Decision 050/2017: First Scottish and Aberdeen City Council Orders made under the High Hedges (Scotland) Act 2013 Reference No: 201602266 Decision Date: 31 March 2017 Summary The Council was asked about notices and orders made under the High Hedges (Scotland) Act 2013. The Council provided information, but withheld an address, explaining that it was personal data and disclosure would breach the data protection principles. The Commissioner agreed.

  Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and 1(6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment)

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definitions (a), (b) and (c) "environmental information") and 2(3) (definitions (b) "the data protection principles", (c) "data subject" and (d) "personal data"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) (Personal data)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I - the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

  Background

1. On 4 August 2016, First Scottish made a request for information to Aberdeen City Council (the Council), in relation to notices or orders made by the Council under section 8 of the High Hedges (Scotland) Act 2013[1] ("the 2013 Act"). First Scottish asked for notice or orders that:

· remain extant as at 4 August 2016

· have been complied with and have monies owed to the Council as at 13 April 2016

· have invoices pending in respect of works carried out by or on behalf of the Council to resolve the matter as at 13 April 2016.

First Scottish said that if it was not possible for the details of outstanding monies to be confirmed, they wished all notices served or orders made by the Council under the 2013 Act from 6 October 2015 to 13 April 2016.

2. First Scottish stipulated certain details that should be provided in respect of each High Hedge notice, but stated that they did not require the personal data in these records.

3. The Council responded on 16 August 2016. It provided information in the form of a spreadsheet, but withheld the address of the property where a High Hedge notice had been served. It considered that the information was personal data and disclosure would breach the first data protection principle.

4. On 19 August 2016, First Scottish wrote to the Council requesting a review of its decision. They wished the Council to reconsider whether the exception for personal data applied.

5. The Council notified First Scottish of the outcome of its review on 19 September 2016. It upheld its decision to withhold the property address, and advised that there were alternative means to access the information: for example, information on High Hedge notices (among other things) could be provided via the Council's Property Enquiry Certificate (PEC) service, while appeals to High Hedge notices could be found on the Scottish Government's website[2]. The Council also advised that enquiries could be made directly to its Planning and Sustainable Development service if First Scottish, or their client, had a specific address in mind.

6. On 9 December 2016, First Scottish applied to the Commissioner for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. First Scottish were dissatisfied with the outcome of the Council's review because they believed they had a legitimate interest in the information and there would be no breach of the data protection principles if the information was disclosed to them.

  Investigation

7. The application was accepted as valid. The Commissioner confirmed that First Scottish made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

8. On 9 January 2017, the Council was notified in writing that First Scottish had made a valid application. The Council was asked to send the Commissioner the information withheld from First Scottish. The Council provided the information and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA or the EIRs it considered applicable to the information requested.

10. On 10 March 2017, First Scottish confirmed to the Commissioner that that they were not seeking the information available on the Directorate of Planning & Environmental Appeals website[3]. The aim of their application was to obtain the details of High Hedge notices as they are served and before they have progressed to an appeal.

  Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner considered all the withheld information and the relevant submissions, or parts of submissions, made to her by both First Scottish and the Council. She is satisfied that no matter of relevance has been overlooked.

12. By way of background, the 2013 Act provides for applications to be made to a local authority where a high hedge on neighbouring land is considered to have an adverse effect on the reasonable enjoyment of domestic property. The Act gives the local authority powers to settle disputes between neighbours. If the local authority, having taken all views into account, finds that the hedge is having an adverse effect, it can issue a High Hedge notice requiring the hedge owner to take action to remedy the problem and prevent it recurring. Failure to comply with such a notice would allow the authority to go in and do the work itself, recovering the costs from the hedge owner. There is a right of appeal to the Scottish Ministers[4].

Application of the EIRs

13. "Environmental information" is defined in regulation 2(1) of the EIRs (paragraphs (a), (b), (c) and (f) of the definition are reproduced in full in Appendix 1). Where information falls within the scope of this definition, a person has a right to access the information under the EIRs, subject to qualifications and exceptions.

