Decision 146/2014 Mr Fraser Hall and Glasgow City Council
Costing and contract information
Reference No: 201400198
Decision Date: 4 July 2014
Summary
On 29 April 2013, Mr Hall asked Glasgow City Council (the Council) for information relating to ground consolidation work carried out in Strathbungo. The Council provided some information. It acknowledged that it held other information, but did not provide that information.
Following an investigation, during which further information was disclosed, the Commissioner found that the Council was entitled to withhold the remaining information. However, she also found that it had failed to provide Mr Hall with responses that complied with the EIRs.
Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (paragraphs (a) and (c) of definition of "environmental information"); 5(1) and (2)(b) (Duty to make available environmental information on request); 10(1), (2), (3) and (5)(e) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (b) (Personal data); 13(a), (b) and (e) (Refusal to make information available); 16 (Review by Scottish public authority)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions - definition of "personal data"); Schedule 1 (The data protection principles - Part I, The principles (the first data protection principle)) and Schedule 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1. On 29 April 2013, Mr Hall wrote to the Council and, in relation to ground consolidation work carried out at Strathbungo, requested information which included the following:
a) the reconciliation to the individual properties of the aggregate GAV (Gross Annual Value) figure of ?96,918, and
b) the individual cost breakdown (audit trail i.e. the full breakdown of all costs) making up the contract sum of ?886,752.33.
2. The Council responded on 8 November 2013. It stated that it had no record of having received the letter of 29 April 2013, at least until a further copy was provided on 13 June 2013. In relation to part a) of his request, the Council informed Mr Hall that it was only required to give him information relative to his own account. In relation to part b), Mr Hall was informed that the information was held by another named person within the Council.
3. In a further response on 8 November 2013, the Council provided Mr Hall with a list detailing the GAVs of a number of properties.
4. Also on 8 November 2013, Mr Hall wrote to the Council, stating that he was dissatisfied with the response provided. In relation to part a) of the request, he considered the breakdown to be incomplete: he wished a breakdown of all properties, including (for example) where houses had been split into two. In relation to part b), he maintained this should be disclosed.
5. On 12 December 2013, following further correspondence, Mr Hall wrote to the Council and specifically asked that it review its decision in relation to parts a) and b) of his request.
6. The Council notified Mr Hall of the outcome of its review on 19 December 2013. It informed him that he had been provided with a full breakdown of the values applied and provided him with the contractor's final payment certificate and valuation for the contract, with a summary sheet outlining all further costs/charges. It stated that the priced Bill of Quantities was commercially sensitive and therefore would not be released.
7. On 15 January 2014, Mr Hall wrote to the Commissioner, stating that he was dissatisfied with the outcome of the Council's review and applying to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.
8. The application was validated by establishing that Mr Hall made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to those requests. The case was then allocated to an investigating officer.
Investigation
9. Mr Hall applied to the Commissioner regarding all four parts of his request of 29 April 2013. However, he only sought a review in relation to parts a) and b) and so these were the only parts the Commissioner could investigate.
10. On 13 February 2014, the investigating officer notified the Council in writing that an application had been received from Mr Hall, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the Council was asked to justify its reliance on any provisions of FOISA and the EIRs it considered applicable to the information requested, and to explain why it had handled Mr Hall's request in the manner it had.
11. During the investigation, the Council issued a further response to Mr Hall. It apologised for not dealing with his information request in line with the EIRs. The Council provided Mr Hall with some information, explaining that other information was being withheld in terms of regulation 11(2) of the EIRs (as personal data) and regulation 10(5)(e) on the basis that it was commercially sensitive.
12. In providing its submissions to the Commissioner, the Council repeated its apology and provided arguments supporting its position that the above exceptions applied.
13. Mr Hall confirmed receipt of the disclosure during the investigation, but still required a decision.
Commissioner's analysis and findings
14. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr Hall and the Council. She is satisfied that no matter of relevance has been overlooked.
