Decision 267/2016: ABW Consultants Ltd and West Lothian Council Planning and related matters at Whitrigg, East Whitburn Reference No: 201601137 Decision Date: 15 December 2016 Summary West Lothian Council (the Council) was asked for information relating to planning and related matters at Whitrigg, East Whitburn. The Council considered the request under the EIRs. It disclosed some information, and withheld other information which it considered to be personal data. The Commissioner found that the Council was entitled to withhold some, but not all, of the information under the exception relating to personal data, and required it to disclose the information she did not consider to be exempt.

Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (Interpretation) (paragraphs (a) and (c) of definition of "environmental information"), 5(1) and (2)(b) (Duty to make available environmental information on request); 10(1), (2), (3) and (4)(a) (Exceptions from duty to make environmental information available); 11(2) and (3)(a)(i) (Personal data); 13 (Refusal to make information available)

Data Protection Act 1998 (the DPA) sections 1(1) (Basic interpretative provisions) (definition of "personal data"); Schedules 1 (The data protection principles, Part 1: the principles) (the first data protection principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (Conditions 1 and 6)

The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.

Background

1. On 11 August 2015, ABW Consultants Ltd (ABWCL) made a request for information to the Council. Referring to paragraphs 65-76 of the Commissioner's Decision 070/2014 ABW Consultants and West Lothian Council[1], ABWCL asked the Council to disclose the documents referred to in paragraph 71 of that Decision Notice. In addition, ABWCL asked for any further documents involving correspondence between the Council and the police post-dating the original request for information.

2. The Council considered the request under the EIRs and responded on 27 October 2015. It withheld the information requested under regulation 10(5)(b) of the EIRs, on the basis that disclosure would, or would be likely to, prejudice substantially the police's ability to conduct an inquiry of a criminal nature.

3. On 24 November 2015, ABWCL wrote to the Council requesting a review of its decision. It did not believe there was the risk of prejudice claimed by the Council. In addition, ABWCL argued that the public interest favoured transparency.

4. Having received no response to its requirement for review, ABWCL wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. The Commissioner subsequently issued Decision 048/2016 ABW Consultants Ltd and West Lothian Council[2], finding that the Council had breached Part 1 of FOISA and requiring a response to ABWCL's request for review.

5. The Council carried out a review and notified ABWCL of the outcome on 18 April 2016. Modifying its original decision, the Council disclosed what it claimed to be the requested information, all with third party personal data redacted in terms of regulation 11(2) of the EIRs. The Council explained which parties were involved in each item of correspondence (i.e. the Council and/or the police).

6. On 19 June 2016, ABWCL wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. ABWCL stated it was dissatisfied with the outcome of the Council's review because it believed the Council held further correspondence with the police that had not been disclosed. ABWCL was also dissatisfied with the extent to which the Council had redacted personal data.

Investigation

7. The application was accepted as valid. The Commissioner confirmed that ABWCL made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to her for a decision.

8. On 19 July 2016, the Council was notified in writing that ABWCL had made a valid application. The Council was asked to send the Commissioner the information withheld from ABWCL. The Council provided the information and the case was allocated to an investigating officer.

9. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Council was invited to comment on this application and answer specific questions. These related to the Council's reliance on regulation 11(2) of the EIRs, and to the steps taken by the Council to identify and to locate any information falling within the scope of the request. The Council was also asked to explain why it had disclosed, at review stage, further items of correspondence which did not appear to fall within the scope of ABWCL's request.

10. The Council responded, providing submissions. It agreed that the additional items of correspondence disclosed at review stage did not fall within the scope of ABWCL's request, and apologised for this error. The Council explained that the review had considered correspondence falling outwith the period covered by the request.

11. The Council also acknowledged that part of the email chain in Document 1 did not fall within the scope of ABWCL's request, as this related to the handling of the information request rather than the correspondence requested.

12. As this information does not fall within the scope of ABWCL's request, the Commissioner cannot investigate any dissatisfaction ABWCL has with redactions to that information.

13. ABWCL also provided submissions as to why it believed the redacted information should be disclosed.

Commissioner's analysis and findings

14. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both ABWCL and the Council. She is satisfied that no matter of relevance has been overlooked.

