Decision 113/2016: Mr Ganesh Sittampalam and Aberdeenshire Council Stonehaven Town Action Plan Reference No: 201502141 Decision Date: 13 May 2016 Summary On 21 July 2015, Mr Sittampalam asked Aberdeenshire Council (the Council) for the Stonehaven Town Action Plan (the Plan), along with any letters sent out to business owners listed in the Plan. The Council responded by disclosing a redacted copy of the Plan and a template for the letters, withholding the remaining information as either commercially sensitive or personal data. Following a review, Mr Sittampalam remained dissatisfied and applied to the Commissioner for a decision. The Commissioner investigated and found that the Council had partially failed to respond to Mr Sittampalam's request for information in accordance with Part 1 of FOISA. She concluded that the Council incorrectly withheld information under the exemptions under sections 33(1)(b) (Commercial Interests and the economy) and 38(1)(b) (Personal information) of FOISA. The Commissioner required the Council to disclose the wrongly withheld information to Mr Sittampalam.

  Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2)(a)(i) and (2)(b) and (5) (definitions of "data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedule 1 (The data protection principles, Part I: the principles) (the first data protection principle) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

  Background

1. On 21 July 2015, Mr Sittampalam made a request for information to the Council. The information requested was a copy of the Plan, along with any letters to owners in the area requesting alterations to their properties.

2. The Council responded on 14 August 2015 by disclosing a redacted version of the plan and the template on which the letters were based. It explained it was withholding the remaining information under section 33(1)(b) (Commercial interests and environment) and 38(1)(b) (Personal information) of FOISA to withhold information.

3. On 25 August 2015, Mr Sittampalam wrote to the Council, requesting a review of its decision. Referring to existing media coverage, he disagreed with the Council's application of exemptions to the names of businesses redacted from the Plan.

4. The Council notified Mr Sittampalam of the outcome of its review on 22 September 2015, continuing to withhold the information in question but with more detailed reasoning.

5. On 14 November 2015, Mr Sittampalam wrote to the Commissioner. He applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr Sittampalam stated he was dissatisfied with the outcome of the Council's review. He did not accept that the exemptions applied to the redaction of business names from the Plan, particularly where those businesses "had already made the general existence of criticisms public".

  Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Sittampalam made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

7. On 27 November 2015, the Council was notified in writing that Mr Sittampalam had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr Sittampalam. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested.

  Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Sittampalam and the Council. She is satisfied that no matter of relevance has been overlooked.

10. The Commissioner has interpreted the application as relating to owners' names redacted from the Plan. She does not interpret it as extending to the letters referred to in Mr Sittampalam's information request.

11. The Commissioner will now consider each exemption applied to the withheld information in turn.

Section 33(1)(b) - Commercial interests and the economy

12. Mr Sittampalam referred to media articles where two business owners had spoken out about the plan, in other words, they had actively sought publicity. He argued it was in the public domain already that there was a plan for businesses in the Stonehaven local area so it would be common knowledge which businesses were named in the plan.

13. Section 33(1)(b) provides that information is exempt information if its disclosure under FOISA would, or would be likely to, prejudice substantially the commercial interests of any person (including a Scottish public authority). Section 33(1)(b) of FOISA is subject to the public interest test in section 2(1)(b) .

14. There are a number of elements an authority must demonstrate are present when relying on this exemption In particular, it must show:

(i) Whose commercial interests would, or would be likely to, be harmed by disclosure;

(ii) The nature of those commercial interests; and

(iii) How disclosure would, or would be likely to, prejudice substantially those interests. The prejudice must be substantial: in other words, or real and demonstrable significance.

15. The Council submitted that disclosure of the withheld information would be likely to prejudice the commercial interests of the businesses named in the plan. The Council suggested some businesses might not be in a position to make improvements, for legitimate reasons. It highlighted the potential for negative publicity arising from businesses being publicly identified, which it believed was likely to deter visitors and have a negative effect on their sales or bookings.