Application of the EIRs
15. It is clear from the Council's correspondence with both Mr Hall and the Commissioner, and from the information itself, that the information sought by Mr Hall is properly considered to be environmental information, as defined in regulation 2(1) of the EIRs. It relates to ground consolidation works as a result of mining within the area; the Commissioner is satisfied that it would fall within either paragraph (a) of the definition of environmental information contained in regulation 2(1) (as information on the state of the elements of the environment) or paragraph (c) of that definition (as information on measures affecting or likely to affect those elements). Mr Hall has not disputed this and the Commissioner will consider the information in what follows solely in terms of the EIRs.
Regulation 5(1) of the EIRs
16. Regulation 5(1) of the EIRs (subject to the various qualifications contained in regulations 6 to 12) requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.
17. Under the EIRs, a public authority may refuse to make environmental information available if one or more of the exceptions in regulation 10 apply and, in relation to the exceptions contained in regulation 10(4) and (5), only if (in all the circumstances) the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.
Regulation 11(2) of the EIRs - personal data of another person
18. The Council submitted that the information withheld in response to part a) of Mr Hall's request were GAVs which were not otherwise publicly available. It submitted that the information comprised personal data, which were excepted in terms of regulation 11(2) of the EIRS.
19. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) excepts personal data where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in Schedule 1 to the DPA. The Council argued that to provide a further breakdown of the GAVs would enable Mr Hall, and others, to work out the amount billed to individuals, which would breach the first data protection principle.
Is the information under consideration personal data?
20. The definition of "personal data" is contained in section 1(1) of the DPA and is set out in the Appendix below. Having considered the information withheld under this exception and the submissions received from the Council on this point, the Commissioner accepts that the information meets the requirements set out in the definition. It is information from which the costs apportioned to individual proprietors could be identified, in conjunction with other information accessible to Mr Hall and others. Given the nature of the information, the Commissioner accepts that it relates to those individual proprietors.
The first data protection principle
21. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be making the information available in the public domain, in response to Mr Hall's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met (again, the full text of the principle is set out in the Appendix).
22. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be made available. If any of these conditions can be met, she must then consider whether making the information available would be fair and lawful.
23. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.
Can any of the conditions in Schedule 2 be met?
24. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit making the information available to Mr Hall. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).
25. There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:
a. Is Mr Hall pursuing a legitimate interest or interests?
b. If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?
c. Even if the processing is necessary for Mr Hall's legitimate interests, is that processing nevertheless unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
26. There is no presumption in favour of making personal data available under the general obligation laid down by regulation 5(1) of the EIRs. Accordingly, the legitimate interests of Mr Hall must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit making the personal data available. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to make the personal data available to Mr Hall.
Is Mr Hall pursuing a legitimate interest or interests?
27. The Council argued that Mr Hall had not provided a reason why he had a legitimate interest in the information. It acknowledged that he might have a personal interest in knowing what other GAV calculations were for neighbouring properties, but did not consider this to be of sufficient substance to amount to a legitimate interest for the purposes of condition 6. Therefore, it could identify no condition in Schedule 2 which would permit the personal data to be made available. In the absence of a condition permitting it to make the personal data available, the Council submitted that that it would be unlawful for it to do so.
28. Mr Hall was invited to make submissions on this point, but did not do so. Having considered the information, the Commissioner accepts that Mr Hall may have a personal interest in the withheld personal data but, in the absence of any submissions as to why this should amount to a legitimate interest for the purposes of condition 6, she accepts that his personal interest would not be of sufficient substance to amount to such a legitimate interest.
29. Given this conclusion, the Commissioner finds that there is no condition in Schedule 2 which would permit the personal data to be made available. In the absence of such a condition, it would be unlawful to make the personal data available. Consequently, the Commissioner finds that the Council would have breached the first data protection principle in making the data available, and so was entitled to withhold the data under regulation 11(2) of the EIRs.
Regulation 10(5)(e) of the EIRs
30. The Council submitted that the information withheld in response to part b) of Mr Hall's request was excepted from disclosure by virtue of regulation 10(5)(e) of the EIRs.
31. Regulation 10(5)(e) provides that a Scottish public authority may refuse to make environmental information available to the extent that its disclosure would, or would be likely to, prejudice substantially the confidentiality of commercial or industrial information where such confidentiality is provided for by law to protect a legitimate economic interest.
