Decision 096/2021: Information relating to two planning applications

Public authority: Perth and Kinross Council
Case Ref: 202000931

Summary

The Council was asked for information about two planning applications.

The Council made some information available to the Applicant, but withheld other information as it considered elements of this to be subject to legal privilege and other parts to be personal data. Some of this information was made available to the Applicant on review.

Further information was disclosed during the investigation, with some personal data redacted.

While the Commissioner accepted that searches carried out by the Council by the end of the investigation would have been capable of identifying all relevant, recorded information held, he found that it should have made all of this available to the Applicant at the time he submitted his request. The Commissioner also found that the Council was entitled to withhold certain personal data from the Applicant, but not to withhold other personal data or information it had considered to be subject to legal privilege (as disclosed during the investigation).

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a), (b) and (c) of definition of "environmental information" and definitions of "personal data" and "the UK GDPR"; 5(1) and (2)(b) (Duty to make available environmental information on request); 11(2), (3A)(a) and (7) (Personal data)

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 28 November 2019, the Applicant made a request for information to Perth and Kinross Council (the Council). The information requested was:

Copies of all correspondence and contacts, to include emails, letters, memos, notes of phone calls, records of meetings, reports, photographic records, etc. between Perth & Kinross Council officers and the applicants or their agents in relation to planning applications 19/00090/FLL and 19/01429/LBC not otherwise available on the Public Access portal.

2. The Applicant noted that the information requested in relation to 19/00090/FLL included all items detailed above from 28 September 2019 onward to date, including any post-determination discussion and advice.

3. In regard to 19/01429/LBC, the Applicant explained that the requested information included all discussion and advice on the suitability or otherwise of the proposal and all correspondence and contacts, to include emails, letters, memos, notes of phone calls, records of meetings, reports, photographic records, etc. between Council officers and all other agencies, including the applicants or their agents, from 21 August 2019 to date.

4. The Applicant went on to explain that the information requested, for both requests, also included all internal and external consultations and advice, including legal advice, sought/provided by and/or obtained by Council officers, from any source, in relation to either or both planning applications.

5. The Council sought clarification from the Applicant on 19 December 2019 as to whether he wanted to receive information it held about a Stage 2 complaint of relevance to this request.

6. The Applicant responded to the request for clarification on the same date, confirming that he did want all of the documents referred to in the Council's clarification request. The Applicant provided further clarification on 20 December 2019, stating that he wished to receive any post-determinative discussion and advice held in relation to either or both planning applications.

7. The Council wrote to the Applicant on 6 January 2020, apologising that it would be unable to respond to his request within the statutory timescale, but undertaking to provide a response by the end of that week.

8. The Council responded to the Applicant's request on 8 January 2020, processing it under the EIRs. In doing so, it made some information available to the Applicant, withholding other information it considered to be legally privileged and so excepted from disclosure under regulation 10(5)(d) of the EIRs. The Council also relied on the exception in regulation 11(2) of the EIRs for withholding information it considered to be personal data.

9. On 22 January 2020, the Applicant wrote to the Council, requesting a review of its decision on the basis that he was dissatisfied with its response, particularly in relation to the documents withheld by the Council under regulation 10(5)(d) of the EIRs.

10. The Council notified the Applicant of the outcome of its review on 19 February 2020. The Council explained that information in two of the documents withheld had been incorrectly identified as being legally privileged in their entirety, and these were now being made available to him, subject to the redaction of information the Council considered to be personal data, excepted from disclosure under regulation 11(2) of the EIRs. The Council also withheld information in one paragraph of one of the documents as it still considered this to be legal advice, excepted from disclosure under regulation 10(5)(d) of the EIRs. It advised that it was relying on the arguments advanced in its response to the Applicant's request for applying these exceptions.

11. On 15 August 2020, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of the Freedom of Information (Scotland) Act 2002 (FOISA) applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated he was dissatisfied with the outcome of the Council's review for the following reasons:

(i) He believed he was entitled to have full access to the information requested by him. This included those communications containing information from legal advisers which the Council was withholding on the basis of being considered to have legal privilege.

(ii) He was not convinced that he was being given access to all documents that should be on file and on record to which he believed he was entitled.

(iii) He considered it to be in both his and the wider public interest that this documentation be made available, to allow proper scrutiny and accountability in the interests of best practice, openness and fairness.

(iv) He was of the view that upholding public trust and confidence in the planning system and the principles of open and fair engagement was essential and an accepted tenet of proper public administration. This was only possible, in his view, through the application of transparent process and accountability (which required to be demonstrated in full).

Investigation

12. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

13. On 7 September 2020, the Council was notified in writing that the Applicant had made a valid application. The Council was asked to send the Commissioner the information withheld from the Applicant.

