Decision 130/2021: 2019 Salmon/Sea Trout catch data
Public authority: Scottish Ministers
Case Ref: 202001146
Summary
The Ministers were asked for salmon and trout catch data at fishery district level (for 2019) across Scotland.
The Ministers disclosed some aggregated information, but withheld some district-level information as it could be linked to living individuals.
The Commissioner investigated and found that, although the data could be linked to third parties indirectly using existing knowledge with other information available, it was still fair and lawful to disclose the data under the EIRs.
Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definitions of "the data protection principles", "data subject", paragraphs (a),(c) and (f) of definition of "environmental information" "personal data" and "the UK GDPR" and (3A)(a) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3A)(a) and (7) (Personal data)
United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. It may be helpful to explain that the withheld information involves data about fish caught in fishery districts in Scotland. These are defined by statute and are usually the catchment of a single river that drains into the sea, together with the adjacent coast; some districts are groups of neighbouring small river catchments and associated coastlines. Within districts are individual private fisheries.
2. On 29 April 2020, the Applicant made a request for information to the Scottish Ministers (the Ministers). The information requested was the catch data for salmon and sea trout for all 109 fishery districts in Scotland for the year 2019. Noting that the catch data for the year in question had been restricted because of the GDPR, he sought an explanation of how catch information from a single fishery district could be extrapolated into private information about the proprietor.
3. The Ministers responded on 15 May 2020, applying the exemption in section 39(2) of the Freedom of Information (Scotland) Act 2002 (FOISA) and dealing with the request under the EIRs. They withheld the catch data under regulation 11(2) of the EIRs. The Ministers considered the information comprised the personal data of third parties, which could not be disclosed in compliance with the GDPR. An explanation was provided.
4. On 15 May 2020, the Applicant wrote to the Ministers, requesting a review of their decision. He did not agree that he was seeking personal data and so challenged the application of regulation 11(2).
5. The Ministers notified the Applicant of the outcome of their review on 27 August 2020, generally upholding their position. They disclosed some information, which they accepted was not personal data.
6. On 17 September 2021, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant was dissatisfied with the review outcome because the information he sought was simply about numbers of fish caught, which could not, in his view, be the personal data of the proprietors concerned.
Investigation
7. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
8. On 5 October 2021, the Ministers were notified in writing that the Applicant had made a valid application. The Ministers were asked to send the Commissioner the information withheld from the Applicant. The Ministers provided the information and the case was allocated to an investigating officer.
9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Ministers were invited to comment on this application and to answer specific questions. These related to their rationale for categorising the withheld information as personal data and their approach in applying regulation 11(2) of the EIRs.
Commissioner's analysis and findings
10. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both the Applicant and the Ministers. He is satisfied that no matter of relevance has been overlooked.
11. The Applicant sought data for all 109 districts in Scotland, i.e. an entire "data set" for Scotland. This would give him all Scottish salmon and trout catch data for 2019, as had been the case in previous years when this annual data was published routinely in its entirety. He had made an information request because some of the 2019 data were presented in an aggregated format (amalgamating smaller districts) and this was a departure from previous years. In the Ministers' view, their review outcome disclosed all the information they could without it being possible to identify individuals.
12. The issue for the Commissioner here is whether the Ministers were entitled to aggregate and therefore withhold information for certain districts, applying regulation 11(2) of FOISA. The Applicant has not disputed the Ministers' decision to deal with this request under the EIRs and the Commissioner is satisfied that this was an appropriate decision in the circumstances: the request relates to reporting on aspects of the state of the elements of environment, including natural sites and biological diversity (paragraph (a) of the definition of "environmental information" in regulation 2(1) of the EIRs). In what follows, therefore, the Commissioner will consider the Ministers' handling of the request solely in terms of the EIRs.
Regulation 11(2) - Personal data
13. In terms of regulation 10(3) of the EIRs, a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2), read in conjunction with regulation 11(3A)(a), provides that personal data of which the applicant is not the data subject (applying the relevant definitions in section 3 of the DPA 2018) shall not be made available where its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018. There is no public interest test to be considered where this limb of regulation 11(2) applies.