Application of the EIRs

15. The Commissioner is satisfied that the information covered by this request is environmental information, as defined in regulation 2(1) of the EIRs. The information in question relates to a planning application concerning a substantial development and, as such, the Commissioner is satisfied that it would fall within either paragraph (a) or paragraph (c) of the definition of environmental information in regulation 2(1) of the EIRs (reproduced in Appendix 1 to this decision).

16. ABWCL has not disputed the Council's decision to handle the request under the EIRs and the Commissioner will consider the information in what follows solely in terms of the EIRs.

Regulation 5(1) of the EIRs

17. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant. This is subject to various qualifications contained in regulations 6 to 12 (regulation 5(2)(b)).

18. It should be borne in mind that this obligation extends to information actually held by an authority when it receives the request, as opposed to information which an applicant believes the authority should hold, but which is not actually held.

19. Under the EIRs, a Scottish public authority may refuse to make environmental information available if one or more of the exceptions in regulation 10 apply and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in maintaining the exception (regulation 10(1)(b)).

20. If no such information is held by the authority, the exception in regulation 10(4)(a) of the EIRs should apply. In applying any exception, regulation 13 requires the authority to give the applicant notice in writing: the requirements of regulation 13 are reproduced in Appendix 1 to this decision.

21. The Commissioner has taken into account the submissions provided by ABWCL in which it provides reasons why it believes the Council should hold the information requested (pertaining to the latter part of the request).

Regulation 10(4)(a) of the EIRs

22. Regulation 10(4)(a) of the EIRs provides that a Scottish public authority may refuse to make environmental information available to the extent that it does not hold that information when an applicant's request is received. As indicated above, the exception in regulation 10(4)(a) is subject to the public interest test.

23. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority. She also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information. While it may be relevant as part of this exercise to explore expectations as to what information the authority should hold, ultimately the Commissioner's role is to determine what relevant information is actually held by the public authority (or was, at the time it received the request).

24. In its submissions to the Commissioner, the Council provided an explanation and evidence of the searches it had carried out to identify and locate the information requested, as follows:

? A manual check of hard copy papers (which included all paper documents submitted by the former Chief Legal Officer) was conducted. The only relevant information identified was that falling within the scope of the first part of the request (i.e. that referred to in paragraph 71 of Decision 070/2014), comprising two documents containing email chains.

? The Head of Planning, Economic Development and Regeneration was contacted and confirmed that any correspondence held within Planning would be held by the Development Management Manager, who had ultimate responsibility for handling and determining the planning application.

? The Development Management Manager confirmed that information held by the Planning Service was on the online planning application file, which was publicly accessible via the Council's website[3] by entering the relevant reference number. All documents post-dating the original request had been searched electronically using the keywords "lbp" and "police", but no relevant information was identified. The Development Management Manager also checked the online planning file but did not identify any correspondence with the police.

? A search of the Council's Legal Services Department's case management system (IKEN) identified one file concerning the planning application. Each document in that file falling within the relevant timeframe was read, but no relevant information was identified.

? Council solicitors who could have been involved in planning matters at the time the planning application was dealt with were contacted, but none held any relevant information. One officer acknowledged that there would have been correspondence with the police at the time, concerning dates and times of meetings, but there was no reason to retain this information and it was no longer held.

? The Chief Executive's Office carried out a search of the Council's document management system (MERIDIO) using the keywords "lbp", "police" and "whitrigg". This search, the Council confirmed, would also cover any of the former Chief Legal Officer's information, if held. No relevant information was identified.

25. In conclusion, the Council submitted that while it held the information sought in the first part of the request (i.e. that referred to in paragraph 71 of Decision 070/2014), it held no information falling within the scope of the latter part of the request (i.e. correspondence post-dating the original information request). It informed the Commissioner that it wished to rely on regulation 10(4)(a) of the EIRs in this respect.

26. Having considered all the relevant submissions and the terms of the request, the Commissioner is satisfied that the Council took adequate, proportionate steps to establish what information it held that fell within the scope of ABWCL's request. She accepts that any information relevant to the request would have been identified using the searches described by the Council.