14. During the period between the validation of the application and the allocation of the case to the investigating officer, the Council made further information available to the Applicant, previously withheld under regulation 10(5)(d). This information was made available subject to the redaction of information the Council considered to be personal data, excepted from disclosure under regulation 11(2).

15. The Council copied the Commissioner in to several emails it sent to the Applicant on 16 October 2020, in which it made further information available and commented that any information previously withheld from the Applicant at the review stage had now either been disclosed in full or was contained in the information now being made available. In addition to information previously withheld, the Applicant was provided with further information identified by the Council as falling within scope of the request.

16. The Applicant confirmed that he had received all of this information.

17. Given that the Council made information available to the Applicant at that point, without any reasons for it being withheld earlier, the Commissioner must find that it breached regulation 5(1) of the EIRs in failing to make the information available in response to the Applicant's request or requirement for review.

18. The Council provided the information that it was continuing to withhold under regulation 11(2) of the EIRs and the case was allocated to an investigating officer.

19. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions. These related to the actions and searches undertaken by the Council to determine what recorded information it held falling within scope of the Applicant's request, together with the reasons for applying regulation 11 to information deemed to be personal data.

20. During the investigation, the Applicant provided further submissions as to why he considered it to be in both his and the wider public's interest that all information currently still being withheld from him should be made public. The Applicant also referred to certain information the Council had made available to him and questioned whether other related information was held.

Commissioner's analysis and findings

21. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Council. He is satisfied that no matter of relevance has been overlooked.

Handling in terms of the EIRs

22. The Council processed the Applicant's request and requirement for review in accordance with the EIRs.

23. Where information falls within scope of the definition of "environmental information" in regulation 2(1) of the EIRs, a person has a right to access it (and the public authority a corresponding obligation to respond) under the EIRs, subject to various restrictions and exceptions contained in the EIRs.

24. The Applicant has not challenged the Council's decision to deal with the information as environmental information. The Commissioner is satisfied that the information does compromise environmental information (see, in particular, definitions (a), (b) and (c) of environmental information in regulation 2(1) of the EIRs) and will consider the handling of the request in what follows solely in terms of the EIRs.

Regulation 5(1) of the EIRs - Duty to make environmental information available

25. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by an applicant. The obligation relates to information that is held by the authority when it receives a request.

26. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within scope of the request. Having done so, regulation 5(1) requires the authority to provide that information to the requester, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).

27. In order to ascertain whether all relevant information had been identified, the Council was asked to explain the steps it took to establish what information it held that fell within the terms of the Applicant's request.

28. The Council explained that it has a statutory obligation, as a planning authority, to hold information about each and every planning application it receives, and all information received or generated by it in relation to a planning application is held in its planning system. This, the Council submitted, is a standard system used across all Scottish planning authorities. The Council commented that all information is transferred promptly to this system and it has proven unlikely that any information relevant to a planning application will exist outside the system.

29. In terms of the searches carried out for information held in relation to this request, the Council explained that information was only sought from the system after the dates of previous requests, on the assumption that the previous requests had been handled correctly. The Council noted that all information for the two planning applications was requested from the dates of the respective previous requests and, in addition, the case officer was also asked for information falling within the same scope.

30. When asked about the provision of further information to the Applicant after the application was received by the Commissioner, the Council noted that this information had been retrieved as part of the original search, but it had been misidentified as falling outwith the timeframe of the request. However, as part of the multiple related appeals to the Commissioner, the Council commented that it was felt simplest to disclose them rather than to establish if the information had been disclosed in response to the earlier requests made by the same Applicant, which the Council suspected had been the case.

31. As mentioned above, during the investigation, the Applicant identified information he considered to be missing from what the Council had made available to him. Further submissions were sought from the Council on this matter and, following a search of deleted emails, certain additional information was located and subsequently made available to the Applicant, subject to the redaction of information the Council considered to be personal data exempt under regulation 11(2) of the EIRs. The Applicant confirmed he had received this information and noted that he accepted the redaction of email addresses belonging to Council officers. He did not, however accept the redaction of other information. This will be considered further in the Commissioner's consideration of the application of regulation 11(2) below.

32. The Applicant also questioned why there appeared to be an absence of information and explanation regarding a statement in one document, which suggested that follow-up action was required, but no information had been made available to him in relation to such action being taken. Following communication with the Council, the Council informed the Applicant of the reason behind the statement. However, the Applicant was not satisfied that he had been provided with all relevant information held by the Council.

33. The document containing the statement of concern to the Applicant was a Committee Action Sheet. The Council explained that each Report of Handling for a planning application is dealt with by three officers and normally any routine comments to the case officer are made verbally. In this case, however, a member of staff unused to the normal process had chosen to add these to the Committee Action Sheet. The Council provided an explanation to the Commissioner about the intention behind the comments, which were not considered particularly significant in relation to consideration of the planning application, and stated that there was no expectation that any recorded information would be held about the actions. The Council submitted that searches carried out by relevant staff members have also been unable to identify any relevant information regarding this.