14. To rely on this provision, therefore, the Ministers must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Article 5(1) of the UK GDPR.
Is the withheld information personal data?
15. The first question the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 - see Appendix 1.
16. Information that could identify individuals will only be personal data if it relates to those individuals. Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
17. The Applicant submitted that the requested information comprised records of wild fish catches and could not be ascribed to specific proprietors. It could not, therefore, be described as personal data.
18. In the Ministers' view, the withheld information could be linked indirectly to individual proprietors (or occupiers) and therefore related to them and would be their personal data.
19. In the case of Breyer v Bundesrepublik Deutschland[1] the Court of Justice of the European Union looked at the question of identification. The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified. When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is insignificant, the information will not be personal data.
20. The Ministers submitted that, in some cases, the proprietors/occupiers in question were living individuals, sole traders or small partnerships, in which case the data would be considered personal in accordance with the definition in section 3(2) of the DPA 2018. The catch information, if made available, could be linked with information available from the Scottish Assessors website (ownership/tenancy of fisheries being readily accessible there, on the valuation roll) to provide personal information which could be used to inform decisions about the economic, cultural or social identities of the individuals concerned. The information thus disclosed could be linked indirectly to those individuals and so related to them.
21. In support of this contention, the Ministers gave two examples using specific districts and returns within the 2019 dataset, describing how catches for individual fisheries (capable of being identified with particular living individuals) could be calculated in some cases.
22. The Commissioner must be careful not to disclose the withheld information in his reasoning. This restriction limits the level of detail he can give to justify his conclusion. (This factor has been acknowledged by the courts. In the case of Scottish Ministers v Scottish Information Commissioner (William Alexander's Application) [2007] CSIH 8[2], the Court of Session commented that, in giving reasons, the Commissioner is necessarily restrained by the need to avoid disclosing information which ought not to be disclosed.)
23. In this case, the Commissioner accepts the Ministers' argument that information on the earning capacity of individual fisheries (and therefore of their individual proprietors/occupiers) can be derived from the withheld data, linked with existing knowledge and data already placed in the public domain.
24. On balance, therefore, having considered all relevant submissions, the Commissioner is satisfied that the information under consideration here could be used, in conjunction with other information readily accessible, to identify catches attributable to particular fisheries which could be identified with particular living individuals as proprietors or occupiers. While acknowledging the points made by the Applicant in this case, the Commissioner also accepts that the information in question would be of some economic or cultural/social significance to the individuals in question. It could, therefore, be said to relate to them.
25. The Commissioner is therefore satisfied that the withheld information comprises personal data as defined in section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
26. The Ministers contended that disclosure of this data would breach Article 5(1)(a) of the UK GDPR, which requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject". The definition of "processing" is wide and includes "disclosure by transmission, dissemination or otherwise making available" (section 3(4)(d) of the DPA 2018).
27. In the case of the EIRs, personal data are processed when disclosed in response to a request. Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
28. The Commissioner will first consider whether any of the conditions in Article 6(1) can be met. Generally, when considering whether personal data can lawfully be disclosed under FOISA, only condition (f) (legitimate interests) is likely to be relevant.
Condition (f): legitimate interests
29. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data …"
30. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
31. The tests which must be met before Article 6(1)(f) can be met are as follows:
- Does the Applicant have a legitimate interest in obtaining the personal data?
- If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
- Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?
Does the Applicant have a legitimate interest in obtaining the personal data?
32. The Applicant provided statements setting out his legitimate interest comments, with supporting evidence. In these statements, the Applicant explained he had a background in researching this issue in the context of aquaculture development and related decision making by planning authorities, including Marine Scotland's role in regulating wild fish stocks, and the impacts of such development on local wild fisheries.
33. The Applicant further explained why he was interested in the detail of the data by district. He stated that salmon catch data had been restricted to about half the previous number of fishery districts. From 2015, the Scottish Government had been obliged by its commitment to the North Atlantic Salmon Conservation Organisation to introduce Conservation Gradings, which affected whether anglers could keep the fish they caught or not. The Applicant stated that, to calculate the Conservation Grading, it was essential to know the catch data for the river.
