Decision Notice 293/2024: Responses to an informal consultation
Authority: Inverclyde Council
Case Ref: 202400489
Summary
The Applicant asked the Authority for all the responses given to an informal consultation with local residents on whether the Authority should carry out a formal consultation regarding a Stopping Up Order for a section of a named road. The Authority withheld all the information that fell within scope of the request because it was personal data. The Commissioner investigated and found that the Authority was entitled to withhold the information as personal data.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner)
The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”) (Interpretation); 5(1) (Duty to make environmental information available on request); 11(1) and (2) (Personal data); 17(1), (2)(a) and (b) (Enforcement and appeal provisions)
United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing)
Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data)
Background
1. On 13 December 2023, the Applicant made a request for information to the Authority. He asked for a copy of all the responses to a consultation (issued at the end of November 2023) on the topic of a potential stopping up order concerning Overton Road, Kilmacolm.
2. The Authority responded on 16 January 2024. It notified him that the information was contained within a number of letters and emails, and the Authority was of the view that disclosure would breach the first data protection principle contained within Article 5(1) of the UK GDPR. The Authority stated it was withholding the information as it comprised the personal data of a number of individuals.
3. On 16 January 2024, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with the decision because the consultation document made no provision for anonymous submissions and, therefore, any submissions could not be exempt from disclosure for the reason given by the Authority.
4. The Authority notified the Applicant of the outcome of its review on 8 February 2024. The Authority told the Applicant that he should have been informed that the information he was seeking was environmental information for the purposes of the EIRs. The Authority upheld its earlier response and withheld the information under regulations 11(2)(a) and (b) of the EIRs, on the grounds that it was personal data.
5. On 28 March 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated he was dissatisfied with the outcome of the Authority’s review because the consultation was public, made no provision for submissions in confidence, and the responses should contain little (if any) personal data. He considered that any minimal personal data that was captured by his request could be redacted.
Investigation
6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 18 April 2024, the Authority was notified in writing that the Applicant had made a valid application. The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. The Authority was invited to comment on this application and to answer specific questions. These related to its reasons for withholding the information.
Commissioner’s analysis and findings
9. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
The withheld information
10. The withheld information comprised 46 items of correspondence.
(i) The Authority is withholding the entirety of documents 16 to 18, and parts of documents 25, 29 and 33 under regulation 11(1) of the EIRs.
(ii) The Authority is withholding the remaining information in documents 1 to 46 under regulation 11(2) of the EIRs.
Application of the EIRs
11. The Commissioner is satisfied that any information falling within the scope of the request is properly considered to be environmental information, as defined in regulation 2(1) of the EIRs (see in particular paragraphs (a), (b), (c) and (f) of the definition in regulation 2(1) of the EIRs). The Applicant made no comment on the Authority’s application of the EIRs in this case and the Commissioner will consider the request in what follows solely in terms of the EIRs.
Regulation 5(1) of the EIRs – Duty to make environmental information available
12. Regulation 5(1) of the EIRs requires a Scottish public authority which holds the information to make it available when requested to do so by any applicant. This obligation relates to information that is held by the authority when it receives a request.
13. On receipt of a request for environmental information, the authority must ascertain what information it holds falling within the scope of the request. Having done so, regulation 5(1) requires the authority to make the information available, unless a qualification in regulation 6 to 12 applies (regulation 5(2)(b)).
Regulation 11(1) - Personal information
14. During the investigation, the Authority identified that some of the information (in documents 16 to 18, 25, 29 and 33) was the Applicant’s own personal data, and it applied regulation 11(1) of the EIRs to this particular information.
15. The Applicant asked the Commissioner to consider whether this information could be disclosed.
16. Regulation 10(3) of the EIRs makes it clear that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. Regulation 11(1) prohibits public authorities from making an applicant's own personal data available in response to an EIRs request. This is because individuals have a separate right to make a request for their own personal data under the GDPR (or, as appropriate, under the DPA 2018). This route is more appropriate for individuals accessing their own personal data, as data disclosed in response to a Subject Access Request (SAR) is made available to the data subject: any data disclosed under the EIRs is placed into the public domain.
17. Personal data are defined in section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
18. The Commissioner has considered the information withheld by the Authority under regulation 11(1) of the EIRs and is satisfied that it is the Applicant's own personal data; the Applicant can be identified from the information and the information focusses on - and is biographical in relation to - him. Consequently, it relates to the Applicant. The Commissioner is therefore satisfied that the information is excepted from disclosure under regulation 11(1) of the EIRs.
19. The Commissioner notes that the Applicant has no objection to his own personal data being disclosed under the EIRs. However, the Commissioner cannot order an authority to disclose information under the EIRs which it would, in effect, be unlawful for it to disclose.
Regulation 11(2) of the EIRs – Personal data
20. The Authority is withholding the remainder of the information under regulation 11(2) of the EIRs.
21. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
22. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
23. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would breach the first data protection principle in Article 5(1) of the UK GDPR ("lawfulness, fairness and transparency").
Is the withheld information personal data?
24. As noted above, "Personal data" are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable individual". Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
25. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus. An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
26. The Authority submitted that, given the subject matter of the request, which sought correspondence to the Authority from third parties about a particular issue (a consultation) which made clear the connection between the Authority and the third parties, then the information clearly related to the third parties and their private lives. The Authority submitted that the information was directly about those third parties, their activities and their opinions.
27. The Authority submitted that the information requested was personal data because it related to living persons, their homes, properties and private lives, and that those persons were identifiable from the information contained within the responses. The Authority commented that the Applicant knew the identities of the third parties.