16. The Council also submitted that disclosure of the business names in these circumstances might deter new businesses from coming to the area, as they might deem such action to be unfair.

17. The Council explained that the town had been bypassed some years previously and, in addition, there were restrictions on access from the south via the Bervie Braes road. It was "all too easy", therefore, to bypass the town completely. Local groups had worked hard to promote the town and attract visitors, and the Council believed this work would be endangered if the withheld information were to be disclosed. Potential visitors might get the impression that Stonehaven was not an attractive town, and not come.

18. The Commissioner has difficulty relating the Council's submissions to the actual information withheld in this case. Firstly, approximately half the entries which have been redacted do not relate to commercial entities at all, but to providers of public services in the area. In the majority of cases, these are Scottish public authorities under FOISA (including the Council).

19. The Commissioner has accepted in previous cases that there may be circumstances in which entities of this kind have commercial interests. Here, however, the information relates to the performance of public functions or the general maintenance of property used for such functions. The Commissioner fails to see how any of it could be said to relate to commercial interests any of these service providers might have.

20. The same can be said of information relating to private domestic properties - the owners of these properties do not have relevant commercial interests, except to the extent that they are landlords (and these do not appear to be the kinds of commercial interests the Council has in mind here) - and those occupied by voluntary organisations. It is not even clear whether, to the extent that there are individual commercial entities identified, or identifiable, from the withheld information, it is the particular commercial interests of these entities the Council has in mind.

21. Even if it is assumed that the Council is concerned about the impact of disclosure on these specific businesses, it not at all clear how it believes this might come about. The Commissioner will go on to consider the general argument about visitors being deterred from coming to the town below, but why any deterrent effect should make itself felt on specific individual businesses is unclear. If the visitors were to come at all, it appears likely (in the absence of evidence to the contrary) that they would base any decisions on which businesses to visit on appearances once they got there, rather than on the Plan. For good or ill, there is nothing the Plan can do about such actual appearances.

22. The Council's submissions do mention "bookings" and the Commissioner acknowledges that judgements made in advance may be relevant to choices made in respect of overnight accommodation. Having considered the relatively minor comments relating to such premises, and given the broad, speculative nature of the Council's assertions in this area as in others, the Commissioner cannot accept that choices on overnight accommodation would be likely to be influenced significantly by the withheld information.

23. The most that can be drawn from the submissions provided, therefore, is that the Council has a general apprehension that the commercial standing and attractiveness of the town would be likely to be harmed by disclosure of the withheld information, to the general detriment of the existing businesses there. The Commissioner can see the relevance to this line of argument of potential visitors being deterred from coming to Stonehaven, but she would still need to be persuaded that this was the likely effect of disclosure. In this connection, she needs to consider the content of the withheld information.

24. The withheld information relates to locations where action is seen to be required, references to those involved, or to be involved, in the proposed action, and ownership details for the properties concerned. In a number of cases, this last column identifies a particular entity (generally the Council or a service within the Council) as owner - otherwise, ownership is identified simply as "private".

25. On the other hand, for the most part, the Council has disclosed the vast majority of the column headed "issues" - the column detailing the areas of concern, on which action is seen as necessary. If anything were likely to have the negative impact the Council appears to be claiming, it appears to the Commissioner that it would be the information in this column. The Commissioner is not suggesting that this would be likely in fact - that appears to be overstating the case somewhat - but this appears to be the only category of information in the Plan which could conceivably have the deterrent effects feared by the Council.

26. The Council has also mentioned a fear that new businesses might be deterred from coming to Stonehaven if the withheld information were to be disclosed. It is not clear whose commercial interest the Council believes this might affect and, in any event, the Council's submission on this point is too broad, unfocused and speculative for the Commissioner to consider usefully.