32. As with all of the exceptions contained within regulation 10, a Scottish public authority applying this exception must interpret the exception in a restrictive way (regulation 10(2)(a)) and apply a presumption in favour of disclosure (regulation 10(2)(b)). Even where the exception applies, the information must be released unless, in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception (regulation 10(1)(b)).
33. The Aarhus Convention: an Implementation Guide (which offers guidance on the interpretation of the Aarhus Convention, from which the EIRs are derived) notes (at page 60) that the first test for considering this exception is that national law must expressly protect the confidentiality of the withheld information: it must, the guidance states, explicitly protect the type of information in question as commercial or industrial secrets. Secondly, the confidentiality must protect a "legitimate economic interest": this term is not defined in the Convention, but its meaning is considered further below.
34. The application of regulation 10(5)(e) of the EIRs was fully considered in Decision 033/2009 Mr Paul Drury and East Renfrewshire Council[1] and the Commissioner does not intend to repeat that consideration in detail here. There, the Commissioner concluded that, before regulation 10(5)(e) can be engaged, authorities must consider the following matters:
? Is the information commercial or industrial in nature?
? Does a legally binding duty of confidence exist in relation to the information?
? Is the information publicly available?
? Would disclosure of the information cause, or be likely to cause, substantial harm to a legitimate economic interest?
Is the information commercial or industrial in nature?
35. It is apparent that the information relates to a contract to carry out ground consolidation works and, as such, the Commissioner is satisfied that the information is commercial in nature.
Does a legally binding duty of confidence exist in relation to the information?
36. The Council has presented the Commissioner with no specific submissions as to why a legally binding duty of confidence should exist in relation to the withheld information, other than to say that the relationship between the Council and the contractor brought with it an implied obligation of confidentiality between the parties in relation to the content of the pricing information, which was submitted during a commercial tendering process.
37. The Council explained that, while the contractor did not oppose disclosure of the total costs of the works or the provision by the Council of a description of them, they did view disclosure of the commercial rates for the works as a breach of the implied obligation of confidentiality existing between the parties.
38. Having considered the context within which the information was supplied to the Council, the Commissioner accepts that it was supplied subject to an implied obligation of confidence. Such an obligation may lapse with the passage of time but, given her conclusions on timing below, the Commissioner accepts that it remained in force at the time the Council responded to Mr Hall's requirement for review.
39. While the Commissioner accepts the Council's submissions on this point, those providing such information to a Scottish public authority must be aware that the information may still be disclosed under FOISA or the EIRs, where substantial prejudice is not evident or where it is deemed to be in the public interest.
Is the information publicly available?
40. The Council submitted that the redacted information was not currently in the public domain.
41. While noting that other elements of the requested information have been made publicly available, the Commissioner accepts that the withheld information was not publicly available when the Council dealt with Mr Hall's requirement for review (nor, indeed, is it so available now).
Would disclosure of the information cause, or be likely to cause, substantial harm to a legitimate economic interest?
42. As noted above, the term "legitimate economic interest" is not defined within the EIRs. The interest in question must, however, be financial, commercial or otherwise "economic" in nature, and the prejudice to that interest must be substantial. In order to apply this exception, an authority must, in the Commissioner's view, be able to demonstrate that the harm to the economic interest in question would be real, actual and of significant substance.
43. The Council told the Commissioner that it had consulted with the contractor involved. The contractor considered it would be detrimental to its commercial interests to make the commercial rates of the works available, particularly as this would allow a rival contractor to ascertain its margins and replicate its pricing structure. Rivals would therefore be able to undercut the contractor in future tendering exercises. This, the contractor and the Council submitted, would substantially prejudice the contractor's ability to compete for future projects in a competitive marketplace and would, as a result, cause substantial harm to the contractor's legitimate economic interests.
44. The Council noted that the redacted information was time-sensitive. Its release might be possible in the future, but the contractor had explained that prices in its industry had not changed substantially since the tender bid was submitted in 2010/11. This was a result of the recession and current market conditions, and was confirmed by officers of the Council involved in such contracts.
45. The Council further submitted that it regularly sought tenders for similar projects and provided the Commissioner with a list of similar recent and scheduled projects. It further submitted that other local authorities also sought such tenders on a regular basis. For all of the reasons set out above, the Council submitted that it would cause real, actual harm of significant substance to the contractor's commercial interests if this price-sensitive information were made available.
