Decision 207/2018: Allotment register

Public authority: Scottish Borders Council
Reference No: 201801268

Summary

Scottish Borders Council was asked for a copy of the register of allotment holders for allotments in Hawick.

The Council provided some information, but withheld other information on the basis that it was personal data and, in this case, exempt from disclosure.

The Commissioner investigated and found that the Council correctly withheld the personal data.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1), (3) and (4) (Interpretation); 5(1) and 2(b) (Duty to make available environmental information on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3)(a)(i) and (3)(b) (Personal data)

Data Protection Act 1998 (the DPA 1998) sections 1(1) (Basic interpretative provision) (definition of "personal data"); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

Data Protection Act 2018 (the DPA 2018) Schedule 20 (Transitional provisions etc - paragraph 61)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 14 January 2018, Mr Q made a request for information to Scottish Borders Council (the Council). Mr Q requested a copy of the register of allotment holders for allotments in Hawick.

2. The Council responded on 5 February 2018. The Council provided Mr Q with the number of plots at two locations, whether the plots were manageable and occupied, and confirmed that the occupied plots were occupied by Hawick residents. The Council also provided an extract from its register, redacting personal data in accordance with regulation 11(2) of the EIRs.

3. On 9 February 2018, Mr Q wrote to the Council, requesting a review of its decision on the basis that the Allotment (Scotland) Act 1892 provided him with a right to examine the register, including details such as "…the particulars of the tenancy, acreage, and rent of every allotment let…"

4. The Council notified Mr Q of the outcome of its review on 20 February 2018. The Council provided Mr Q with:

(i) a blank copy of the Conditions of Let for each plot which provided details of the particulars applied to each tenancy, and the annual rent payable in respect of each plot and confirmed that this was the same for each plot;

(ii) spreadsheets with details of the plots let at two locations, with personal details redacted (again under regulation 11(2) of the EIRs);

(iii) confirmation of the number of plots at each site and the total acreage for each site, stating that it did not hold information regarding the acreage of each individual plot.

5. On 27 July 2018, Mr Q wrote to the Commissioner. Mr Q applied to the Commissioner for a decision in terms of section 47(1) of the Freedom of Information (Scotland) Act 2002 (FOISA). By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. Mr Q stated he was dissatisfied with the outcome of the Council's review, given that the Allotment (Scotland) Act 1892 provided him with a right to examine the register in its entirety. He did not accept that the Council was entitled to redact information on the basis that it was personal data.

Investigation

6. The application was accepted as valid. The Commissioner confirmed that Mr Q made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.

7. On 6 September 2018, the Council was notified in writing that Mr Q had made a valid application. The Council was asked to send the Commissioner the information withheld from Mr Q. The Council provided the information and the case was allocated to an investigating officer.

8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and to answer specific questions, focusing on the issues raised by Mr Q in his application.

Commissioner's analysis and findings

9. In coming to a decision on this matter, the Commissioner considered all of the withheld information and the relevant submissions, or parts of submissions, made to him by both Mr Qand the Council. He is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

10. The Commissioner is satisfied that any information falling within the scope of the request, which relates to details of allotments, is properly considered to be environmental information, as defined by regulation 2(1) of the EIRs (parts (a) and (c) are reproduced in the Appendix 1 to this decision). Mr Q made no comment on the Council's application of the EIRs in this case and the Commissioner will consider the request in what follows solely in terms of the EIRs.

Regulation 11(2) of the EIRs - personal data of another person

11. The Council submitted that the information withheld consisted of the individual's full names, house numbers and street names, telephone/mobile numbers and email addresses, and was consequently their personal data. As such, the information was considered excepted from disclosure under regulation 11(2) of the EIRs.

Data Protection Act 2018 (Transitional provisions)

12. On 25 May 2018, the DPA 1998 was repealed by the DPA 2018. The DPA 2018 amended regulation 11(2) of the EIRs and also introduced a set of transitional provisions, which set out what should happen where a public authority dealt with an information request before the EIRs were amended on 25 May 2018 but where the matter is being considered by the Commissioner after that date.

13. In line with paragraph 61 of Schedule 20 of the DPA 2018 (see Appendix 1), if an information request was dealt with before 25 May 2018 (as is the case here - the review outcome was issued on 20 February 2018), the Commissioner must consider the law as it was before 25 May 2018 when determining whether the authority dealt with the request in accordance with the EIRs.

14. Paragraph 56 of Schedule 20 goes on to say that, if the Commissioner concludes that the request was not dealt with in accordance with the EIRs (as they stood before 25 May 2018), he cannot require the authority to take steps it would not be required to take in order to comply with the EIRs on or after 25 May 2018.

15. The Commissioner will therefore consider whether the Council was entitled to apply the exceptions in regulation 11(2) of the EIRs under the old law. He will only order the Council to disclose the information if disclosure would not now be contrary to the new law.

16. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(2) provides that a personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include where disclosure would contravene any of the data protection principles in Schedule 1 to the DPA 1998 (regulation 11(3)(a)(i)). The Council argued that the disclosure of the information would breach the first data protection principle.