27. The Commissioner has also noted the Council's comment that the town is easy to bypass completely. She understands that has been the case for some time. Visitors bypassing the town will, presumably, be those whose ultimate destination is somewhere else. In the absence of further evidence, it seems unlikely that a decision on where to make a brief stop en route would be influenced unduly by consideration of a document such as the Plan. In any case, the Council seems to discount the possibility - which seems equally (if not more) plausible in the circumstances - that the Plan might encourage visitors, aware that this is a town committed to making itself more attractive.

28. In the absence, therefore, of more detailed, focused submissions on how harm of the kind the Council has described could be expected to follow from disclosure of the withheld information, the Commissioner must conclude that the Council's fears are unsubstantiated. She is not satisfied that the tests for this exemption have been met for any of the withheld information.

29. As the information cannot be considered exempt under section 33(1)(b), the Commissioner must find the Council was not entitled withhold the information under that exemption. In the circumstances, the Commissioner is not required to go on to consider the application of the public interest test.

30. The Council also withheld the information under section 38(1)(b) of FOISA, which the Commissioner must now consider.

Section 38(1)(b) - Personal information

31. The Council also applied the exemption in section 38(1)(b) of FOISA to the withheld information. For section 38(1)(b) of FOISA to apply, the withheld information must be personal data.

Whether the withheld information is personal data

32. "Personal data" are defined in section 1(1) of the DPA as "data which relate to a living individual who can be identified form those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller" (the full definition is set out in Appendix 1).

33. The Council did not differentiate any of withheld data when deciding what, if any, was personal data.

Data set 1

34. The Commissioner has identified data set 1 as being -

? All entries in the "ownership" column of the Plan

? All references to the Council and its services and properties

? All references to businesses and other organisations and their premises, with no apparent personal connotations

? References to the holders of particular public offices, with no other personal connotations.

35. The Council did not comment in any detail on how the information in data set 1 met the definition in section 1(1) of the DPA. Its submissions on section 38(1)(b) refer only to the names and addresses of individuals. In the absence of detailed arguments on this point, the Commissioner has considered data set 1 carefully. She has no basis for concluding that any of the information in data set 1 can be considered personal data.

36. As indicated above, the "ownership" column identifies private ownership very largely as that - "private", with nothing to identify who the owner is. The few instances which identify individual owners other than the Council are, with one exception, references to bodies corporate or voluntary associations. On the information available to her, the Commissioner cannot see how living individuals could be identified from this information. The same, obviously, follows for references to these entities in other columns.

37. The Commissioner is satisfied that the exception referred to in the previous paragraph comprises the personal data of a particular property owner. They could be identified from it and, in relating to their personal business interests, it relates to them.

38. Elsewhere in the Plan, there are references to businesses which are clearly corporate entities. Where the references relate to specific premises occupied by these businesses, the Commissioner cannot accept that these references relate to living individuals who can be identified from them, whether taken by themselves or with other available information. She finds that section 38(1)(b) of FOISA cannot apply to this information as it cannot be said to comprise personal data. As section 33(1)(b) of FOISA was incorrectly applied to this information, the Commissioner requires the Council to disclose this information to Mr Sittampalam. This includes the whole of the "ownership" column of the Plan, with the exception of the names of one proprietor (see paragraph 37 above) and one Council employee, which the Commissioner accepts in the circumstances as being sufficiently "about" the individual in question to be their personal data: these exceptions will be considered further below, under "Data set 2".

39. On the other hand, there are instances where the business is used as a point of reference, e.g. to premises "by" or "above" the business premises in question. There are also specific references to the premises of a number of small businesses, which do not appear to be incorporated. In these cases, in a relatively small community, the Commissioner accepts that there is a genuine risk of individual proprietors being identifiable - in which case, the information (in relating to private business interests) would relate to the individuals concerned and be their personal data. The Commissioner will consider these data further below, along with what she has identified as data set 2.

