Decision 171/2018: Occupancy of residence and court action

Public authority: South Lanarkshire Council
Reference No: 201800631

Summary

South Lanarkshire Council was asked why it took someone to court and what the outcome of the action was. The Council was also asked how many residents it had been claimed would be housed in a property when it was allocated.

The Council refused to confirm or deny whether it held any information about the court action. It confirmed it held information about the number of residents, but refused to disclose it.

The Commissioner investigated and found that Council had responded to the request in accordance with FOISA.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 18(1) (Further provision as respects responses to request); 38(1)(b), (2)(a)(i), (2)(b) and (5) (definitions of "the data protection principles", "data subject" and "personal data") (Personal information)

Data Protection Act 1998 (the DPA 1998) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6(1))

Data Protection Act 2018 (the DPA 2018) Schedule 20 (Transitional provision etc - paragraph 56)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 12 February 2018, Mr X made a request for information to South Lanarkshire Council (the Council). The request read as follows:

"I would like this email to be taken as a freedom of information request to find out why [the Council] are taking my neighbours to court and the outcome and also how many residents [named person] claimed would be housed in the property when it was allocated…"

2. The Council responded on 9 March 2018. The Council notified Mr X that it was unable to confirm or deny whether it held any information falling within the scope of his request (section 18(1) of FOISA).

3. On 12 March 2018, Mr X wrote to the Council requesting a review of its decision.

4. The Council notified Mr X of the outcome of its review on 9 April 2018. The Council upheld its reliance on section 18 of FOISA in relation to the court action. However, it stated it now wished to confirm that it held information about the number of tenants, but that it wished to withhold that information under section 38(1)(b) of FOISA (the exemption for third party personal data).

5. On 10 April 2018, Mr X applied to the Commissioner for a decision in terms of section 47(1) of FOISA. Mr X believed that the Council held the information he required and was confusing the public interest with its own interest. He said that he needed the information to inform a possible complaint to the Scottish Public Services Ombudsman (the SPSO). He also made clear that, in relation to the second part of his request, he did not require names, only a number.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr X made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions including justifying its reliance on any provisions of FOISA it considered applicable to the information requested. The Council did this.

8. Mr X also provided comments and information to assist the Commissioner's investigation.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all the relevant submissions, or parts of submissions, made to him by both Mr X and the Council. He is satisfied that no matter of relevance has been overlooked.

Third party personal data

10. The Council relied on section 38(1)(b) of FOISA (as read with section 38(2)(a)(i)) (Personal information) to withhold the number of residents the tenant had claimed would be housed in the property when it was allocated to them.

Data Protection Act 2018 (Transitional provisions)

11. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amended section 38 of FOISA. It also introduced a set of transitional provisions which set out what should happen where a public authority dealt with an information request before FOISA was amended on 25 May 2018, but where the matter is being considered by the Commissioner after that date.

12. In line with paragraph 56 of Schedule 20 to the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018 (as is the case here), the Commissioner must consider the law as it was before 25 May 2018 when determining whether the authority dealt with the request in accordance with Part 1 of FOISA.

13. Paragraph 56 of Schedule 20 goes on to say that, if the Commissioner concludes that the request was not dealt with in accordance with Part 1 of FOISA (as it stood before 25 May 2018), he cannot require the authority to take steps which it would not be required to take in order to comply with Part 1 of FOISA on or after 25 May 2018.

14. The Commissioner will therefore consider whether the Council was entitled to apply the exemption in section 38(1)(b) of FOISA under the old law. If he finds that the Council was not entitled to withhold the information under the old law, he will only order the Council to disclose the information if disclosure would not now be contrary to the new law.

Section 38(1)(b) of FOISA (pre-25 May 2018)

15. Section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) (or, as appropriate, section 38(2)(b)) exempts information from disclosure if it is "personal data", as defined in section 1(1) of the DPA 1998, and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA 1998. This exemption is an absolute exemption: this means that it is not subject to the public interest test in section 2(1)(b) of FOISA.

16. In order to rely on this exemption, the Council must show, firstly, that the information - in this case a number - is personal data for the purposes of the DPA 1998 and, secondly, that disclosing the personal data would contravene one or more of the data protection principles to be found in Schedule 1 to the DPA 1998.

17. The Council commented that it had interpreted Mr X's request as seeking the number of proposed residents, but as his requirement for review had mentioned the relationship of the tenants, he may have been seeking more than a number. The Commissioner considers that Mr X's request should be taken at face value as a request for the number of potential residents identified on the application form, and not as a request for information about the tenants' relationships.

