Decision 050/2018: Mrs and Mrs S and Inverclyde Council Planning representations Reference No: 201702295 Decision Date: 10 April 2018 Summary The Council was asked for representations or comments it had received relating to specific planning applications. The Council withheld certain information on the basis that it was personal data. The Commissioner accepted that the Council correctly withheld the personal information.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a) and (c) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2) and (3)(a)(i) (Personal data)

Data Protection Act 1998 (the DPA) section 1(1) (definition of "personal data") (Basic interpretative provisions); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 10 April 2017, in relation to specific planning applications, Mr and Mrs S made a request for information to Inverclyde Council (the Council). The information requested was

"… copies of the representations received in support of the above planning applications"

2. The Council responded on 8 May 2017. The Council provided some information. It advised Mr and Mrs S it had removed personal data from the information disclosed under regulation 11(2) of the EIRs, as disclosure would breach the data protection principles.

3. On 31 May 2017, Mr and Mrs S wrote to the Council, requesting a review of its decision on the basis that they disagreed with the application of regulation 11(2) of the EIRs. They stated that the Council had published that they had made representations on the planning consent: given that their own personal data had been disclosed, it was in the interests of fairness all information should be made available.

4. The Council notified Mr and Mrs S of the outcome of its review on 27 June 2017. The Council upheld its decision that the information withheld was excepted from disclosure under regulation 11(2), on the basis that making the information available would breach the data protection principles.

5. On 18 December 2017, Mr and Mrs S wrote to the Commissioner. Mr and Mrs S applied to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. Mr and Mrs S stated they were dissatisfied with the outcome of the Council's review because (in their view) the Council had not been consistent in its handling of personal data, having published theirs. They submitted that in order for the planning process to be fair and transparent, all of the information requested should be made available.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr and Mrs S made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 18 January 2018, the Council was notified in writing that Mr and Mrs S had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr and Mrs S. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions, with specific reference to regulation 11(2) of the EIRs.

9. The Council responded, confirming that the request fell to be dealt with in terms of the EIRs and applying the exemption in section 39(2) of FOISA. The Council advised that it considered the information that had been withheld to be personal data. It believed disclosure would breach the first data protection principle and therefore regulation 11(2) of the EIRs applied.

Commissioner's analysis and findings

10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr and Mrs S and the Council. He is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

11. The Commissioner is satisfied that any information falling within the scope of the request, which relates to specific planning applications, is properly considered to be environmental information, as defined in regulation 2(1) of the EIRs (parts (a) and (c) are reproduced in Appendix 1 to this decision). Mr and Mrs S made no comment on the Council's application of the EIRs in this case and the Commissioner will consider the request in what follows solely in terms of the EIRs.

Regulation 5(1) of the EIRs

12. Regulation 5(1) of the EIRs (subject to the various qualifications contained in regulations 6 to 12) requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. It is important to bear in mind that this obligation relates to information actually held by an authority when it receives the request, as opposed to information an applicant believes the authority should hold, but which is not in fact held.

Regulation 11(2) of the EIRs - personal data of another person

13. The Council submitted that the information withheld consisted of the names, addresses and signatures of third parties, and was the personal data of those individuals, who had made representations to the Council. As such, the information was considered excepted from disclosure under regulation 11(2) of the EIRs.

14. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in Schedule 1 to the DPA (regulation 11(3)(a)(i)). The Council argued that disclosure of certain information would breach the first data protection principle.

Is the information under consideration personal data?

15. The definition of "personal data" is contained in section 1(1) of the DPA and is set out below in Appendix 1. Having considered the submissions received, the Commissioner is satisfied that a person's name, address and signature is the most common way of identifying them. Given the context in which the information appears, he is satisfied that the information redacted relates to the individuals concerned. As such, it is their personal data.

The first data protection principle

16. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be making the information available in the public domain, in response to Mr and Mrs S' request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (the full text of the principle is set out in Appendix 1). A condition in Schedule 3 to the DPA will also require to be met if the data are sensitive personal data, as defined in section 2 of the DPA: the Commissioner is satisfied that this is not the case here.

17. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

18. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be made available. If any of these conditions can be met, she must then consider whether making the information available would be fair and lawful.

Can any of the conditions in Schedule 2 be met?

19. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit making the information available to Mr and Mrs S. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

20. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

a. Are Mr and Mrs S pursuing a legitimate interest or interests?

b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

c. Even if the processing is necessary for Mr and Mrs S's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

21. There is no presumption in favour of making personal data available under the general obligation laid down by regulation 5(1) of the EIRs. Accordingly, the legitimate interests of Mr and Mrs S must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit making the personal data available. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to make the personal data available to Mr and Mrs S.

Are Mr and Mrs S pursuing a legitimate interest or interests?

22. The Council submitted that, while Mr and Mrs S believed they had a legitimate interest in in ensuring the planning process was fair and transparent, it was not apparent why the withheld personal data should be required for that purpose. It submitted that the information could only be required for reasons of personal curiosity, which did not amount to a legitimate interest for the purposes of condition 6.

23. Mr and Mrs S submitted that the Council published information, which identified them as having submitted representations in relation to the planning application. They submitted that they had a legitimate interest in ensuring they were treated equally and fairly in relation to how the Council handled representations on planning applications.

24. The Commissioner acknowledges that Mr and Mrs S have provided their personal reasons for wishing the information, in that they are is dissatisfied with the way the Council handled and processed their own personal data, as contrasted with that of the third parties involved here.

25. The Commissioner cannot comment further on the processing of Mr and Mrs S' personal data, as any issue the data subject might have with the processing of their personal data, under the DPA, is a matter for the (UK) Information Commissioner (the ICO). He can only consider here whether a condition in Schedule 2 would allow disclosure of the withheld personal data under the EIRs. He notes that Mr and Mrs S have raised the handling of their own personal data with the ICO.

26. Having considered the information and all of the submissions received, the Commissioner accepts that disclosure might satisfy Mr and Mrs S's personal interest. However, he is not satisfied that any dissatisfaction they might have with the Council's handling of their personal data in this context could be furthered by the provision of the information being withheld. It would be perverse to justify making the personal data of others available to the public on the basis of particular individuals' dissatisfaction with the publication of their own personal data.

27. In the circumstances, the Commissioner is not satisfied that any interest Mr and Mrs S might have in obtaining the personal data in question could be considered to amount to a legitimate interest in obtaining these personal data, for the purposes of condition 6 in Schedule 2 to the DPA.

28. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit the personal data to be made available. In the absence of such a condition, it would be unlawful to make the personal data available. Consequently, the Commissioner finds that the Council would have breached the first data protection principle in making the data available, and so was entitled to withhold the data under regulation 11(2) of the EIRs.

Decision The Commissioner finds that Inverclyde Council complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr and Mrs S.

Appeal

Should either Mr and Mrs S or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

10 April 2018

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

…

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

…

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

10 Exceptions from duty to make environmental information available-

…

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

…

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998[6] that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.