40. Some references to the holders of public offices have been redacted. The reference in each case is to the office and does not identify the holder by name. While the holder could be identified from the reference, the Commissioner does not accept, in this context, that the reference in question relates to a specific individual. In each case, a matter of concern is being referred to the holder of that particular office, to action in a professional capacity: there is no suggestion that any of these matters necessarily requires the personal attention of that office holder, and it might equally well be attended to by someone else in the relevant office or establishment. Equally, the reference in question does not depend on the office holder being a particular person: the holder could change and the relevant point in the plan would remain equally valid. In the circumstances, the Commissioner does not consider these references to comprise the personal data of the office holder concerned.

Data set 2

41. The remaining redacted data is referred to from now on as data set 2. In the Commissioner's view, the following redacted passages clearly identify living individuals:

? Any redactions in which individuals are named

? Any references from which particular residential addresses can be identified, either directly or by proximity (see paragraph 39 above).

42. In these cases, the Commissioner is satisfied that living individuals could be identified from the redacted information, particularly in a relatively small community. In relating to their personal residential addresses, it relates to the individuals who live there (and potentially to the owners, if different). Therefore, the Commissioner accepts that this information is, in this case, the personal data of the individuals concerned, as defined by section 1(1) of the DPA.

43. On the other hand, the Commissioner is satisfied that the withheld information from which residential addresses could be identified can, with more judicious redaction, be deprived of that quality. It would then cease to be personal data. This would involve the removal of house names and numbers, along with other locational data of the kind referred to in paragraph 39 above.

The first data protection principle

44. The Council stated that section 38(1)(b) of FOISA applied to the withheld information because disclosure would breach the first data protection principle.

45. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be disclosure of the information into the public domain, in response to Mr Sittampalam's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. If the personal data are also sensitive personal data, at least one of the conditions in Schedule 3 must also be met: the Commissioner has considered the definition of sensitive personal data in section 2 of the DPA and is satisfied that this does not apply to the withheld information.

46. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether the disclosure of the personal data would be fair and lawful.

Can any conditions in Schedule 2 be met?

47. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit disclosure of personal data to Mr Sittampalam. In any event, neither Mr Sittampalam nor the Council has argued that any other conditions would be relevant.

48. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller, or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individuals to whom the data relate).

49. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

a. Is Mr Sittampalam pursuing a legitimate interest or interests?

b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subjects?

c. Even if the processing is necessary for Mr Sittampalam's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms of legitimate interests of the data subjects?

50. There is no presumption in favour of disclosure of personal data under the general obligation laid down by section 1(1) of FOISA. Accordingly, the legitimate interests of Mr Sittampalam must outweigh the rights and freedoms or legitimate interests of the data subjects before condition 6 will permit personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to Mr Sittampalam.

Is Mr Sittampalam pursuing a legitimate interest or interests?

51. Mr Sittampalam submitted that to the extent that any personal information was involved, such data had probably deliberately been made known by the data subject already, or its disclosure would be fair in pursuance of the legitimate interest in scrutiny of the Council.

52. Having considered all relevant submissions she has received on this point, along with the withheld personal data, the Commissioner accepts that Mr Sittampalam and the wider public do indeed have a legitimate interest in scrutinising the Council's Plan.

Is the processing necessary for the purposes of these interests?

53. When considering this, the Commissioner must consider whether the interests she has identified might reasonably be met by any alternative means, which would interfere less with the privacy of the individuals whose personal data has been withheld.

54. The Council submitted that any legitimate interest Mr Sittampalam had in finding out what was in the Plan could be achieved by means of the redacted copy he had already.

55. In his application, Mr Sittampalam complained that he was unable to tell exactly which comments applied to which businesses just from publicly available information and the redacted Plan supplied to him by the Council. He argued that the precise comments made about these businesses should be revealed, so that both sides of the "argument" (as aired in the media) could be properly understood.