Is the information personal data?

18. "Personal data" are defined in section 1(1) of the DPA 1998 as "data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller…" (See the full definition in Appendix 1.).

19. The Council referred the Commissioner to Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[1]. The Council stated that the information requested was the total number of individuals on an application for Council housing which resulted in those persons obtaining the tenancy. The Council indicated that it could clearly identify those persons and, therefore, the identifiability test was met. The Council said that Mr X himself could link the number to the persons who were his neighbours. Further, disclosure of the information would allow others to link that number to the persons who were Mr X's neighbours.

20. In reaching a decision on this point, the Commissioner has taken account of the guidance from the (UK) Information Commissioner (the ICO), who regulates the DPA 1998 throughout the UK. The ICO issued the following guidance[2] on determining what is personal data:

"When considering identifiability it should be assumed that you are not looking just at the means reasonably likely to be used by the ordinary man in the street, but also the means that are likely to be used by a determined person with a particular reason to want to identify individuals."

21. In relation to the question of identifiability of the data subject(s), it is recognised that a public authority (and the Commissioner) must consider the effects of disclosure in terms of the wider population: the data controller referred to in part (b) of the definition of personal data in section 1 of the DPA 1998 is not just the public authority, but the public to whom the data are disclosed.

22. This issue was considered in more detail in the judgement of the Court of Justice of the European Union in Breyer v Bundesrepublik Deutschland[3]. In this case, the Court said that the correct test to consider is whether there is a realistic prospect of someone being identified. In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is "insignificant", the information will not be personal data.

23. Mr X's requirement for review shows that he has some knowledge of the number of persons living next door and who they are. He is therefore likely to be able to identify whether the number held by the Council represents all or just some of those individuals. He will therefore be able to deduce information about those individuals, i.e. whether they were named on the tenancy application or have come to live there later. As he is aware of the family relationships, he will be able to say whether the number given on the application form relates to the tenant's immediate family or includes other individuals. Further information about the individuals represented by the number is available on the electoral roll.

24. In all the circumstances, the Commissioner is satisfied that the number of tenants in question is personal data for the purposes of section 1(1) of the DPA 1998. Living individuals are identifiable and information impacting so directly on the private lives of the individuals concerned relates to those individuals.

Would disclosure contravene the first data protection principle?

25. The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA 1998 is met and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA 1998 is also met. "Processing" in the context of a disclosure under FOISA means disclosing the personal data into the public domain.

26. The withheld information is not sensitive personal data and it is therefore not necessary for the Commissioner to consider the conditions in Schedule 3 in this case.

27. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 of the DPA 1998 be met?

28. When considering the conditions in Schedule 2, the Commissioner notes Lord Hope's comment in the case of Common Services Agency v Scottish Information Commissioner [2008] UKHL 47[4], that the conditions require careful treatment in the context of a request for information under FOISA, given that the conditions are not designed to facilitate the release of information, but rather to protect personal data from being processed in a way that might prejudice the rights, freedoms or legitimate interest of the data subject(s).

29. The first condition in Schedule 2 which might be considered relevant in this case is condition 1. Condition 1 applies when a data subject has consented to the processing. The Council did not consider it appropriate to ask the data subjects for consent in this instance. The Commissioner accepts that consent has not been sought nor given by the data subject(s) in this case and that condition 1 in Schedule 2 cannot be met.

30. Condition 6 in Schedule 2 is, in the Commissioner's view, the only other condition which might allow the number to be disclosed to Mr X. The Council - and Mr X himself - identified this condition as relevant. Condition 6 is set out in full in Appendix 1.

31. The tests which must be met before condition 6 can apply are:

(i) Does Mr X have a legitimate interest or interests in obtaining the information?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject(s)?

(iii) Even if the processing is necessary for Mr X's legitimate interests, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s)?

32. There is no presumption in favour of disclosure of personal data under the general obligation laid down in FOISA. The legitimate interests of Mr X must outweigh the rights and freedoms or legitimate interests of the data subject(s) before the personal data (the number) can be disclosed. If both sets of legitimate interests are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the number to Mr X.

Does Mr X have a legitimate interest in obtaining the information?