14. The Council considered the requested information to be environmental information as defined in paragraph (c) of regulation 2(1) of the EIRs as the information related to the application and enforcement of High Hedge notices within Aberdeen City, and such notices affect or are likely to affect the elements referred to in paragraph (a) of regulation 2(1). The Council took into account the Commissioner's guidance[5] that environmental information should be interpreted as broadly as possible and stated that it treats such requests as requests for environmental information because the decisions and policies the Council makes in relation to environmental notices have an impact on the environment.

15. First Scottish has not disputed the Council's decision to handle the request under the EIRs.

16. The Commissioner is satisfied that the information covered by the request is environmental information, as defined in regulation 2(1) of the EIRs (paragraphs (a) to (c) of the definition of "environmental information"). The information relates to measures that will affect the elements of the environment (i.e. a High Hedge notice).

17. The Council applied the exemption in section 39(2) of FOISA. This provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs.

18. The Commissioner accepts that the Council is entitled to apply this exemption to the request from First Scottish, given her conclusion that the information requested is environmental information. As there is a separate statutory right of access to environmental information available to the applicant, the Commissioner also accepts that, in this case, the public interest in maintaining this exemption and in handling the request in line with the requirements of the EIRs outweighs any public interest in disclosing the information under FOISA.

19. The Commissioner will consider the information in what follows solely in terms of the EIRs.

Regulation 11(2) of the EIRs: personal data

20. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. This requirement is subject to the exceptions and other relevant provisions in the EIRs.

21. Regulation 11(2) excepts personal data of which the applicant is not the data subject, where either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies.

22. In order for a Scottish public authority to rely on the exception in regulation 11(2), it must show that:

· the information is personal data for the purposes of the DPA and

· making it available would contravene at least one of the data protection principles laid down in the DPA.

Is the withheld information personal data?

23. "Personal data" are defined in section 1(1) of the DPA as:

"data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possessions of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

24. Section 9 of the 2013 Act provides that a High Hedge notice is binding on every person who is for the time being an owner of the neighbouring land specified in the notice. The withheld information therefore relates to the land owner(s). In the circumstances, the Commissioner is satisfied that the withheld information relates to an identifiable person or persons. The person or persons who occupy the property are identifiable from the address, by the Council and by other third parties.

25. The withheld information is therefore the personal data the owner of the affected property and the person who applied for the High Hedge notice. The Council referred to these persons as the "affected parties". For convenience, the Commissioner will simply refer in her decision to the "data subjects".

The first data protection principle

26. The first data protection principle states that the processing of personal data (in this case, making those data publicly available in response to a request made under the EIRs) must be fair and lawful and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.

27. The Commissioner has considered the definition of sensitive personal data, as found in section 2 of the DPA. She does not consider any of the withheld information to be sensitive personal data.

28. There are three separate aspects to the first data protection principle:

· fairness

· lawfulness and

· the conditions in the schedules.

29. These three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be made available, it is likely that disclosure will also be fair and lawful.

30. The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be made available. If any of these conditions can be met, she must then consider whether the disclosure of these personal data would also be fair and lawful.

31. When considering the conditions in Schedule 2, the Commissioner has noted Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 471[6], that the conditions require careful treatment in the context of a request for information under FOISA, given that they were not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interests of the data subject.

Can any of the conditions in Schedule 2 to the DPA be met?

32. Condition 1 applies when a data subject has consented to their personal data being disclosed. The Council submitted that the data subjects have not given consent for the Council to put the information into the public domain, and would not have an expectation that the Council would do so. The Commissioner accepts that consent has not been given by the data subjects. Therefore, condition 1 in Schedule 2 cannot be met.

33. Condition 6 in Schedule 2 could potentially apply in this instance. First Scottish specifically referred to this condition in their correspondence with the Council and provided reasons why they thought it would justify disclosure of the personal data.

34. The Commissioner has considered all of the conditions in Schedule 2 and agrees that condition 6 is the only one which might be relevant in this case.

35. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects (i.e. the individuals to whom the data relate).

36. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

· Is First Scottish pursuing a legitimate interest or interests?

· If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

· Even if the processing is necessary for First Scottish's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects?

37. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. The legitimate interests of First Scottish must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to First Scottish.

Is First Scottish pursing a legitimate interest or interests?

38. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In the Commissioner's published guidance on regulation 11(2)[7] of the EIRs, it states:

In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety.

39. When First Scottish applied to the Commissioner, they stated (as they had to the Council) that their interest in the information was for the legitimate purpose of providing a PEC service to the public, and the information requested was a necessary part of this service. They explained that provision of PECs is a requirement prescribed by both the Law Society and the Council of Mortgage Lenders for the large majority of property transactions and, as such, they would consider the provision of these indemnified reports as an "essential service". First Scottish commented that private search firms have a predominant position in the PEC market place, to the extent that they are the only providers in some council areas where the councils no longer provide a PEC service.

40. First Scottish explained that both they and the Council provide a PEC service to the general public, with the predominant users of the service being members of the legal profession. They commented that the Council asks for no clarification as to the interests of a particular party when an instruction [for a PEC] is made to them: when providing a PEC, the Council's only requirement is that the requester pays the Council's fee for the service.

41. First Scottish argued that, if it is not appropriate to disclose the information in a PEC, due to the level of protection required to be given to the data subjects, then the Council's "property PEC department" should not have access to it. They suggested that their legitimate interest in the information was the same as the Council's, in terms of their capacity to provide complete and accurate PECs.

42. The Council disputed that First Scottish had demonstrated the necessary level of legitimate interest in the requested information. The Council considered that the commercial interests of First Scottish (in relation to its PEC service) did not outweigh "data protection", and did not accept that First Scottish have a legitimate interest that would require the personal data of a third party to be processed "in a manner not communicated to that third party".

43. The Council accepted that, should a prospective purchaser of the property obtain a PEC from the Council, the withheld information would be disclosed to them in the PEC. The Council considered that, in this situation, the prospective buyer would be seen as an "interested party" with a much clearer level of legitimate interest.

44. The Council commented that, here, the information which has been withheld is the personal data of a member of public against whom action has been taken due to a complaint by another member of public. As such, this may be a fractious situation, prone to escalation. The member of public whose information has been requested is not necessarily an active participant in the action which has been taken upon them and may be in dispute over the action taken so far. The Council added that, in this case, there is no indication that the member of public is planning on selling their property.

45. The Council may be correct to highlight that First Scottish may not be seeking the information for a client who is actively interested in the property, but this does not mean that First Scottish do not have a legitimate interest in the personal data. It cannot be said that the only person with a legitimate interest in the address of a property where a High Hedge order has been issued is a person buying or selling or renting that property, or that a company such as First Scottish will only have a legitimate interest where they are seeking information on behalf of someone with an active interest in purchasing the property.

46. First Scottish are a property search company. A High Hedge notice may be relevant information to First Scottish, even if there is no client actively seeking information about the specific property subject to the notice. For example, information which confirms which properties are subject to a High Hedge notice as of a certain date serves to show that other properties are not subject to such notices.

47. The Commissioner is satisfied that First Scottish, with its commercial interest in supplying property information, was pursuing a legitimate interest in seeking the withheld information. She will now go on to consider whether access to the withheld information was necessary for the purposes of that interest.

Is the processing involved necessary for the purposes of those legitimate interests?

48. In reaching a decision on this, the Commissioner must consider whether the interests of First Scottish might reasonably be met by any alternative means.

49. In their application to the Commissioner, First Scottish stated that some of the information they requested can be confirmed on the Scottish Government's register of appeals. The information may also be inferred by way of a Notice of Liability being registered with Registers of Scotland. However, as these two record types do not provide full confirmation of all the High Hedge notices that have been served, First Scottish suggested that the Council is the only holder of the complete list of properties affected.

50. First Scottish argued that, if the Council did not disclose the full list, an opportunity is created for the burden of a High Hedge notice to be unfairly undisclosed to the prospective buyer of a property. Under normal circumstances, the seller of the property would be obliged to inform a prospective buyer of a property of a notice that had been served; however, there are circumstances where this disclosure may be hindered. For example, the nondisclosure of a High Hedge notice during the sale of a property may occur when the property is being sold as part of a deceased owner's estate or if the property was the subject of repossession or if the seller was to behave dishonestly. Such instances would leave a buyer unfairly subject to an undisclosed burden.