Is the information under consideration personal data?

17. The definition of "personal data" is contained in section 1(1) of the DPA 1998 and is set out in Appendix 1. Having considered the submissions received, the Commissioner is satisfied that a person's name, address and contact details are the most common means of identifying them. The Commissioner is satisfied that the information redacted from the register relates to the individuals concerned when held in that context, and therefore comprises their personal data.

The first data protection principle

18. The first data protection principle states that personal data shall be processed fairly and lawfully. The processing in this case would be making the information available in the public domain, in response to Mr Q's request. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA 1998 is met (the full text of the principle is set out in Appendix 1). A condition in Schedule 3 to the DPA 1998 will also require to be met if the data are sensitive personal data, as defined in section 2 of the DPA 1998: the Commissioner is satisfied that this is not the case here.

19. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

20. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA 1998 which would permit the withheld personal data to be made available. If any of these conditions can be met, he must then consider whether making the information available would be fair and lawful.

Can any of the conditions in Schedule 2 be met?

21. In the circumstances, it appears to the Commissioner that condition 6 in Schedule 2 is the only one which might permit making the information available to Mr Q. Condition 6 allows personal data to be processed if the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

22. There are a number of different tests which must be satisfied before condition 6 can be met. These are:

(i) Is Mr Q pursuing a legitimate interest or interests?

(ii) If yes, is the processing involved necessary for the purposes of those interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if processing is necessary for Mr Q's legitimate interests, is that processing nevertheless unwarranted by reason of prejudice to the rights and freedoms of legitimate interests of the data subject?

23. There is no presumption in favour of making personal data available under the general obligation laid down by regulation 5(1) of the EIRs. Accordingly, the legitimate interests of Mr Q must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit making the personal data available. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to make the personal data available to Mr Q.

Is Mr Q pursuing a legitimate interest or interests?

24. The Council submitted that Mr Q did not explain any interest he had in obtaining the information requested, other than his belief that he had a legal entitlement to the information. With the lack of explanation, the Council considered that the applicant did not have a legitimate interest to the information. The Council therefore concluded that disclosure of the information would have been unwarranted, as there was no interest to weigh against the right of the data subjects not to have their data processed unlawfully.

25. Mr Q submitted that the Allotments Act 1892 gave the right to any ratepayer to examine the register of allotment holders.

26. In addition, Mr Q submitted that the right to know who leases allotments was important to anyone interested in the management of allotment sites. It ensured a publicly available check that allotments were being fairly allocated and allowed identification of individuals not maintaining their allotments (to enable assistance to be offered). Those with the necessary local knowledge could also identify whether allotments were being used (whether maintained or not) by people other than the legitimate allotment holder.

27. Mr Q went on to note that his interest stemmed from his involvement in a local environmental SCIO (Scottish Charitable Incorporated Organisation) which required consultation and research into use, non-use and related issues. He submitted that direct contact with allotment holders was essential for the successful understanding of a number of issues.

28. Mr Q emphasised that the legislation under which he sought the information did not require him to provide reasons for his interest.

29. The Commissioner is satisfied that Mr Q has a legitimate interest in obtaining the information, and that there is a wider public interest in transparency regarding the management of allotment sites.

Is disclosure of the information necessary for the purposes of these legitimate interests?

30. Having accepted that Mr Q has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of the personal data is necessary for Mr Q's legitimate interests. In doing so, he must consider whether these interests might reasonably be met by any alternative means.

31. Having considered Mr Q's legitimate interests, the Commissioner accepts that, to some extent, disclosure of the information is necessary in order to fulfil them. The Commissioner is satisfied that the withheld personal data would provide Mr Q with factual information which would add to his understanding of the management and allocation of allotments.

32. The Commissioner also accepts that, in all the circumstances of this case, Mr Q's legitimate interests could not reasonably be met by alternative means. He is satisfied that the disclosure of personal data is necessary to meet Mr Q's legitimate interests.

Would disclosure cause unwarranted prejudice to the legitimate interest of the data subjects?

33. As the Commissioner is satisfied that disclosure of the withheld personal data would be necessary to fulfil Mr Q's legitimate interests, he is now requires to consider whether that disclosure would nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects. As noted above, this involves a balancing exercise between the legitimate interests of Mr Q and those of the data subjects.

34. The Commissioner must approach this balancing exercise on the basis that disclosure under the EIRs is disclosure to the world at large and not simply to Mr Q. He has accepted that the information is personal data of the individuals concerned and that it cannot practicably be anonymised.

35. The Council did not provide any specific arguments as to the rights, freedoms and legitimate interests of the data subjects. It acknowledged that Mr Q made reference to the 1892 Act requirement to keep a register showing the particulars of the tenancy, acreage and rent of every allotment let, and to have that register open to ratepayers in the Council's area. The Council commented that the 1892 Act did not define what is meant by "particulars of the tenancy". The Council noted that section 14 of the 1892 Act stated that the register should be held "in such a manner as may be prescribed by the regulations made under this Act", but no regulations were made and therefore the precise content of the register, and what was meant by particulars of the tenancy, had never been clarified.