56. The Commissioner is not aware of any other viable means of meeting Mr Sittampalam' s legitimate interest which would interfere less with the privacy of the data subjects than providing the information requested. For this reason, and having considered all relevant submission, she is satisfied the disclosure of the information is necessary for the purposes of Mr Sittampalam's legitimate interests. Given the nature of the document, and of Mr Sittampalam's arguments, she does not believe it is possible in this context to distinguish "businesses" in the strict sense of the word from others who have been the subject of comments.

Would disclosure be unwarranted by reason of prejudice to the legitimate interest of the data subjects?

57. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr Sittampalam' s legitimate interests, she must now consider whether disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Mr Sittampalam and those of the data subjects. Only if the legitimate interests of Mr Sittampalam outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

58. In the Commissioner's briefing on personal information[1], she notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

(i) The potential harm or distress that might be caused by disclosure

(ii) Whether the individual objected to the disclosure

(iii) The reasonable expectations of the individual as to whether the information should be disclosed.

59. The Council provided only the most basic submissions to the effect that disclosure would breach the first data protection principle. The Commissioner has considered all relevant submissions she has received carefully, along with the withheld personal data. In some places, particularly in relation to private domestic addresses, it appears clear that the individuals concerned would have no reasonable expectation of their personal data being disclosed. In others, the arguments may be less compelling, but the Commissioner is prepared to accept that the individuals concerned would not have expected disclosure of their personal data in the context of the Plan. The Commissioner notes what Mr Sittampalam has said in relation to media coverage of certain businesses, but she really has no way of knowing the precise context in which these names became public - and she certainly has no direct knowledge of the expectations of the other businesses.

60. In all the circumstances, therefore, having weighed Mr Sittampalam' s legitimate interests against the legitimate interests, rights and freedoms of the data subjects, the Commissioner has concluded that those of the data subjects outweigh those of Mr Sittampalam. As a result, she has determined that disclosure of the withheld personal data would be unwarranted in this case.

61. In the absence of a condition permitting disclosure, the Commissioner must find that disclosure to be unlawful. It would also, in the circumstances narrated above, be unfair. It would be contrary to the first data protection principle. The Council was therefore entitled to withhold the personal data under section 38(1)(b) of FOISA.

62. However, the Commissioner must now return to her findings in paragraph 42 above. The Council is required to provide Mr Sittampalam with such information as can be disclosed without disclosing personal data, as described in that paragraph.

63. To assist the Council in identifying what should be disclosed to Mr Sittampalam, the Commissioner will provide it with a marked up copy of the Plan.

Additional comment

64. The Commissioner is concerned that a good deal of the information the Council has attempted to withhold in this case relates to the Council itself. There would appear to be no reasonable basis for applying either of the exemptions claimed by the Council to this information. There would appear to be no obvious reason for withholding information of this kind, other than to protect the Council from possible embarrassment. The Commissioner would ask the Council to remember that this is not the purpose of FOISA.

Decision The Commissioner finds that Aberdeenshire Council (the Council) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr Sittampalam. The Commissioner finds that by disclosing some information in the Plan, the Council complied with Part 1. It was also entitled to withhold information under section 38(1)(b) of FOISA. However, the Commissioner also finds the Council incorrectly applied the exemption in section 33(1)(b) (and, in part, section 38(1)(b)) to the withheld information. By failing to disclose this information, the Commissioner finds the Council failed to comply with Part 1 (and in particular section 1(1)) of FOISA. The Commissioner therefore requires the Council to disclose parts of the withheld information, as identified in a marked-up copy of the Plan, by 27 June 2016.

 Appeal

Should either Mr Sittampalam or Aberdeenshire Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

 Enforcement

If the Council fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that The Council has failed to comply. The Court has the right to inquire into the matter and may deal with The Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

13 May 2016

  Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

?

(e) in subsection (1) of section 38 -

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

33 Commercial interests and the economy

(1) Information is exempt information if-

(a) it constitutes a trade secret; or

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

?

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

...

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?

 Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

---