51. The Council did not accept these points. It said that the information required to avoid the situation outlined by First Scottish was available from the Council (i.e. through its PEC service) and therefore there should be no reason for a buyer to be unfairly subject to an undisclosed burden. The Council commented:

"The only circumstance whereby their client would be left in the situation they describe is if First Scotland did not undertake a thorough search of all available resources. This would include contacting the council in relation to a single property of named address whilst acting on behalf of their client."

52. First Scottish submitted:

"We could not use the Council's PEC service to obtain High Hedge notice information generally (with the exception of those cases that have been the subject of an appeal with the Scottish Government) unless we had note of the addresses of affected properties beforehand. To obtain confirmation of the properties affected in this way at a particular moment in time we would require to obtain Council PECs for the every property within the local authority area. Aside from the restrictive financial implications of this option, we very much doubt that the council would be able to deliver such a large volume of work within their standard service delivery period prescribed for PECs, if in fact, they could deliver this volume of work within a reasonable period at all."

53. The Council was asked if there was any way in which First Scottish could obtain the address of a property subject to a High Hedge notice without already knowing that property's address. The Council acknowledged that there was currently no method by which a commercial enterprise can gain a full list of properties affected by High Hedge notices. Without knowing an address, a commercial enterprise would have to rely on those properties appealed to the Scottish Government, but the Council acknowledged that the list obtained from this resource would not be exhaustive.

54. The Commissioner therefore understands that First Scottish would first have to know the address of a property in order to find out whether it is affected by a High Hedge notice: without an address, it cannot use the Council's PEC service to confirm whether a property is affected in this way. There is no way for First Scottish to find out the addresses of affected properties without asking the Council for this information, with the exception of those properties where the High Hedge notice has been appealed to the Scottish Government. The only other possibility would be to seek PECs for every property in the Council area, which is unrealistic, in terms of the cost to First Scottish and the burden of work this would create for the Council.

55. In all the circumstances, therefore, the Commissioner is satisfied that disclosure of the withheld information was necessary for the purposes of First Scotland's legitimate interests. These legitimate interests were not capable of being met without the information being made available to them.

Is the processing unwarranted in this case by reason of prejudice to the rights, freedoms or legitimate interests of the data subject/s?

56. The Commissioner must now consider whether the processing is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects. This test involves a balancing exercise between the legitimate interests of First Scottish and those of the data subjects. Only if the legitimate interests of First Scottish outweigh those of the data subjects can the information be made available without breaching the first data protection principle.

57. In the Commissioner's guidance[8] on regulation 11 of the EIRs, she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

· whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)

· the potential harm or distress that may be caused by the disclosure

· whether the individual objected to the disclosure

· the reasonable expectations of the individuals as to whether the information should be disclosed.

58. The Council maintained that it would be reasonable for people whose houses are not for sale to expect that their personal details would not be shared with a commercial enterprise. The Council said:

"It would be disproportionate to share this information with a commercial organisation as there would be no guarantee that this information would still be accurate if the property is sold at a later date. The best way to ensure accuracy of data would be to apply for a PEC at the time when the property is due to be marketed for sale."

59. As noted above, the Council commented that the information is the personal data of a member of public against whom action has been taken as a result of a complaint by another member of public. As such, this may be a fractious situation, prone to escalation: the member of public whose information has been requested is not necessarily an active participant in the action which has been taken upon them and, in fact, may be in dispute at the action taken.

60. In its application to the Commissioner, First Scottish suggested that disclosure of the requested information would not cause any unwarranted prejudice to the rights, freedoms or legitimate interests of the owners/occupiers of the property or properties. The information would only confirm that the Council considers the property to have a high hedge as defined in the 2013 Act. The requirements to determine high hedges are clearly explained in the legislation and this information is available to the public, while the fact that a particular property had a tall hedge would be generally known within the local area as the hedge is likely to be visible. First Scottish felt that their legitimate interest in the information outweighs the rights of the data subjects in this instance.