34. The Applicant was concerned that there was a double standard emerging here, as he submitted "on the one hand, the Scottish Government is restricting the supply of data to a wider audience yet is happy to provide [the data at district level] to ensure that anglers can catch (and kill) wild salmon."
35. The Ministers understood the Applicant's position to be that the information could be useful to fishery scientists as an aid to research into what was happening to wild fish populations within districts, as well as to inform decisions about future conservations strategies. The Ministers stated they remained unclear what legitimate interest the Applicant had in catch data at such a small geographical scale, rather than the slightly larger scale for which data were published. They did, however, agree that there was societal interest in researching, monitoring and managing local salmon stocks, and that the Applicant did have some legitimate interest in obtaining the information requested.
36. Having considered all relevant submissions, the Commissioner is satisfied that the Applicant does have a legitimate interest in the withheld information, at the level requested, for the reasons he has explained.
Is disclosure of the personal data necessary?
37. Having accepted that the Applicant has a legitimate interest, the Commissioner must consider whether disclosure of the personal data is necessary to meet that legitimate interest.
38. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
39. The Commissioner notes the Minsters have already disclosed aggregated data, but that the Applicant has asked a breakdown to district level, for the reasons set out above.
40. The Ministers submitted that aggregated fishery data are released by them as (a) Official Statistics (b) as part of statutory consultation on legislative measures used to conserve salmon stocks and (c) in response to requests for environmental information. The Ministers considered the disclosed data to be sufficient to allow local management effectiveness to be scrutinised and to allow researchers to investigate reasons for changes in stock levels at a local level, whilst also protecting personal data. In their view, the information disclosed to date, in combination with the routine publication of data detailed above, was sufficient for the Applicant's legitimate interest to be met.
41. To support his position, the Applicant supplied the investigating officer with a video showing how catch data could be used to study the biology of, and reasons for, declines in these types of wild fish population. A key point in that video is missing data and the effects on statistical analysis, particularly in "smoothing" fluctuations and gaps in data samples, year on year: the importance of sufficiently similar data sets, year on year for the whole of Scotland, was key.
42. Having reviewed the information disclosed and publicly available, the Commissioner is not satisfied that the Applicant's legitimate interests have been met here in full, given the effects of aggregation and the issues it creates for understanding what is happening to populations in individual river catchments, year on year. To address the Applicant's legitimate interests fully, the Commissioner accepts that it would be necessary to have the withheld personal data.
43. In the circumstances here, the Commissioner accepts that disclosure of the withheld information would be necessary in order to satisfy the legitimate interests identified.
Interests of the data subjects
44. The Commissioner has acknowledged that disclosure of the withheld information would be necessary to achieve the Applicant's legitimate interests. This must be balanced against the interests or fundamental rights and freedoms of the data subjects (proprietors/occupiers). Only if the legitimate interest of the Applicant outweighed those of the data subjects could personal data be disclosed without breaching the first data protection principle.
45. The Ministers provided clarifications in relation to two versions (versions 4 and 5) of their Privacy Notice which were in circulation to proprietors/occupiers at the time when the withheld data was obtained and subsequently. Version 4 would have been provided to all fisheries in receipt of a catch return at the end of the 2019 fishing season, while version 5 would have been provided at the end of the 2020 season (after the submission of data set under consideration here, although it may have influenced expectations as to what would happen to that earlier data set). In any case, it is not apparent that either version creates a particularly strong expectation that (personal) catch data would not be made available in response to a request for environmental information.
46. The Ministers confirmed that, while individuals had not specifically objected to disclosure, officials' experience of working with the data providers and wider industry, meant they were strongly of the view that many would, if asked, object to any release of their personal data. They gave an example (in relation to a different data set) in support of this view, where the individual in question believed the data had been used in a derogatory way, and also submitted that others had indicated that they objected to any processing of their personal data resulting in the data being made public. The Ministers understood the general view to be that the individuals considered the data to be "theirs": they were compelled to report it, but the Ministers had a corresponding duty to maintain privacy.