34. The standard of proof to determine whether a public authority holds information is the civil standard of the balance of probabilities. In determining where the balance of probabilities lies, the Commissioner considers the scope, quality and thoroughness and results of searches carried out by the public authority. He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information.

35. Having considered all of the submissions from the Council and the terms of the request, the Commissioner is unable to accept that adequate and proportionate searches were carried out by the Council at the time it responded to the Applicant's request. The Commissioner accepts, based on its submissions, that the searches since carried out by the Council would have been capable of identifying all recorded information held by the Council and falling within the scope of the request. However, he is not satisfied that the Council made all relevant, recorded information available to the Applicant that it identified at the time it responded to his request. Furthermore, the Commissioner finds that, following further searches carried out during the course of the investigation, the Council located other information falling within scope of his request which it subsequently made available to him.

36. In the circumstances, the Commissioner finds that the Council failed to comply fully with regulation 5(1) of the EIRs in responding to the Applicant's request.

Regulation 11(2) of the EIRs - Personal data

37. The Council relied on the exception in regulation 11(2) (as read with regulation 11(3A)(a)) for withholding some information from what it made available following the Applicant's application to the Commissioner. Here, the Commissioner will consider the information which remained withheld under this provision at the close of the investigation.

38. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).

39. The Council has submitted that the redacted information constituted personal data, disclosure of which in response to this request would breach the first and second data protection principles in Article 5(1) of the UK GDPR ("lawfulness, fairness and transparency" and "purpose limitation").

Is the withheld information personal data?

40. The first question the Commissioner must address is whether the information is personal data in terms of section 3(2) of the DPA 2018.

41. "Personal data" is defined in section 3(2) of the DPA as "any information relating to an identified or identifiable individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

42. Information will "relate" to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.

43. An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.

44. In its submissions, the Council explained that the withheld information comprises information that specifically identified a living person, or linked with such information in the document, was identifiably about a living person.

45. Having considered the Council's submissions and the withheld information, the Commissioner accepts that the redacted information taken on its own, or in conjunction with other information contained in the documents, can be linked to a named individual (to whom it can be said to relate, in the circumstances) and so is satisfied that individual data subjects can be identified from the redacted information.

46. The Commissioner is therefore satisfied that the redacted information is personal data as defined in section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles?

47. Article 5(1)(a) of the UK GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."

48. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". For the purposes of the EIRs, personal data are processed when made available in response to a request. This means that the personal data can only be made available if doing so would be both lawful (i.e. it would meet one of the conditions for lawful processing in Article 6(1) of the UK GDPR) and fair.

49. The Council did not consider that any conditions in Article 6(1) applied in the circumstances of the case. In considering this, the Commissioner has looked at condition 6(1)(f) as the only one which might potentially apply in the circumstances.

Condition (f): legitimate interests

50. Condition (f) states that the processing will be lawful if it is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).

51. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.

52. The tests which must be met before Article 6(1)(f) can apply are as follows:

(i) Does the Applicant have a legitimate interest in obtaining the personal data?

(ii) If so, would making the personal data available be necessary to achieve that legitimate interest?

(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

53. There is no definition within the DPA 2018 of what constitutes a "legitimate interest", but the Commissioner takes the view that the terms indicate that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. In the Commissioner's published guidance on personal information[1] it states:

"In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

54. The Council explained that it had not asked the Applicant what his legitimate interests are. It commented that it had been unable to discern any legitimate interest in the disclosure of the personal data withheld. The Council noted that, in particular, it did not consider the withheld information to be significant in terms of the Applicant's request.

55. The Applicant submitted that he was entitled to receive the withheld information and explained that, in the time it had taken to process these planning applications, many alarming indicators and evidence had been uncovered which led him to conclude that the public interest (in relation to the Council's handling of the planning process) was not being well served in this instance.

56. The Applicant referred to several emails he had sent to and received from the Council regarding its handling of these planning applications, to justify why he was of the view that the planning process applied by the Council in this case was of serious concern to the public.

57. In the Applicant's view, the history contained in these emails has exposed a lack of any commitment to proper investigation and scrutiny when serious matters in regard to process are brought to the attention of the most senior responsible officers in the Council.

58. It is for these reasons the Applicant believes that the withheld information should be made public, in order that public scrutiny can enable accountability to be satisfied.

59. Having considered both the submissions from the Council and the Applicant, the Commissioner accepts that the Applicant was pursuing a legitimate interest in seeking to understand actions taken, and the process followed by, the Council in respect of the processing of these two planning applications.