61. First Scottish said they understand the 2013 Act to be a fair and impartial method to resolve disputes between neighbours concerning high hedges. The steps that are to be followed prior to a notice being served - where several attempts are to be made to resolve the matter prior to serving a notice - suggest that the situation is indeed likely to be fractious to a degree if it is found that a notice is required to be served. Should the serving of a notice be in dispute, the 2013 Act allows for the recipients have a right to appeal. First Scottish could not see how disclosure of this information for the purposes of informing a prospective buyer or their lender would have any further adverse effect on the situation. They commented that it is a general requirement for a seller to volunteer this information to a prospective buyer or lender anyway, and further confirmation of this in the form of a PEC would not add to the difficulties of the situation.

62. The Council was asked by the Commissioner if it provides guidance on what to expect, in terms of privacy, if a High Hedge notice is served on a person's property. The Council replied that it has no guidance specifically for the 2013 Act, but would treat all information received in line with the DPA, as the public would expect. The Council highlighted that the personal data that is linked to the High Hedge Orders was not provided by the data subjects themselves initially, but by a third party neighbour, and that a local authority must give each owner and occupier of the neighbouring land a copy of the application for the High Hedge notice. The Council stated that it does not explicitly advise the applicant and the hedge owner about how the Council will handle their personal data at that stage, but believed that there would be no expectation that their information will be published or provided to a third party.

63. The Commissioner has considered these submissions fully and carefully.

64. In considering the effects of disclosure on the data subjects, it is relevant to be aware that disclosing information under the EIRs has the effect of putting the information in the public domain.

65. A High Hedge notice shows that a particular type of legal action has been taken in respect of a property. Disclosure of the notice would formally confirm that the hedge at the property is legally defined as a "high hedge". It is possible that the recipient of such a notice would be viewed negatively.

66. The Commissioner draws a distinction between disclosure of information to a prospective buyer or lender through a PEC (i.e. in situations where the person receiving the information has an active interest in the property and the liabilities of the property) and disclosure into the public domain through the EIRs. As far as the Commissioner can see, nothing in the 2013 Act itself would create an expectation about how a person's personal data would be processed by the Council.

67. The Commissioner accepts that it would be reasonable to expect a High Hedge notice to be disclosed to a prospective buyer of the affected property. However, the request from First Scottish could potentially cover properties which are not for sale and where there is no prospective buyer or lender involved.

68. The Commissioner concludes that the data subjects would have no expectation that their personal data would be made publicly available by disclosure of the High Hedge notice under the EIRs, particularly in situations where the property is not for sale. The Commissioner accepts that the existence of a High Hedge notice implies some dispute with a neighbour, and she considers that disclosure of the information into the public domain would increase the level of reputational damage to the owner of the hedge. She finds that disclosure of the personal data would be unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects, and that this outweighs the legitimate interests of First Scottish.

69. Taking all the above into consideration, the Commissioner is satisfied that condition 6 of Schedule 2 cannot be met in this case.

70. As no condition in Schedule 2 can be met, disclosing the property owners' personal data would breach the first data protection principle. The Commissioner therefore concludes that the exception in regulation 11(2) of the EIRs has been correctly applied by the Council to the personal data of the property owners.

71. Having accepted this, the Commissioner will not consider the second data protection principle in with regard to the withheld information.

Decision The Commissioner finds that Aberdeen City Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by First Scottish.

  Appeal

Should either First Scottish or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

31 March 2017

  Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

…

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

…

39 Health, safety and the environment

…

(2) Information is exempt information if a Scottish public authority-

(a) is obliged by regulations under section 62 to make it available to the public in accordance with the regulations; or

(b) would be so obliged but for any exemption contained in the regulations.

…

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

…

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

(b) factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in paragraph (a);

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

(3) The following expressions have the same meaning in these Regulations as they have in the Data Protection Act 1998], namely-

…

(b) "the data protection principles";

(c) "data subject"; and

(d) "personal data".

…

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

10 Exceptions from duty to make environmental information available-

…

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

…

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---