Commissioner's conclusions
47. The Commissioner has considered the likely expectations of the data subjects, the Ministers' claims for which appear to be based on very limited evidence, along with the potential for harm or distress being caused by disclosure of the information. Disclosure under the EIRs is a public disclosure and, in this case, disclosure of the information would publicly link the data subjects to an actual catch figure and, possibly, create some scope for financial and reputational consequences. The submissions offered in relation to such consequences are, however, anecdotal at best and lack any real substance. On the basis of these submissions, the Commissioner has difficulty accepting that harm would be likely or (if it were) of any real consequence.
48. After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights and freedoms of the data subjects, the Commissioner finds that the legitimate interests of the Applicant in disclosure of the withheld data outweigh those of the data subjects in this case. Consequently, he is satisfied that disclosure of the withheld personal data can be justified under Article 6(1)(f) of the UK GDPR. He can find no other reason why disclosure should be unlawful, or unfair, and therefore concludes that the Ministers were not entitled to withhold the data under regulation 11(2) of the EIRs.
49. Consequently, the Commissioner requires the Ministers to disclose the withheld personal data to the Applicant, by the date stated in this Decision.
Decision
The Commissioner finds that the Scottish Ministers (the Ministers) partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.
The Commissioner is satisfied that the Ministers complied with regulation 5(1) of the EIRs, to the extent that they disclosed some information in response to the Applicant's requirement for review.
However, the Commissioner finds that the Ministers failed to comply with regulation 5(1), by applying regulation 11(2) to information he finds was not properly excepted under that provision.
He requires the Ministers to disclose the withheld information to the Applicant by 18 October 2021.
Appeal
Should either the Applicant or the Ministers wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If the Ministers fail to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Ministers have failed to comply. The Court has the right to inquire into the matter and may deal with the Ministers as if they had committed a contempt of court.
Margaret Keyse
Head of Enforcement
2 September 2021
Appendix 1: Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations -
…
"the data protection principles" means the principles set out in -
(a) Article 5(1) of the UK GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
"data subject" has the same meaning as in the Data Protection Act 2018 (see section of that Act):
…
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
…
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
…
(f) the state of human health and safety, including the contamination of the food chain, where relevant, conditions of human life, cultural sites and built structures inasmuch as they are or may be affected by the state of the elements of the environment referred to in paragraph (a) or, through those elements, by any of the matters referred to in paragraphs (b) and (c);
"personal data" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);
…
"the UK GDPR" has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act); and
…
(3A) In these Regulations, references to the UK GDPR and the Data Protection Act 2018 have effect as if in Article 2 of the UK GDPR and Chapter 3 of Part 2 of that Act (exemptions for manual unstructured processing and for national security and defence purposes) -
(a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and
…
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
…
(b) is subject to regulations 6 to 12.
…
10 Exceptions from duty to make environmental information available
…
(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.
…
11 Personal data
…
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if -
(a) the first condition set out in paragraph (3A) is satisfied, or
(b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations -
(a) would contravene any of the data protection principles, or
…
(7) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the UK GDPR would be contravened by the disclosure of information, Article 6(1) of the UK GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.
…
UK General Data Protection Regulation
Article 5 Principles relating to processing of personal data
1 Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency")
…
Article 6 Lawfulness of processing
1 Processing shall be lawful only if and to the extent that at least one of the following applies:
…
f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.
Data Protection Act 2018
3 Terms relating to the processing of personal data
…
(2) "Personal data" means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) "Identifiable living individual" means a living individual who can be identified, directly or indirectly, in particular by reference to -
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(4) "Processing", in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as -
…
(d) disclosure by transmission, dissemination or otherwise making available,
…
(5) "Data subject" means the identified or identifiable living individual to whom the data relates.
…
(10) "The UK GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).
…
(14) In Parts 5 to 7, except where otherwise provided -
(a) references to the UK GDPR are to the UK GDPR read with Part 2;
…
(c) references to personal data, and the processing of personal data, are to personal data and processing to which Part 2, Part 3 or Part 4 applies;
(d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which Part 2, Part 3 or Part 4 applies.