60. However, the withheld information in this case comprises the direct contact details of various members of Council staff, together with, in some cases, comments made by certain members of Council staff. In one case handwritten initials of a member of Council staff have been redacted. The Commissioner recognises that these members of staff have been involved in either processing or responding to concerns raised by the Applicant about the handling of the planning applications, or involved in the processing of the applications themselves. However, he does not consider disclosure of the withheld information would add anything to the Applicant's understanding of why decisions were taken in the way that they were, or how well the process was followed when considering and processing these two planning applications. The identity of these Council officers is already clear from the information disclosed to the Applicant. The Commissioner does not, therefore, consider that the Applicant has a legitimate interest in receiving this information.

61. Other information that has been withheld concerns the name, contact details, signature and opinion of an Architect, together with the name and address of the recipient of the Architect's letter. The Commissioner understands that the redactions made to the information in this document were made in response to an information request from another individual (not the Applicant in this case). It appears that, rather than considering the content of the information in this document in light of the Applicant's request and legitimate interests, the Council disclosed the information to him in the same way as they had to the earlier requester.

62. Having examined the information that has been redacted, the Commissioner does not consider disclosure of that information would assist the Applicant in understanding any better the reasoning applied by the Council, or the actions taken by it, when considering and processing these two planning applications. However, he is of the view that the Council should have given consideration to the Applicant's request and own legitimate interests in accessing this information, rather than simply disclosing it in the same manner as it did to an earlier requester, whose legitimate interests may have been different.

63. As the Commissioner has concluded that the Applicant does not have a legitimate interest in receiving the personal data redacted in this case, he finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied. Accordingly, he accepts that making the personal data available would be unlawful.

64. Given that the Commissioner has found that the processing would be unlawful, he is not required to go on to consider separately whether making the personal data available is necessary to fulfil any legitimate interest, or the data subject's interests or fundamental rights and freedoms (or to balance them against any legitimate interest in making the information available).

65. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the GDPR being met, the Commissioner must conclude that making the personal data available would breach the data protection principle in Article 5(1)(a) of the UK GDPR. Consequently, he is satisfied that making the personal data available is not permitted by regulation 11(2) of the EIRs.

66. As mentioned previously, the Council also argued that making the withheld personal data available would breach the data protection principle in Article 5(1)(b) of the UK GDPR. Because the Commissioner has found that making the withheld personal data available would be unlawful in terms of the data protection principle in Article 5(1)(a) of the UK GDPR, he need not (and will not) go on to consider whether disclosure would also breach the data protection principle in Article 5(1)(b).

Decision

The Commissioner finds that Perth and Kinross Council partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.

The Commissioner finds that, by relying on the exception in regulation 11(2) of the EIRs for withholding some personal data, the Council complied with regulation 5(1) of the EIRs.

However, while the Commissioner accepted that searches carried out by the Council by the close of the investigation would have been capable of identifying all relevant, recorded information held, he is not satisfied that all relevant information identified at that time was disclosed to the Applicant. He also finds that the Council failed to identify other recorded information it held falling within scope of the request, which it subsequently made available to the Applicant. The Commissioner finds that the Council was not entitled to rely on regulations 10(5)(d) and 11(2) of the EIRs for withholding information that it subsequently made available during the processing of the application and investigation. The Commissioner therefore finds that the Council failed to comply with regulation 5(1) of the EIRs in this respect.

Given that the Council has made available the information it did not consider to be excepted from disclosure (and information identified during initial and subsequent searches) during the course of the processing of the application and investigation, the Commissioner does not require the Council to take any action in respect of these failures, in response to the Applicant's request.

Appeal

Should either the Applicant or the Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement
16 June 2021

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

…

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

(b) factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in paragraph (a);

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

"personal data" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

…

"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act); and

…

(3A) In these Regulations, references to the UK GDPR and the Data Protection Act 2018 have effect as if in Article 2 of the UK GDPR and Chapter 3 of Part 2 of that Act (exemptions for manual unstructured processing and for national security and defence purposes) -

(a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and

…

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -

(a) the first condition set out in paragraph (3A) is satisfied, or

(b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations -

(a) would contravene any of the data protection principles, or

…

(7) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

UK General Data Protection Regulation

Article 5 Principles relating to processing of personal data

1 Personal data shall be:

a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")

…

Article 6 Lawfulness of processing

1 Processing shall be lawful only if and to the extent that at least one of the following applies:

…

f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

Data Protection Act 2018

3 Terms relating to the processing of personal data

…

(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -

…

(d) disclosure by transmission, dissemination or otherwise making available,

…

(5) "Data subject" means the identified or identifiable living individual to whom the data relates.

…

(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).

…

(14) In Parts 5 to 7, except where otherwise provided -

(a) references to the UK GDPR are to the UK GDPR read with Part 2;

…

(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;

(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.

---