33. The DPA1998 does not define "legitimate interest", but the Commissioner takes the view that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's published guidance on section 38(1)(b) of FOISA stated:

"In some cases, the legitimate interest might be personal to the applicant - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

34. Mr X explained that he was concerned that there had been a "false claim" for a Council tenancy. He said that he had verified some information on the electoral roll but, to decide whether his suspicion was correct, he needed the numbers given to the Council. With that information, he could decide whether to complain to the SPSO. He believed there was a public interest in the investigation of any false or "bogus" claim for Council accommodation.

35. The Council accepted that Mr X had a legitimate interest because the information related to matters involving his neighbour and accordingly affected him (as a neighbour).

36. The Commissioner agrees. He also accepts that there is a wider public interest in the scrutiny of such a process as allocation of a Council tenancy.

Is disclosure of the information necessary for the purposes of these legitimate interests?

37. Having accepted that Mr X has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of the personal data is necessary for Mr X's legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means.

38. The Council accepted that Mr X could not obtain this information in a less intrusive way and accepted that this condition was met.

39. The Commissioner agrees and can identify no other viable means of meeting Mr X's legitimate interests which would interfere less with the privacy of the data subjects than providing the information requested by Mr X.

Would disclosure be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s)?

40. As the Commissioner is satisfied that disclosure of the information is necessary to fulfil Mr X's legitimate interests, he is required to consider whether that disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject(s). This involves a balancing exercise between the legitimate interests of Mr X and those of the data subject(s). As noted above, only if the legitimate interests of Mr X outweigh those of the data subject(s) can the information be disclosed.

41. In the Commissioner's guidance on section 38(1)(b) of FOISA, he notes a number of factors which should be taken into account in carrying out the balancing exercise. These include:

• whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances)
• the potential harm or distress that may be caused by the disclosure
• whether the individual objected to the disclosure
• the reasonable expectations of the individuals as to whether the information should be disclosed.

42. Mr X commented:

"I could not imagine that adding bogus names to an application for council housing could be described as a genuine right and freedom of the person who completed the application for housing."

43. The Council submitted that the data subject(s) would not expect this information to be disclosed. The information was contained in an application for housing and any person making such an application would not expect the information to be disclosed to the public, i.e. disclosed under FOISA.

44. The Commissioner considers that:

(i) the withheld information clearly relates to the data subject(s)' private rather than public life

(ii) a person applying for a tenancy will have done so in the reasonable expectation that the personal data in the application form would treated confidentially

(iii) disclosure could cause harm or distress to the data subject(s) but any harm or distress would generally be low.

45. Having balanced the legitimate interests of the data subject(s) against those of Mr X, the Commissioner finds that any legitimate interests served by disclosure of the withheld personal data would not outweigh the unwarranted prejudice that would result in this case to the rights and freedoms or legitimate interests of the individual(s) in question. In the circumstances of this particular case, the Commissioner concludes that condition 6 in Schedule 2 to the DPA 1998 cannot be met in relation to the withheld personal data.

46. Given that the Commissioner has found that there is no condition in Schedule 2 which would permit the Council to disclose the personal data, disclosure would breach the first data protection principle. This means that the information is exempt from disclosure under section 38(1)(b) of FOISA.

Transitional provisions

47. As the Commissioner has found that the Council complied with Part 1 of FOISA (as it stood before 25 May 2018) in responding to the request by Mr X, insofar as it concerns section 38(1), he is not required to go on to consider whether disclosure of the personal data would breach Part 1 of FOISA as it currently stands.

Section 18(1) of FOISA - "neither confirm nor deny"

48. The Council refused to confirm or deny whether it held any information falling within the scope of Mr X's request for information on a court action and its outcome.

49. Section 18(1) of FOISA allows public authorities to refuse to confirm or deny whether they hold information in limited circumstances (see Appendix 1).

50. Where a public authority has chosen to rely on section 18(1), the Commissioner must decide whether it would be in the public interest not to reveal that the information exists or is held. He must also establish whether, if the information existed and was held by the public authority, the information could be withheld under any of the exemptions listed in section 18(1) and cited by the authority.

51. It is not sufficient to claim that one or more of the relevant exemptions applies. Section 18(1) makes it clear that the authority must be able to give a refusal notice under section 16(1), on the basis that any relevant information, if it exists and is held, would be exempt information under one or more of the listed exemptions.