46. As mentioned above, the Commissioner has to be satisfied that the harm to the economic interest in question (and thus to the confidentiality to be protected) would be real, actual and of significant substance. She accepts the Council's submissions as to the commercial sensitivity of the pricing information at the time it carried out its review.
47. Having taken all of the Council's submissions into consideration, together with the information actually withheld, the Commissioner is satisfied that disclosure of the information would have caused, or would have been likely to cause, substantial harm to the ongoing legitimate economic interests of the contractor. Therefore, the Council was entitled to withhold it under regulation 10(5)(e) of the EIRs. The Council also provided reasons why it considered its own legitimate economic interests would be prejudiced substantially if the information were made available, but the Commissioner has not found it necessary to consider these arguments in the circumstances.
Consideration of the public interest
48. Having upheld the use of the exception contained within regulation 10(5)(e) in relation to the withheld pricing information, the Commissioner is required to consider the public interest test set out in regulation 10(1)(b) of the EIRs. The test specifies that a public authority may only withhold information to which an exception applies where, in all the circumstances, the public interest in making the information available is outweighed by the public interest in maintaining the exception.
49. The Council recognised a general public interest in authorities being accountable, and thus subject to scrutiny with respect to the use of public funds. However, it also considered there to be a public interest in local authorities obtaining best value when incurring expenditure.
50. The Council concluded that its ability to scrutinise and negotiate rates would be prejudiced should contractors be deterred from submitting detailed cost breakdowns when pricing works, on the basis that their legitimate economic interests would be harmed by public disclosure of their commercial rates.
51. The Council submitted that it was unaware of any wider public interest in the price breakdown being made available in this instance. However, it believed it had sought to balance the competing interests by making available the total cost of the work, together with details of the various aspects of the work which makes up that sum.
52. The withheld information clearly relates to public expenditure and the Commissioner recognises the public interest in transparency in relation to the amounts paid to the contractor. Equally, however, given the strong public interest in the maintenance of confidences and in fair competition, she is satisfied that there is a strong public interest in the pricing information not being made public (which would be the effect of making it available under the EIRs). On balance, therefore, in all the circumstances of this case, she concludes that the public interest in making the pricing information available is outweighed by the public interest in maintaining the exception in regulation 10(5)(e) of the EIRs.
Handling of the request and content of notices
53. Regulation 13 of the EIRs provides that, subject to regulations 10(8) and 11(6) (neither of which are relevant here), if a request to make environmental information available is refused by a Scottish public authority in accordance with regulation 10, the refusal shall:
? be given in writing, not later than 20 working days after the date of receipt of the request (regulation 13(a));
? specify the reasons for the refusal, including any exception under regulation 10(4) or (5) (or, where relevant, any provision of regulation 11) and how the public authority reached its decision with respect to the public interest under regulation 10(1)(b) (regulation 13(b));
? inform the applicant of the review provisions under regulation 16 and the enforcement and appeal provisions available in accordance with regulation 17 (regulation 13(e)).
54. The Council stated that it did not receive the request of 29 April 2013 until a further copy was provided on 13 June 2013. In any case, the Council did not respond to Mr Hall's request for information until 8 November 2013. This was a clear failure to comply with regulation 13(a).
55. The Commissioner also finds that the Council's response of 8 November 2013 failed entirely to meet the requirements of regulation 13(b) and (e). It failed to state that the withheld information was considered to be excepted from disclosure under the EIRs, or to indicate which exception was considered to apply and why. Nowhere did that response inform Mr Hall of his rights to require a review or to make an application to the Commissioner.
Handling of review
56. Regulation 16(3) of the EIRs states that, on receipt of a requirement for review, the authority shall review the matter and decide whether it has complied with the EIRs. Regulation 16(4) requires the authority to notify the applicant of its decision, within 20 working days, while regulation 16(5) requires the authority, where it decides that it has not complied with its duty under the EIRs, to take steps immediately to remedy the breach of duty.
57. Although the Council responded to Mr Hall's requirement for review on 19 December 2013, this response cannot reasonably be described as communicating a decision reached on review, or for that matter as suggesting that any review has been carried out. The Commissioner does not consider it to meet the requirements of regulation 16, as narrated above.
