Decision 077/2014 Mr John Grassom and South Lanarkshire Council
Planning application representations
Reference No: 201400080
Decision Date: 2 April 2014
Summary
On 1 July 2013, Mr Grassom asked South Lanarkshire Council (the Council) for information redacted from a letter of representation contained in a planning application file. The information was withheld under regulation 11(2) of the EIRs, on the basis that the contents were personal data the disclosure of which would breach the first data protection principle. Following an investigation, the Commissioner accepted this position.
Relevant statutory provisions
Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation) (paragraphs (a) and (c) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (b) (Personal data)
Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part I - the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 1 July 2013, Mr Grassom wrote to the Council, requesting the remaining information from a letter published on the Council's website (in connection with a planning application) in redacted form.
2. The Council responded on 31 July 2013. The Council withheld the information as personal data which it considered exempt under regulations 11(1) and 11(2) of the EIRs.
3. On 4 August 2013, Mr Grassom wrote to the Council requesting a review of its decision. He did not believe the individual concerned had a reasonable expectation their personal data would not be disclosed.
4. The Council notified Mr Grassom of the outcome of its review on 3 September 2013, upholding its decision to withhold the information under regulations 11(1) and 11(2).
5. On 7 January 2014, Mr Grassom wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.
6. The application was validated by establishing that Mr Grassom made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
7. On 21 January 2014, the Council was notified in writing that an application had been received from Mr Grassom and asked to provide the Commissioner with the information withheld from him. The Council responded with the information requested and the case was then allocated to an investigating officer.
8. The investigating officer subsequently contacted the Council, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. The Council was asked to justify its reliance on regulation 11 of the EIRs.
9. Both the Council and Mr Grassom provided submissions to the Commissioner during the investigation.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Grassom and the Council. She is satisfied that no matter of relevance has been overlooked.
11. The withheld information consists of the redacted paragraphs from a letter of representation written to the Council in relation to a planning application, responding to objections made by Mr Grassom. Given the nature of the process to which it relates, the Commissioner is satisfied that the information is properly considered to be environmental information as defined in regulation 2(1) of the EIRs.
12. The Council submitted that all of the information should be withheld under regulation 11(2) of the EIRs and that parts should also be withheld under regulation 11(1) of the EIRs. The Commissioner will begin by considering the application of regulation 11(2).
Regulation 11(2) of the EIRs
13. Regulation 11(2) excepts third party personal data from being made available if either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies to the information.
14. The Council's arguments relate to those parts of the first condition which apply where making the information available would contravene the data protection principles. In order for a Scottish public authority to rely on this exception, it must show (i) that the information is personal data for the purposes of the DPA, and (ii) that making it available would contravene at least one of the data protection principles laid down in Schedule 1 to the DPA. In this case, the Council argued that the first data protection principle would be contravened.
Is the withheld information personal data?
15. "Personal data" are defined in section 1(1) of the DPA as:
data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
16. The Council submitted that the withheld information related to the writer of the letter, as an expression of their personal opinions. That individual was identifiable from the letter as a whole, the unredacted portions of that letter being in the public domain. In addition, the Council submitted that the withheld information included the personal data of a number of other individuals, who were identified and commented on in the letter.
17. In this case, the Commissioner is satisfied that the withheld information can be considered the personal data of the letter writer and the other individuals identified by the Council. The individuals can be identified from the information, either by itself or with information which has been published already. In the context in which the information appears, the Commissioner is satisfied that it relates to those individuals.
18. The first data protection principle states that the processing of personal data (in this case, making those data publicly available in response to a request made under the EIRs) must be fair and lawful. In particular, the principle specifies that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. In the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met.
19. The Council has submitted that elements of the withheld information are properly considered to be sensitive personal data in terms of section 2 of FOISA. In this case, the Commissioner finds it helpful to consider all of the information against the Schedule 2 conditions first, looking at the Schedule 3 conditions thereafter only if she finds it necessary to do so.
20. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. However, these three aspects are interlinked. For example, if there is a specific condition which permits the personal data to be made available, it is likely that disclosure will also be fair and lawful.
21. The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be made available. If any of these conditions can be met, she must consider whether it would be fair and lawful to make the data available.
Can any of the conditions in Schedule 2 be met?
22. The Commissioner has looked at all of the conditions in Schedule 2 and concluded that condition 6 is the only one which might be considered relevant in this case.
23. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (i.e. the individual(s) to whom the data relate). The processing in this case would be making the data available in response to Mr Grassom's request.
24. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
? Is Mr Grassom pursuing a legitimate interest or interests?
? If yes, is the processing involved necessary for the purposes of these interests? In other words, is the processing proportionate as a means and fairly balanced as to its ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject(s)?
? Even if the processing is necessary for the purposes of Mr Grassom's legitimate interests, is the processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s)?
Is Mr Grassom pursuing a legitimate interest or interests?
25. Mr Grassom believed that information which referred to him or his family should be made available, along with information considered by SLC as part of the decision-making process, to allow him to respond to comments and address perceived inaccuracies.
26. The Council acknowledged that that Mr Grassom had a legitimate interest in obtaining the response to his objections, as part of the planning process. This was why it had provided him with a substantial part of the letter already.
27. The Council also accepted that Mr Grassom could argue he had a legitimate interest in obtaining the information relating to him. However, that information would, by definition, be excepted as his personal data under regulation 11(1).
28. The Commissioner agrees with the Council's position in relation to information relating to Mr Grassom: that will be his own personal data and therefore excepted under regulation 11(1). The appropriate route for disclosure of such information is under the DPA, to the data subject alone: the Commissioner cannot accept that there can be a legitimate interest in making such information available to the world at large, under the EIRs.
29. Having considered the submissions from both Mr Grassom and the Council, however, the Commissioner accepts that Mr Grassom is (and was, in making his request) pursuing a legitimate interest in relation to the planning process.
Is the processing involved necessary for the purposes of those interests?
30. The Commissioner must now consider whether disclosure is necessary for the purposes of Mr Grassom's legitimate interests. In doing so, she must consider whether these interests might reasonably be met by any alternative means.
31. The Council distinguished the redacted information from that made available already. The redacted information was not considered relevant to the planning process and was not considered by the Council in reaching a view on the planning application.
32. Having considered all relevant submissions and both the withheld and the publicly available information from the letter of representation, the Commissioner agrees that any information which could reasonably be considered material to consideration of the planning application, and participation in the planning process, has been made available already. The letter as a whole may have been submitted as part of the planning process, but the Commissioner accepts that disclosure of the redacted paragraphs is not necessary for the pursuit of any legitimate interest in that process.
33. The Commissioner is therefore satisfied that condition 6 in Schedule 2 to the DPA cannot be met in this case. Having reached that conclusion, she does not find it necessary to consider whether any of the withheld personal data are sensitive personal data.
34. In the absence of a condition permitting disclosure, the Commissioner must conclude that disclosure would be unlawful. In all the circumstances, therefore, she finds that disclosure would breach the first data protection principle and that the information was therefore properly withheld under regulation 11(2) of the EIRs.
35. In the light of the above conclusion, the Commissioner will not go on to consider the Council's application of the exception in regulation 11(1) of the EIRs.
DECISION
The Commissioner finds that the Council complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr Grassom.
Appeal
Should either Mr Grassom or South Lanarkshire Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
2 April 2014
Appendix
Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations -
?
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on-
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
?
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
?
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
?
(b) is subject to regulations 6 to 12.
?
10 Exceptions from duty to make environmental information available
?
(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.
?
11 Personal data
?
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.
(3) The first condition is-
(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-
(i) any of the data protection principles;
?
(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
?
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - the principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
