Decision 273/2024: Supporting statement for a planning application
Authority: Fife Council
Case Ref: 202401099
Summary
The Applicant asked the Authority for a supporting statement in relation to a specific planning application. The Authority disclosed a copy of the statement, subject to the redaction of personal data. The Commissioner investigated and found that the Authority was entitled to withhold the information as personal data.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner) The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”, “the data protection principles”, “data subject”, “personal data”, “the UK GDPR” and and the definition of “environmental information”) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3A)(a) and (7) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions)
United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
Background
1. On 11 June 2024, the Applicant made a request for information to the Authority. Among other things, he asked for the unredacted supporting statement submitted by an applicant as part of a specified planning application.
2. The Authority responded on 9 July 2024. The Authority disclosed a redacted copy of the supporting statement, withholding certain information under the exception in regulation 10(5)(f) of the EIRs.
3. On the same day, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because he disagreed that the exception in regulation 10(5)(f) of the EIRs applied to the withheld information.
4. The Authority notified the Applicant of the outcome of its review on 9 August 2024, which withdrew reliance on the exception in regulation 10(5)(f) of the EIRs and instead relied on the exception in regulation 11(2) to withhold the same information. The Authority explained that the withheld information had been provided “above the normal requirements” of an application and there was a reasonable expectation that such information would remain confidential between the applicant and the decision maker.
5. On 15 August 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated that he was dissatisfied with the outcome of the Authority’s review for the following reasons:
- he disagreed that there was a reasonable expectation of privacy
- the Authority had conceded that he had a legitimate interest in disclosure of the information but had failed to clarify who the withheld information related to.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 4 September 2024, the Commissioner gave the Authority notice in writing of the application. The Authority was also asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information, and the case was subsequently allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to its reasons for withholding information under the exception in regulation 11(2) of the EIRs.
Commissioner’s analysis and findings
9. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
Application of the EIRs
10. Having considered the withheld information and the terms of the request, the Commissioner accepts the decision of the Authority to deal with the request under the EIRs rather than under FOISA.
11. The Commissioner is satisfied that the information covered by the request is environmental information, as defined in regulation 2(1) of the EIRs. He would also note that he can see no detriment to the Applicant by considering his request under the EIRs rather than FOISA, nor has the Applicant disputed the Authority’s decision to handle his request under the EIRs.
Regulation 5(1) of the EIRs – Duty to make environmental information available
12. Regulation 5(1) of the EIRs requires a Scottish public authority which holds the information to make it available when requested to do so by any applicant. This obligation relates to information that is held by the authority when it receives a request.
13. On receipt of a request for environmental information, the authority must ascertain what information it holds falling within the scope of the request. Having done so, regulation 5(1) requires the authority to make the information available, unless a qualification in regulation 6 to 12 applies (regulation 5(2)(b)).
Regulation 11(2) – Personal data
14. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
15. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
16. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would breach the first data protection principle in Article 5(1) of the UK GDPR ("lawfulness, fairness and transparency").
Is the withheld information personal data?
17. The withheld information comprises certain information redacted by the Authority from a supporting statement submitted by an applicant as part of a specified planning application.
18. "Personal data" are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
19. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus. An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
20. The Authority submitted that the withheld information is personal data, as defined in section 3(2) of the DPA 2018, because it related to an identifiable living individual (the planning applicant).
21. Having considered the Authority's submissions and the withheld information, the Commissioner accepts that the withheld information is personal data as it relates to an identified (or identifiable) individual. He is therefore satisfied that information is personal data in terms of section 3(2) of the DPA 2018.
Would disclosure contravene one of the data protection principles?
22. Article 5(1)(a) of the UK GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."
23. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". For the purposes of the EIRs, personal data are processed when made available in response to a request. This means that the personal data can only be made available if doing so would be both lawful (i.e. it would meet one of the conditions for lawful processing in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Article 6(1)(f) of the UK GDPR
24. The Commissioner will first consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
25. The Commissioner considers condition (f) (legitimate interests) in Article 6(1) of the UK GDPR to be the only one which could potentially apply in the circumstances of this case
Condition (f): legitimate interests
26. Condition (f) states that the processing will be lawful if it is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
27. Although Article 6 of the UK GDPR states that this condition cannot apply to processing carried out by a public authority in performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
28. The tests which must be met before Article 6(1)(f) can apply are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would making the personal data available be necessary to achieve that legitimate interest?