52. The Council submitted that if it held any information falling within this part of Mr X's request, that information would be personal data exempt from disclosure under section 38(1)(b) of FOISA. The Commissioner must therefore consider whether the Council could have refused to provide the information on the grounds that it was exempt from disclosure under section 38(1)(b), if it existed and was held by the Council.

53. In any case where section 18(1) is under consideration, the Commissioner must ensure that his decision notice does not confirm one way or the other whether the information requested actually exists or is held by the authority. This means that he is unable to comment in any detail on the reliance by the public authority on any of the exemptions listed in relation to section 18(1), or on other matters which could have the effect of indicating whether the information existed or was held by the authority.

Section 38(1)(b) - Personal information

54. The Council stated that, if it held the requested information, it would (and could) apply the exemption in section 38(1)(b) of FOISA to that information. (Again, the Commissioner must consider section 38(1)(b) of FOISA as it stood before 25 May 2018.)

55. The Commissioner has already set out in detail (above) the requirements for reliance on section 38(1)(b) and to avoid duplication in this decision will not repeat these.

56. In this case, the Council submitted that the information, if held, would be personal data and disclosure would breach the first data protection principle.

Is the information personal data?

57. The Council took the view that information showing whether the Council had raised any court action against an individual would be the personal data of that individual. The court action would be between the Council and the person and would inevitably identify that person.

58. The Commissioner is satisfied that, if held, the information covered by Mr X's request would be personal data, as defined by section 1(1) of the DPA 1998. The information would relate to an identifiable living individual, or individuals and the nature of the information means that, if held, it must relate to that person or those persons.

59. The Commissioner is satisfied that the data (if held) would not be sensitive personal data for the purposes of section 2 of the DPA 1998.

Would disclosure contravene the first data protection principle?

60. In its submissions, the Council argued that disclosure of the information, if it existed and were held, would contravene the first data protection principle. It did not consider that any of the conditions of Schedule 2 of the DPA 1998 could be satisfied in relation to disclosure of the information and submitted that disclosure would, therefore, be unlawful and in breach of the first principle.

Can any of the conditions in Schedule 2 be met?

61. The first condition in Schedule 2 which might be considered relevant in this case is condition 1. Condition 1 applies when the data subject has consented to the processing. The Commissioner accepts that consent has not been sought or given by the data subject(s) in this case. Therefore, condition 1 in Schedule 2 cannot be met.

62. Again, it appears to the Commissioner that condition 6 of Schedule 2 is the only one which might permit disclosure of the personal data, if held. As noted above, there are a number of different tests which must be satisfied before condition 6 can be met (see paragraph 31).

Is Mr X pursuing a legitimate interest or interests?

63. The Council accepted that Mr X had a legitimate interest as the information (if held) would relate to court action on matters which might affect Mr X as a neighbour of the property.

64. The Commissioner accepts that Mr X would have a legitimate interest in the information, if it exists or is held by the Council.

Would disclosure of the information be necessary to achieve those legitimate interests?

65. Having concluded that Mr X would have a legitimate interest in obtaining the personal data under consideration (if it exists and is held), the Commissioner must now consider whether disclosure of the personal data would be necessary in order to satisfy his legitimate interest. In doing so, he must consider whether his legitimate interest might be reasonably met by any alternative means.

66. In its initial response, the Council accepted that Mr X could not obtain this information in a less intrusive way.

67. Mr X supplied the Commissioner with extracts from Sheriff Court Rolls and with a refusal notice he had received from the Scottish Courts and Tribunal Service (SCTS) in response to a request he had made about the case referred to in the court roll.

68. The SCTS had refused to supply the information to Mr X in terms of the absolute exemption in section 37 of FOISA (Court records, etc.). (The SCTS publication scheme states that information in court rolls is published at the time of a hearing in the interests of open justice, and to assist litigants attending court for those cases, and others having an interest. The SCTS website explains that information in court rolls is not permanently displayed, as once that purpose has ceased it is likely that absolute exemptions would apply to the relevant material under section 37 and 38.)

69. Given that information from court rolls is made publicly available for only a short time, the Commissioner accepts that it would now be necessary for the personal data (if held) to be disclosed to Mr X under FOISA in order to achieve his legitimate interests. There are no other viable means of meeting Mr X's interests which would interfere less with the privacy of the data subject(s) than providing the withheld personal data (if it exists and is held). For this reason, the Commissioner is satisfied that disclosure of the information would be necessary for the purposes of Mr X's legitimate interests.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subject(s)?

70. The Commissioner must consider whether disclosure would be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject(s).