27. The Commissioner can only consider what information is actually held by the Council, and not information it should hold, or what an applicant believes it should hold. She is therefore satisfied, on the balance of probabilities, that the Council does not (and did not, on receiving the request) hold the information requested in the latter part of the request (i.e. concerning correspondence post-dating the original information request).

The public interest

28. The exception in regulation 10(4)(a) is subject to the public interest test in regulation 10(1)(b) of the EIRs and so can only apply if, in all the circumstances of the case, the public interest in maintaining the exception outweighs the public interest in making the information available. In this case, for the reasons set out above, the Commissioner is satisfied that the Council does not (and did not, on receiving the request) hold the information to which it applied this exception. Consequently, she accepts that there is no public interest in requiring the disclosure of such information and finds that the public interest in making the requested information available is outweighed by that in maintaining the exception.

Commissioner's conclusions

29. The Commissioner concludes that the Council was entitled to apply regulation 10(4)(a) of the EIRs in this case (in respect of the information sought in the latter part of ABWCL's request). In doing so, however, the Council had a duty to give ABWCL notice that it was refusing to make the information available, in terms of regulation 13 of the EIRs.

30. As the Council failed to provide such notice to ABWCL, the Commissioner finds that it failed to comply with regulation 13.

Commissioner's comments

31. The Commissioner is also concerned to note that, in providing its review outcome, the Council provided ABWCL with information that did not fall within the scope of the request. She considers the provision of such information unfortunate and potentially confusing. She welcomes the fact that the Council has recognised its error. She would urge the Council to take steps to ensure that it interprets requests, and requirements for review, accurately, so that it provides only the information the requester has asked for. On the other hand, the Commissioner cannot identify the oversight identified in this paragraph (on this occasion) as a failure to comply with the EIRs.

Regulation 11(2) of the EIRs

32. In this case, in providing ABWCL with the information requested in the first part of the request, the Council redacted some information which it considered to be excepted from disclosure under regulation 11(2) of the EIRs, as it comprised personal data and the relevant conditions applied.

33. Regulation 10(3) of the EIRs provides that where the environmental requested includes personal data, a Scottish public authority shall not make those personal data available otherwise than in accordance with regulation 11. Regulation 11(2) states that, to the extent that environmental information includes personal data of which the applicant is not the data subject, a public authority shall not make it available where either "the first condition" (set out in regulation 11(3)) or "the second condition" (set out in regulation 11(4)) applies.

34. The Council's arguments in this case relate to those parts of the first condition that would apply, where making the information available would contravene any of the data protection principles. In order for a Scottish public authority to rely on this exception, it must show that:

(i) the information is personal data for the purposes of the DPA, and

(ii) making it available would contravene at least one of the data protection principles laid down in the DPA.

Is the withheld information personal data?

35. Personal data" are defined in section 1(1) of the DPA as:

"data which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."

36. During the investigation, the Council accepted that information following the "@" in an email address could not be considered personal data as it did not identify a living individual.

37. The Commissioner must agree with this revised position. The information in question does not relate to living individuals and therefore does not meet the definition of personal data in section 1(1) of the DPA. Given this conclusion, the Commissioner finds that the Council was not entitled to apply regulation 11(2) to withhold information following the "@" in any email addresses redacted.

38. As it has not relied on any other exceptions to withhold this information, the Commissioner requires the Council to disclose it to ABWCL.

39. The remaining withheld information in this case variously comprises the names, job titles and contact details of Council employees (past and present), emergency services staff and non-Council employees. It identifies the parties involved in the email correspondence and the individuals referred to in the body of the correspondence. It also, in some cases, provides the home address and home contact details of certain individuals.

40. The Commissioner has considered the submissions received from the Council on this point, along with the withheld information. In line with these submissions, she is satisfied that the information comprises personal data. Living individuals can be identified from the data, and it is about those individuals and so can be said to relate to them. It is therefore those individuals' personal data, as defined by section 1(1) of the DPA.

41. As indicated above, the Commissioner considers all of the remaining withheld information to be the personal data of the individual(s) to whom it relates. In the circumstances, including the terms of the request and the actual information held, she does not consider it would be possible to disclose any of the withheld information without a real risk remaining that the individual(s) could be identified: consequently it would remain their personal data.