(iii) Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?
Does the Applicant have a legitimate interest in obtaining the personal data?
29. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
30. The Applicant explained that he required the personal data because his client was involved in a legal dispute with the data subject, and it was essential that his client was fully aware of all of the data subject’s comments.
31. The Authority acknowledged that the Applicant has a legitimate interest in obtaining the personal data. The Commissioner agrees.
Is disclosure of the personal data necessary?
32. Having accepted that the Applicant has a legitimate interest in the withheld personal data, the Commissioner must consider whether disclosure of the personal data is necessary to meet that legitimate interest.
33. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests can be met by means which interfere less with the privacy of the data subject.
34. The Authority stated that it did not believe disclosure of the personal data was necessary to achieve the Applicant’s legitimate interest. The Authority concluded that the right to privacy of the data subject overrode the Applicant’s legitimate interest and noted that the personal data in question was not considered during the planning application decision.
35. As stated above, the Applicant explained that he required the personal data because his client was involved in a legal dispute with the data subject, and it was essential that his client was fully aware of all of the data subject’s comments. He submitted that the personal data had been read by planning officers responsible for deciding the planning application and that, while they may have been instructed to disregard the information, one cannot “unknow” what is known.
36. The Commissioner has already accepted that the Applicant has a legitimate interest in the personal data. However, in the circumstances, he is not persuaded that disclosure of the personal data would be necessary to satisfy the Applicant’s legitimate interest.
37. As rehearsed earlier, the Applicant explained that he required the information because his client was involved in a legal dispute with the data subject, and it was essential that his client was fully aware of all of the data subject’s comments.
38. In these circumstances, the Commissioner understands that there would be procedures available to the Applicant that would allow him to obtain the information outwith the EIRs (e.g. information material to the legal dispute would be advanced as evidence in court or, if it was not advanced, an application could be made to the court to make the information available to him and his client). Neither of those mechanisms would necessitate disclosure to the world at large, which would be the effect of disclosure
under the EIRs.
39. Having considered all of the circumstances, the Commissioner is satisfied that, although the Applicant has a legitimate interest in the personal data, disclosure is not necessary to achieve that legitimate interest as that interest can be met by means which interfere less with the privacy of the data subject.
40. The Commissioner will, nevertheless, go on to consider whether, if he had found disclosure necessary to achieve the Applicant’s legitimate interest, this would have overridden the interests or fundamental rights and freedoms of the data subject.
Interests or fundamental rights and freedom of the data subject
41. The Commissioner must now balance the legitimate interests in disclosure against the data subjects’ interests or fundamental rights and freedoms. Only if the legitimate interests of the Applicant outweigh those of the data subject can the information be disclosed without breaching the first data protection principle.
42. The Commissioner's guidance on regulation 11 of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subjects and carrying out the balancing exercise. He makes it clear that, in line with Recital (47) of the UK GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
(i) whether the information relates to an individual’s public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances)
(ii) the potential harm or distress that may be caused by the disclosure
(iii) whether an individual objected to the disclosure.
43. The Commissioner has fully considered the submissions from the Authority and from the Applicant, particularly his statement that he and his client are involved in a legal dispute with the data subject. The Commissioner has also fully considered the nature and content of the withheld information.
44. Having done so and having fully considered the competing interests in this particular case, the Commissioner finds that the Applicant's legitimate interest is outweighed by the prejudice to the interests, rights and freedoms of the data subject that would result from disclosure. He therefore finds that condition (f) in Article 6(1) of the UK GDPR cannot be met.
45. In all the circumstances of this particular case, therefore, and in the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that that disclosure of the personal data would be unlawful and would therefore breach the data protection principle in Article 5(1)(a) of the UK GDPR. Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs.
Decision
The Commissioner finds that the Authority complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by the
Applicant.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
David Hamilton
Scottish Information Commissioner
26 November 2024