71. The Council stated that to disclose information about a particular court action would involve an admission that such an action existed and would prejudice a person's rights of confidentiality. A party to such an action would not expect the Council to disclose anything about that action that was not in the public domain.

72. The Commissioner accepts that the information (if it exists and is held) would pertain to the private life of the data subject(s), whatever the nature of the court action.

73. The Commissioner has considered the potential harm or distress that may be caused by disclosure of the existence of a court action and its outcome. While the potential harm would vary considerably depending on the nature of the action (and outcome) of that action and while the existence of a court case may be temporarily made public on the court rolls (and may even be reported by the media), the Commissioner accepts that disclosing publicly that a court action had been raised would, regardless of the nature of the proceedings, cause harm and distress.

74. On balance, the Commissioner takes the view that the Mr X's legitimate interests do not outweigh the prejudice that would be caused by disclosure to the data subject's rights and freedoms or legitimate interests.

75. Consequently, the Commissioner finds that the prejudice that would be caused by disclosure of the information would be unwarranted. The Commissioner is satisfied that condition 6(1) of Schedule 2 is not met in relation to such personal data, if it exists and is held. The Commissioner therefore finds that disclosure of such information, if it exists and is held, would not be fair and lawful and that the Council would be entitled to withhold such information under section 38(1)(b) of FOISA, if it exists and is held.

Conclusion on section 18(1)

76. Having accepted that the Council could have given a refusal notice under section 16(1) of FOISA on the basis that any relevant information, if held, would be exempt information by virtue of section 38(1)(b) of FOISA, the Commissioner is required by section 18(1) to go on to consider whether the Council was entitled to conclude that it would be contrary to the public interest to reveal whether the information existed or was held.

Section 18(1) - The public interest

77. Mr X explained why he believed the information he was seeking should be disclosed (if held). He explained in detail his personal need for the information inasmuch as it related to his neighbour and therefore affected the quality of his private life. The Commissioner has considered the reasons given by Mr X, but will not specify them here. He has attributed due weight to Mr X's interest.

78. In its initial response to Mr X, the Council acknowledged that there was a public interest in access to information, but believed this interest was outweighed by the public interest in ensuring that personal data is processed in accordance with the DPA 1998. The Council stated that compliance with the DPA 1998 was strongly in the public interest.

79. The Commissioner accepts the Council's arguments that there is a strong public interest in protecting the confidentiality of information and the privacy of individuals in relation to their dealings with the Council. He also accepts that there is a strong public interest in ensuring that the Council does not breach the DPA 1998.

80. A disclosure under FOISA is not simply disclosure to the person requesting the information, but is a public disclosure. This must always be borne in mind when considering the effects of disclosure. The Commissioner has considered Mr X's arguments and attributes weight to them too. However, on balance, he accepts that revealing to the public whether or not the Council held the requested information, or whether it existed, would, in all the circumstances of this case, be contrary to the public interest.

81. As a result, the Commissioner is satisfied that the Council was entitled to refuse to confirm or deny, in accordance with section 18(1) of FOISA, whether it held the information requested by Mr X or whether such information existed.

Decision

The Commissioner finds that South Lanarkshire Council complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by Mr X.

Appeal

Should either Mr X or South Lanarkshire Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

31 October 2018

Appendix 1: Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

…

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(a) the provision does not confer absolute exemption; and

…

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption -

…

(e) in subsection (1) of section 38 -

…

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

18 Further provision as respects responses to request

(1) Where, if information existed and was held by a Scottish public authority, the authority could give a refusal notice under section 16(1) on the basis that the information was exempt information by virtue of any of sections 28 to 35, 38, 39(1) or 41 but the authority considers that to reveal whether the information exists or is so held would be contrary to the public interest, it may (whether or not the information does exist and is held by it) give the applicant a refusal notice by virtue of this section.

…

38 Personal information

(1) Information is exempt information if it constitutes-

…

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

…

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

…

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

…

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

…

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1 The data subject has given his consent to the processing.

…

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Data Protection Act 2018

Schedule 2 - Transitional provision etc

56 Freedom of Information (Scotland) Act 2002

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 ("the 2002 Act") before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 10 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

(3) To the extent that the request was dealt with before the relevant time -

(a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act as amended by Schedule 19 to this Act, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.

(4) In this paragraph -

"Scottish public authority" has the same meaning as in the 2002 Act;

"the relevant time" means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.

---