Would disclosure contravene the first data protection principle?

42. The first data protection principle requires that personal data are processed fairly and lawfully. The processing in this case would be the disclosure of the information into the public domain, in response to ABWCL's request.

43. The first principle also states that personal data shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met. In the case of sensitive personal data (as defined by section 2 of the DPA) at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner is satisfied that the personal data under consideration are not sensitive personal data for the purposes of section 2 of the DPA, so it is not necessary for her to consider the conditions in Schedule 3.

44. In what follows, references to Documents 1 and 2 are to the two documents remaining under consideration.

45. In its submissions, the Council argued that disclosure of the withheld personal data in Document 1 would contravene the first data protection principle. As the information concerned the home security arrangements of individuals, the Council considered disclosure would be unfair and unlawful.

46. The Council submitted that it had a duty of care towards its employees and should be able to contact the police regarding home security concerns, without fear that the personal data of the individuals concerned would be publicly disclosed. The Council maintained that such disclosure may prevent staff raising such concerns in future.

47. The Council provided no submissions on this point for Document 2.

48. The Commissioner will now consider whether there are any conditions in Schedule 2 to the DPA which would permit the withheld personal data to be disclosed. If any of these conditions can be met, she must then consider whether disclosure of the information would be fair and lawful.

49. There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules. These three aspects are interlinked. For example, if there is a specific condition in Schedule 2 which permits the personal data to be disclosed, it is likely that disclosure will also be fair and lawful.

Can any of the conditions in Schedule 2 be met?

50. Condition 1 applies when the data subject (i.e. the individual to whom the data relate) has consented to the disclosure of the information.

51. In respect of Document 1, the Council explained that, for the reasons set out above, it wished to continue to withhold all the personal data it had redacted, as it concerned the home security concerns of individuals. In this respect, it confirmed that it had not sought or obtained the consent of the corresponding individuals to disclose their personal data.

52. For Document 2, the Council explained that the personal data had been redacted in accordance with internal guidance and the Council's Data Protection Policy. The Council provided the Commissioner with a copy of its internal guidance, explaining this was currently under review following the issue of Commissioner's Decision 171/2016 ABW Consultants Limited and West Lothian Council[4].

53. The Council explained that all of the individuals whose personal data had been redacted in Document 2 had been contacted. All of these individuals had consented to their personal data, as it appeared in that particular correspondence, being disclosed.

54. In considering the data subjects' consent to the disclosure of their personal data under the EIRs, the Commissioner must be satisfied that this consent was specific to the circumstances, fully informed and freely given. The data subject must be fully aware of the implications of public disclosure of their personal data under the Freedom of Information (Scotland) Act 2002 (FOISA) or the EIRs which is, effectively, a disclosure "to the world". In this case, having considered the submissions from the Council, the Commissioner is satisfied that the consent given by the data subjects, in respect of the personal data redacted from Document 2, was specific to the circumstances, fully informed and freely given.

55. Accordingly, the Commissioner considers that condition 1 in Schedule 2 has been met in this case, in relation to the data subjects' consent to disclosure of their personal data under FOISA or the EIRs, as it appears in Document 2. The Commissioner is aware of no reason why disclosure should be otherwise unfair or unlawful and is satisfied that, in all the circumstances of the case, disclosure as a result of such consent would be fair and lawful. She therefore requires the Council to disclose this information to ABWCL.

56. The Commissioner is somewhat surprised that the Council did not seek the consent of any of the individuals whose personal data was redacted from Document 1, basing its arguments for not doing so on concerns relating to individuals' home security. Whilst she accepts that some of the redacted information relates to this, not all of it does. The Commissioner considers that the Council has taken a somewhat "blanket" approach to the redacted information in Document 1. She notes, and welcomes, that the Council is taking steps to update its guidance on personal data.

57. It is a matter of fact that consent to disclosure has not been sought, or given, by those individuals whose personal data has been redacted from Document 1. In the circumstances, therefore, it appears to the Commissioner that condition 6 in Schedule 2 is the only other one which might permit disclosure of the information to ABWCL. In any event, neither ABWCL nor the Council has argued that any other condition would be relevant.

