of the EIRs (submitting that they had a legitimate interest in the disclosure of the information).

Investigation

7. The application was accepted as valid. The Commissioner confirmed that Mr and Mrs R made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

8. On 18 January 2018, the Council was notified in writing that Mr and Mrs R had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr and Mrs R. The Council provided the information and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions, with specific reference to regulation 11(1) and 11(2) of the EIRs.

10. The Council responded, confirming that the request fell to be dealt with in terms of the EIRs and applying the exemption in section 39(2) of FOISA. The Council advised that it considered the withheld information to be the personal data of Mr and Mrs R, and of other individuals. It maintained, with reasons, that the information was excepted from disclosure under both regulation 11(1) and 11(2) of the EIRs.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr and Mrs R and the Council. He is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

12. The Commissioner is satisfied that any information falling within the scope of the request, which relates to a specific planning application, is properly considered to be environmental information, as defined in regulation 2(1) of the EIRs (parts (a) and (c) are reproduced in Appendix 1 to this decision). Mr and Mrs R made no comment on the Council's application of the EIRs in this case and the Commissioner will consider the request in what follows solely in terms of the EIRs.

Regulation 5(1) of the EIRs

13. Regulation 5(1) of the EIRs (subject to the various qualifications contained in regulations 6 to 12) requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. It is important to bear in mind that this obligation relates to information actually held by an authority when it receives the request, as opposed to information an applicant believes the authority should hold, but which is not in fact held.

Regulation 11(1) of the EIRs - personal information of the applicant

14. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.

15. The Council stated that it could not provide some of the information requested by Mr and Mrs R as it was excepted under regulation 11(1) of the EIRs. In other words, it comprised Mr and Mrs R' own personal data. Regulation 11(1) contains an absolute exception (i.e. not subject to the public interest test) in relation to personal data of which the applicant is the data subject.

16. This exception exists under the EIRs because individuals have a separate right to make a request for their own personal data (commonly known as a SAR) under section 7 of the DPA. The DPA will therefore usually determine whether a person has a right to information about themselves. Therefore, the effect of the exception in regulation 11(1) of the EIRs is not to deny individuals a right of access to information about themselves, but to ensure that the right is exercised under the appropriate legislation.

17. The Commissioner notes that Mr and Mrs R submitted a SAR to the Council and, having received a response, made a complaint to the ICO. The Commissioner however cannot comment on the outcome of the complaint to the ICO, which is about the application of the DPA rather than FOISA. The Commissioner's role is to consider whether the Council was correct to rely upon regulation 11(1) of the EIRs, as it pertains to the personal data of Mr and Mrs R: if he is satisfied that the information was correctly withheld on this basis, he cannot - of course - comment on its content.

Is the information under consideration personal data?

18. "Personal data" are defined in section 1(1) of the DPA as

"data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

19. Having reviewed the information withheld in terms of regulation 11(1) of FOISA, the Commissioner is satisfied that this information can properly be described as the personal data of Mr and Mrs R. Mr and Mrs R can be identified from the information, which focuses on - and is biographical in relation to - them: consequently, it relates to them. Therefore, it is the Commissioner's view that this information is absolutely excepted from disclosure under regulation 11(1) of the EIRs: as such, this information was correctly withheld by the Council.

Regulation 11(2) of the EIRs - personal data of another person

20. The Council also submitted that the withheld information consisted of names, addresses, signatures and the personal opinions of the writer about other individuals. The Council submitted all of these were personal data for the purposes of section 1 of the DPA, excepted from disclosure under regulation 11(2) of the EIRs.

21. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in Schedule 1 to the DPA (regulation 11(3)(a)(i)). The Council argued that disclosure of the information would breach the first data protection principle.

Is the information under consideration personal data?

22. The definition of "personal data" has been discussed above, in relation to regulation 11(1). Having considered the submissions received, the Commissioner is satisfied that the information that has been redacted (as described above) relates to living individuals, who could be identified from that information. In the circumstances, he is satisfied that it comprises their personal data.

The first data protection principle

23. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be making the information available in the public domain, in response to Mr and Mrs R' request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (the full text of the principle is set out in Appendix 1). A condition in Schedule 3 to the DPA will also require to be met if the data are sensitive personal data, as defined in section 2 of the DPA: the Commissioner is satisfied that this is not the case here.

24. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

25. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be made available. If any of these conditions can be met, she must then consider whether making the information available would be fair and lawful.

Can any of the conditions in Schedule 2 be met?

26. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit making the information available to Mr and Mrs R. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

27. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

a. Are Mr and Mrs R pursuing a legitimate interest or interests?

b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

c. Even if the processing is necessary for Mr and Mrs R' legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

28. There is no presumption in favour of making personal data available under the general obligation laid down by regulation 5(1) of the EIRs. Accordingly, the legitimate interests of Mr and Mrs R must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit making the personal data available. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to make the personal data available to Mr and Mrs R.

Are Mr and Mrs R pursuing a legitimate interest or interests?

29. The Council submitted that it did not see how Mr and Mrs R would have a legitimate interest in knowing and making public the names and addresses withheld, or the personal opinions of an individual who had made representations in respect of a planning application (which Mrs and Mrs R had accepted had nothing to do with them). It concluded that Mr and Mrs R did not have a legitimate interest for the purposes of condition 6.

30. Mr and Mrs R submitted that they were aware that their own data was included in the requested information, which had been provided to the Council without their knowledge, approval or consent. As such, they considered that they had a legitimate interest in understanding why their personal data had been included by a third party, in understanding the relevance the third party considered their data had to the planning application, and in making the third party aware that they did not have their permission and did not wish them to use their personal data for any reason.

31. The Commissioner has considered all of the submissions provided by Mr and Mrs R as to why they consider that they have a legitimate interest in the information being disclosed. The Commissioner acknowledges that the reasons provided are personal to Mr and Mrs R, and disclosure would assist them in their understanding of what was submitted to the Council.

32. However, having considered the information and all of the submissions received, the Commissioner is not satisfied that any personal interest Mr and Mrs R might have in obtaining the personal data in question could be considered to amount to a legitimate interest in obtaining these personal data for the purposes of condition 6 in Schedule 2 to the DPA.

33. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit the personal data to be made available. In the absence of such a condition, it would be unlawful to make the personal data available. Consequently, the Commissioner finds that the Council would have breached the first data protection principle in making the data available, and so was entitled to withhold the data under regulation 11(2) of the EIRs.

Decision The Commissioner finds that Inverclyde Council complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr and Mrs R.

Appeal

Should either Mr and Mrs R or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

10 April 2018

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

…

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

…

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

10 Exceptions from duty to make environmental information available-

…

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

…

11 Personal data

(1) To the extent that environmental information requested includes personal data of which the applicant is the data subject then the duty under regulation 5(1) to make it available shall not apply to those personal data.

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.