36. The Council confirmed that had the 1892 Act specifically stated that personal details of the tenants must be kept on a public register, it would have supplied this information to the Mr Q.

37. The Council's interpretation of "particulars of the tenancy" is that this comprises the conditions of let, a blank copy of which was disclosed to the applicant as part of the Review response. The Council does not consider that "particulars of the tenancy" extends to details of the individuals taking such a tenancy. In addition the Council stated that the individual allotment tenants (the data subjects) had not given their consent for their personal data to be disclosed to any third party.

38. The Council argued that disclosing the names alone in this instance would be sufficient to identify individuals in this area. The Council confirmed that Mr Q had been provided with postcodes of the allotment holders at the review outcome, but provision of other details (such as the individual's address, phone number and email address) would make the individuals concerned even more readily identifiable.

39. In reaching a decision on this matter, the Commissioner has concluded that the information is private to the data subjects; he accepts that there was no stipulated requirement to provide this information in the 1892 Act. The Commissioner is satisfied that there is a reasonable expectation on the part of the data subjects that such details would remain private.

40. The Commissioner concludes that, in all the circumstances, the data subjects had a reasonable expectation that the information which was their personal data would remain private. The Commissioner is satisfied that disclosure would impinge on their right to private and family life.

41. Having balanced the legitimate interests of the data subjects against those of Mr Q, the Commissioner finds that any legitimate interests served by disclosure of the withheld personal data would be outweighed by the unwarranted prejudice that would result in this case to the rights and freedoms or legitimate interests of the individuals in question. In the circumstances of this particular case, the Commissioner concludes that condition 6 in Schedule 2 to the DPA cannot be met in relation to the withheld personal data.

42. Having accepted that disclosure of the withheld personal data would lead to unwarranted prejudice to the rights and freedoms of legitimate interest of the data subjects, as described above, the Commissioner must also conclude that its disclosure would be unfair. As no condition in Schedule 2 to the DPA can be met, he must regard disclosure as unlawful. In all the circumstances, therefore, the Commissioner's conclusion is that the first data protection principle would be breached by disclosure of the information and that this information was properly withheld under regulation 11(2) of the EIRs.

Transitional provisions

43. As the Commissioner has found that the Council complied with the EIRs (as they stood before 25 May 2018) in responding to the request by Mr Q, he is not required to go on to consider whether disclosure of the personal data would breach the EIRs as they currently stand.

Community Empowerment (Scotland) Act 2015

44. On 1 April 2018, before Mr Q made his application to the Commissioner, but after the Council had carried out a review, the 1892 Act was repealed. The relevant legislation is now Part 9 of the Community Empowerment (Scotland) Act 2015 (the 2015 Act).

45. The Council was asked to comment on whether this change would alter its response to Mr Q's request. The Council submitted that it position would not change in respect of this request. The Council stated that section 121 of the 2015 Act provides extensive detail regarding what must be included in the annual allotment report which must be published: nowhere in this section does it state that details of the tenants be disclosed. In the absence of any mention of the details of the tenant being required to be published, the Council submitted that its position was reinforced.

46. In all the circumstances, the Commissioner is satisfied that the change in the applicable legislation can have no effect on his analysis and conclusions in respect of regulation 11(2) of the EIRs, as set out above.

Decision

The Commissioner finds that Scottish Borders Council complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by Mr Q.

Appeal

Should either Mr Q or Scottish Borders Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Margaret Keyse
Head of Enforcement

18 December 2018

Appendix 1: Relevant statutory provisions[1]

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations-

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on-

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

…

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

…

(3) The following expressions have the same meaning in these Regulations as they have in the Data Protection Act 1998, namely-

(a) "data", except that for the purposes of regulation 10(3) and 11, a public authority referred to in paragraph (e) of the definition of data in section 1(1) of that Act means a Scottish public authority within the meaning of these Regulations;

(b) "the data protection principles";

(c) "data subject"; and

(d) "personal data".

(4) Subject to paragraphs (1), (2) and (3), expressions in these Regulations which appear in the Directive have the same meaning in these Regulations as they have in the Directive.

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

…

(b) is subject to regulations 6 to 12.

…

10 Exceptions from duty to make environmental information available-

…

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

11 Personal data

…

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

…

(b) in any other case, that making the information available otherwise than under these Regulations would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

 

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

…

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

…

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Data Protection Act 2018

Schedule 2 - Transitional provision etc

61 Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

(1) This paragraph applies where a request for information was made to a Scottish public authority under the Environmental Information (Scotland) Regulations 2004 ("the 2004 Regulations") before the relevant time.

(2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with those Regulations.

(3) To the extent that the request was dealt with before the relevant time -

(a) the amendments of the 2004 Regulations in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with those Regulations, but

(b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with those Regulations as amended by Schedule 19 to this Act.

(4) In this paragraph -

"Scottish public authority" has the same meaning as in the 2004 Regulations;

"the relevant time" means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.

---