58. Condition 6 allows personal data to be processed if that processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject (the individual(s) to whom the data relate).

59. There are, therefore, a number of tests which must be met before condition 6 can apply. These are:

(i) Does ABWCL have a legitimate interest in obtaining the personal data?

(ii) If so, is the disclosure necessary to achieve those legitimate interests? In other words, is the processing proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?

(iii) Even if the processing is necessary for ABWCL's legitimate interests, would it nevertheless be unwarranted, in this case, by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

60. There is no presumption in favour of disclosure of personal data under the general obligation laid down by regulation 5(1) of the EIRs. The legitimate interests of ABWCL must outweigh the rights and freedoms or legitimate interests of the data subject before condition 6 will permit the personal data to be disclosed. If the two are evenly balanced, the Commissioner must find that the Council was correct to refuse to disclose the personal data to ABWCL.

Does ABWCL have a legitimate interest in obtaining the personal data?

61. There is no definition within the DPA of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is merely inquisitive. In the Commissioner's published guidance on personal data[5], it states:

"In some cases, the legitimate interest might be personal to the requester - e.g. he or she might want the information in order to bring legal proceedings. With most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

62. In its submissions to the Commissioner, ABWCL stated that the information related to planning matters which had been the focus of an earlier criminal investigation, following which a complaint had been lodged against the police regarding how that investigation had been conducted. ABWCL explained that it was required, as part of the complaints process, to provide investigating officers with as much information as possible relating to those involved in the case, and against whom specific and general complaints were being made. The information requested, ABWCL explained, was necessary to be able to understand the interactions between the Council and the police. ABWCL believed it was essential that anyone with an interest in this case was able to see what was done "in the name of justice" and by whom. In this respect, ABWCL considered it had a legitimate interest in the redacted information.

63. The Council informed the Commissioner that it had not asked ABWCL why it believed it had a legitimate interest in obtaining the information, but acknowledged that ABWCL had explained to the Commissioner that the matter was the subject of a police complaint.

64. The Council also submitted that the information in Document 1 would not appear relevant to the matter of a police complaint, given that it concerned the Council contacting the police with regard to the home security concerns of individuals.

65. The Commissioner has considered all the relevant submissions she has received on this point, along with the withheld personal data.

66. The Commissioner accepts that ABWCL has a legitimate interest in the withheld information, as disclosure would provide some transparency about which individuals were involved in the corresponding communications, information which ABWCL believed necessary for the complaint brought against the police. This is, at least potentially, a matter of wider public interest and the Commissioner is satisfied that it is relevant in this case for the purposes of determining whether ABWCL has a legitimate interest. In all the circumstances, therefore, she accepts that ABWCL has a legitimate interest in obtaining the withheld personal data in Document 1.

Is disclosure necessary to achieve those legitimate interests?

67. The Commissioner must now go on to consider whether disclosure of the withheld personal data would be necessary to meet the legitimate interest she has identified above. As indicated above, this will include consideration of whether the legitimate interest might be met by alternative means which interfere less with the privacy of the data subject.

68. In this case, the Commissioner has carefully considered all relevant submissions she has received, along with the withheld information. She accepts that the legitimate interest in transparency she has identified above cannot be met in full without disclosure of the withheld personal data. To that extent, disclosure is necessary to meet those legitimate interests.

Would disclosure nevertheless be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

69. The Commissioner must, therefore, go on to consider the interests of the data subjects, and whether disclosure would be unwarranted by reason of prejudice to their rights and freedoms or legitimate interests. As noted above, this involves a balancing exercise between the legitimate interests of ABWCL and those of the data subjects. Only if the legitimate interests of ABWCL outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.

70. The Commissioner has also taken into account the submissions by both parties, and of her own briefing on personal data, published on her website[6]. In her briefing, the Commissioner notes a number of factors which should be taken into account in carrying out this balancing exercise. These include:

? whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

? the potential harm or distress that may be caused to the individual by disclosure;

? whether the individual has objected to the disclosure; and

? the reasonable expectations of the individual as to whether the information would be disclosed.