58. The Council acknowledged that the way in which it dealt with Mr Hall's request and requirement for review did not meet the requirements of the EIRS. It apologised for this during the investigation. In the circumstances, the Commissioner does not require the Council to take any action to address these failures on this occasion, in response to Mr Hall's application.
59. The Commissioner would remind Scottish public authorities of the particular importance of applicants being fully informed as to their rights where environmental information is requested. Unlike FOISA, the EIRs allow authorities no discretion to consider a requirement for review made after the expiry of the 40 working day period specified in regulation 16(2), and it is therefore vital that applicants are fully informed of the right and the period within which it may be exercised.
Decision The Commissioner finds that Glasgow City Council (the Council) partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by Mr Hall.
The Commissioner finds that, while the Council was entitled to withhold information in terms of regulation 10(5)(e) and 11(2) of the EIRs, it failed to provide Mr Hall with responses meeting the requirements of regulations 13 and 16 of the EIRs. Given the Council's subsequent acceptance of this, she does not require the Council to take any action in respect of these failures.
Appeal
Should either Mr Hall or Glasgow City Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Margaret Keyse
Head of Enforcement
4 July 2014
Appendix Relevant statutory provisions
The Environmental Information (Scotland) Regulations 2004
2 Interpretation
(1) In these Regulations -
?
"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -
(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
?
(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;
?
5 Duty to make available environmental information on request
(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.
(2) The duty under paragraph (1)-
?
(b) is subject to regulations 6 to 12.
?
10 Exceptions from duty to make environmental information available-
(1) A Scottish public authority may refuse a request to make environmental information available if-
(a) there is an exception to disclosure under paragraphs (4) or (5); and
(b) in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception.
(2) In considering the application of the exceptions referred to in paragraphs (4) and (5), a Scottish public authority shall-
(a) interpret those paragraphs in a restrictive way; and
(b) apply a presumption in favour of disclosure.
(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.
?
(5) A Scottish public authority may refuse to make environmental information available to the extent that its disclosure would, or would be likely to, prejudice substantially-
?
(e) the confidentiality of commercial or industrial information where such confidentiality is provided for by law to protect a legitimate economic interest;
?
11 Personal data
?
(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.
(3) The first condition is-
(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998[] that making the information available otherwise than under these Regulations would contravene-
(i) any of the data protection principles; or
?
(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.
13 Refusal to make information available
Subject to regulations 10(8) and 11(6), if a request to make environmental information available is refused by a Scottish public authority in accordance with regulation 10, the refusal shall-
(a) be given in writing as soon as possible and in any event no later than 20 working days after the date of receipt of the request for the information;
(b) specify the reasons for the refusal including, as appropriate, any exception under regulation 10(4) or (5) or provision of regulation 11 and how the Scottish public authority has reached its decision with respect to the public interest under regulation 10(1)(b);
?
(e) inform the applicant of the review provisions under regulation 16 and of the enforcement and appeal provisions available in accordance with regulation 17.
16 Review by Scottish public authority
(1) Subject to paragraph (2), an applicant may make representations to a Scottish public authority if it appears to the applicant that the authority has not complied with any requirement of these Regulations in relation to the applicant's request.
(2) Representations under paragraph (1) shall be made in writing to the Scottish public authority no later than 40 working days after either the date that the applicant receives any decision or notification which the applicant believes does not comply with these Regulations or the date by which such a decision or notification should have been made, or any other action should have been taken, by the authority but was not made or taken.
(3) The Scottish public authority shall on receipt of such representations-
(a) consider them and any supporting evidence produced by the applicant; and
(b) review the matter and decide whether it has complied with these Regulations.
(4) The Scottish public authority shall as soon as possible and no later than 20 working days after the date of receipt of the representations notify the applicant of its decision.
(5) Where the Scottish public authority decides that it has not complied with its duty under these Regulations, it shall immediately take steps to remedy the breach of duty.
Data Protection Act 1998
1 Basic interpretative provisions
(1) In this Act, unless the context otherwise requires -
?
"personal data" means data which relate to a living individual who can be identified -
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
Schedule 1 - The data protection principles
Part I - The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
?
Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
[1]