71. As stated above, ABWCL was dissatisfied with the extent to which the Council had redacted personal data.

72. During the investigation, the Council was reminded that the level of seniority of staff within a public authority may have a bearing on whether or not any personal data can be disclosed under FOISA or the EIRs. It was asked to explain the roles and seniority of each individual whose personal data was redacted. The Council duly provided this information.

73. In this case, the withheld information in Document 1 falls into two categories:

? information pertaining to the home security arrangements of certain individuals (or information from which those particular individuals could be identified); and

? information pertaining to the data subjects' public lives (names, email addresses, contact telephone and fax numbers).

74. Where the personal data relates to the home security arrangements of specific individuals, or is information from which those particular individuals could be identified (i.e. name, home address, private telephone number or private email address), the Commissioner accepts that disclosure of the withheld information would prejudice the data subjects' rights and freedoms or legitimate interests to an extent unwarranted by the legitimate interests identified in its disclosure. The Commissioner is therefore satisfied that condition 6 of Schedule 2 is not met for this category of information in this case.

75. In one instance, the redacted information (a direct contact number) related to a particular data subject at the time, but no longer relates to that individual. Should it be the case that the contact details have been reassigned to a different member of staff, disclosure could effectively put the direct contact details (the personal data) of a different member of staff into the public domain. The Commissioner is satisfied that, in this case, disclosure of this information would have the potential to cause harm or distress to the present data subject, who would have a reasonable expectation of privacy in relation to these personal data. The Commissioner is therefore satisfied that condition 6 of Schedule 2 is not met in this case for this information withheld under regulation 11(2).

76. Having concluded that disclosure of some parts of the withheld information would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects, the Commissioner must also conclude that disclosure of this information would be unfair. In the absence of a condition permitting disclosure, she would also regard disclosure as unlawful. In all the circumstances, therefore, she finds that disclosure of this withheld information would breach the first data protection principle and that this information was properly withheld under the exception in regulation 11(2) of the EIRs.

77. Turning to the remainder of the withheld information in Document 1 (i.e. that pertaining to the data subjects' public lives), the Commissioner finds it difficult to accept that disclosure of this information would be a significant intrusion into their lives. In essence, the information would only identify the names of those sending, receiving and copied into the emails in question, the name of an individual involved in a professional capacity, and the contact details of a former senior Council employee.

78. The Commissioner acknowledges that the Council has sought and obtained consent for the disclosure of the personal information in Document 2, but is puzzled why the Council did not consider it appropriate to seek similar consent for at least some of the information redacted in Document 1 (i.e. that which does not identify those individuals raising home security concerns and their associated personal data). She finds this particularly surprising, given that some of the individuals in question are (or were at the time) senior Council employees who would have some kind of expectation that their personal data would be disclosed into the public domain, in response to a request under the EIRs.

79. Furthermore, the Commissioner notes that the Council has not provided submissions describing what, if any, level of harm would be caused to these data subjects if their personal data were disclosed. She also notes that the Council's submissions do not outline any objections to disclosure from those data subjects. The submissions on Document 1 focus entirely on home security arrangements.

80. Where the redacted information contains a name (including a name forming part of an email address), the Commissioner considers disclosure of the name would add to understanding of the correspondence, without leading to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subjects.

81. Where the information comprises a fax number, the Commissioner notes that the information in question is already available in the public domain and so cannot accept that disclosure of this information would lead to unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject.

82. With regard to this remaining withheld information, the Commissioner is satisfied, in all the circumstances of the case, that any intrusion on the data subjects' rights, freedoms or legitimate interests would be insignificant. Having balanced the competing interests of both parties, she is satisfied that disclosure, in this case, would not be unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subjects. The Commissioner can see no reason why disclosure should be otherwise unfair or unlawful. She therefore concludes that disclosure of the remaining withheld information in Document 1 would not breach the first data principle (or indeed any other data protection principle).

83. The Commissioner finds, therefore, that the Council was not entitled to withhold the remaining withheld information in Document 1 under regulation 11(2) of the EIRs.

Information to be disclosed

84. As the Commissioner has found that the Council was not entitled to withhold elements of the withheld information in terms of regulation 11(2) of the EIRs, she requires the Council to disclose that information to ABWCL. The information to be disclosed is:

? all information redacted from Document 2.

? all information following the '@' in any email address that appears in the redacted information in Document 1; and

? information redacted from Document 1, other than information concerning the home security arrangements of staff, or comprising a direct dial telephone number. This will be indicated on a marked copy of Document 1 to be provided to the Council.

Decision The Commissioner finds that West Lothian Council (the Council) partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by ABW Consultants Ltd (ABWCL). The Commissioner finds that the Council was correct to withhold some information under regulation 11 (Personal data) of the EIRs, and complied with the EIRs in that respect. The Commissioner also finds that the Council was not entitled to withhold other information under regulation 11 (Personal data) of the EIRs, and so failed to comply with regulation 5(1) of the EIRs in that respect. She also finds that the Council failed to provide ABWCL with the required notice, required by regulation 13 of the EIRs. The Commissioner therefore requires the Council to provide ABWCL with the information described in paragraph 84 of this Decision Notice, by 29 January 2017.

Appeal

Should either ABW Consultants Ltd or West Lothian Council wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If West Lothian Council (the Council) fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Council has failed to comply. The Court has the right to inquire into the matter and may deal with the Council as if it had committed a contempt of court.

Margaret Keyse
Head of Enforcement

15 December 2016

Appendix 1: Relevant statutory provisions

The Environmental Information (Scotland) Regulations 2004

2 Interpretation

(1) In these Regulations -

?

"environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on -

(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

?

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in paragraphs (a) and (b) as well as measures or activities designed to protect those elements;

?

5 Duty to make available environmental information on request

(1) Subject to paragraph (2), a Scottish public authority that holds environmental information shall make it available when requested to do so by any applicant.

(2) The duty under paragraph (1)-

?

(b) is subject to regulations 6 to 12.

?

10 Exceptions from duty to make environmental information available-

(1) A Scottish public authority may refuse a request to make environmental information available if-

(a) there is an exception to disclosure under paragraphs (4) or (5); and

(b) in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception.

(2) In considering the application of the exceptions referred to in paragraphs (4) and (5), a Scottish public authority shall-

(a) interpret those paragraphs in a restrictive way; and

(b) apply a presumption in favour of disclosure.

(3) Where the environmental information requested includes personal data, the authority shall not make those personal data available otherwise than in accordance with regulation 11.

(4) A Scottish public authority may refuse to make environmental information available to the extent that

(a) it does not hold that information when an applicant's request is received;

?

11 Personal data

?

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject and in relation to which either the first or second condition set out in paragraphs (3) and (4) is satisfied, a Scottish public authority shall not make the personal data available.

(3) The first condition is-

(a) in a case where the information falls within paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 that making the information available otherwise than under these Regulations would contravene-

(i) any of the data protection principles; or

?

13 Refusal to make information available

Subject to regulations 10(8) and 11(6), if a request to make environmental information available is refused by a Scottish public authority in accordance with regulation 10, the refusal shall-

(a) be given in writing as soon as possible and in any event no later than 20 working days after the date of receipt of the request for the information;

(b) specify the reasons for the refusal including, as appropriate, any exception under regulation 10(4) or (5) or provision of regulation 11 and how the Scottish public authority has reached its decision with respect to the public interest under regulation 10(1)(b);

(c) state the basis on which any exception relied on under regulation 10(4) or (5) or provision of regulation 11 applies if it would not otherwise be apparent;

(d) if the exception in regulation 10(4)(d) is relied on, state the time by which the authority considers that the information will be finished or completed; and

(e) inform the applicant of the review provisions under regulation 16 and of the enforcement and appeal provisions available in accordance with regulation 17.

Data Protection Act 1998

1 Basic interpretative provisions

(1) In this Act, unless the context otherwise requires -

?

"personal data" means data which relate to a living individual who can be identified -

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 - The data protection principles

Part I - The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a) at least one of the conditions in Schedule 2 is met, and

?

Schedule 2 - Conditions relevant for purposes of the first principle: processing of any personal data

1. The data subject has given his consent to the processing.

?

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?

---