28. Having considered the Authority's submissions and the withheld information, the Commissioner accepts that the withheld information is personal data as it relates to an identified (or identifiable) individuals. He is therefore satisfied that information is personal data in terms of section 3(2) of the DPA 2018. Given the nature of the information, he is satisfied that it would not be practicable to anonymise it.
Would disclosure contravene one of the data protection principles?
29. Article 5(1)(a) of the UK GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."
30. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available". For the purposes of the EIRs, personal data are processed when made available in response to a request. This means that the personal data can only be made available if doing so would be both lawful (i.e. it would meet one of the conditions for lawful processing in Article 6(1) of the UK GDPR) and fair.
Lawful processing: Article 6(1)(f) of the UK GDPR
31. The Commissioner will first consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
32. The Commissioner considers condition (f) (legitimate interests) in Article 6(1) of the UK GDPR to be the only one which could potentially apply in the circumstances of this case
Condition (f): legitimate interests
33. Condition (f) states that the processing will be lawful if it is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
34. Although Article 6 of the UK GDPR states that this condition cannot apply to processing carried out by a public authority in performance of its tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
35. The tests which must be met before Article 6(1)(f) can apply are as follows:
(i) Does the Applicant have a legitimate interest in obtaining the personal data?
(ii) If so, would making the personal data available be necessary to achieve that legitimate interest?
36. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?
Does the Applicant have a legitimate interest in obtaining the personal data?
37. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
38. The Applicant explained that there had been a long running dispute over the rights of public access on a named road. He commented that, as part of the actions taken by the Authority during this dispute, it conducted an informal and non-statutory public consultation to gauge locals’ reaction to stopping up the named road under section 68 of the Roads (Scotland) Act 1984.
39. The Applicant submitted that he and over 56 other neighbours had previously made it clear to the Authority (during a previous consultation on a separate matter related to the same road), via a common letter, that in the event that consideration was given to stopping up the road they did not oppose the stopping up of vehicular traffic along the road but wished access for pedestrians and cyclist to continue. The Applicant commented that the common letter had been resubmitted to the Authority as part of the consultation to which his request referred. In doing so, the Applicant submitted that the Authority had previously (in the earlier consultation) asked for the views of the local community and the local community had responded, via the common letter.
40. The Applicant argued that the consultation (the subject of his request) was a public consultation which made no provision for confidential submissions. He submitted that, if submissions to public consultation remained private, there was a risk of misleading and inaccurate statements being made to the Authority by those responding to the consultation. The Applicant argued that, without the ability to correct and such misleading or inaccurate statements, the Authority’s decision could be unduly influenced by them.
41. The Applicant submitted that the consultation was about the mundane issue of access rights on a minor country road and, as such, any submission made would contain little, if any personal information beyond the name and address of the submitter. He argued that personal data could be redacted, where appropriate.
42. The Applicant submitted that there was clearly a legitimate interest in being able to establish the information used by the Authority to decide to proceed with any formal consultation on the matter. He commented that the community could potentially use this information to challenge the Authority’s justification for a) proceeding with the section 68 stopping up order and/or b) challenging its decision not to retain public access rights for non-vehicular traffic.
43. The Authority acknowledged the Applicant’s legitimate interest in the consultation responses and it recognised that the information would assist him in seeking to understand the Authority’s decision-making and actions in relation to the potential stopping up of a section of the named road.
Is disclosure of the personal data necessary to achieve those interests?
44. Having accepted that the Applicant has a legitimate interest in the withheld personal data, the Commissioner must consider whether disclosure of the personal data is necessary to meet that legitimate interest.
45. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests can be met by means which interfere less with the privacy of the data subject.
46. The Authority explained that the purpose of the informal consultation was to seek views from specific affected residents on whether a formal statutory Stopping Up Order process should be taken forward, or not.
47. The Authority submitted that the Applicant’s legitimate interests would be met by the Statement of Reasons (formally setting out the Authority’s reasons for the consultation) which would be published in the event that a formal statutory consultation was progressed.
48. The Authority submitted that, at the point the review was carried out, the informal consultation responses were still being assessed and no decision had yet been made on whether to proceed with a formal Stopping Up process.
49. The Authority submitted that, in the event that objections were to be received to any formal Stopping Up process, there would be a public inquiry, or hearing by a Scottish Government Reporter before a decision would be made by the Scottish Ministers on the making of a Stopping Up Order.
50. The Authority argued that the disclosure of the withheld information into the public domain while matters were still under consideration would not add anything further to the Applicant’s understanding of the matter and disclosure was therefore not necessary to achieve his legitimate interests.
51. As discussed earlier, the Applicant had concerns that the consultation responses could have contained inaccurate or misleading information which carried a risk of unduly influencing the Authority’s decision making. The Applicant submitted that he and other members of the community could use the information to challenge the decision to pursue the stopping up order.
52. The Commissioner has already accepted that the Applicant has a legitimate interest in the personal data. Having considered all the arguments carefully, the Commissioner acknowledges the arguments put forward by the Authority; however, those arguments are made in relation to the Stopping Up Order itself. The subject of the request is the informal consultation that took place prior to any formal Stopping Up process.
53. In these circumstances, the Commissioner accepts that disclosure of the withheld information would be necessary in order to satisfy the legitimate interests identified.
Interests or fundamental rights and freedoms of the data subjects
54. The Commissioner has acknowledged that disclosure of the information in question would be necessary to achieve the Applicant’s legitimate interests. This must be balanced against the interests or fundamental rights and freedoms of the third parties. Only if the legitimate interests of the Applicant outweigh those of the data subjects could personal data be disclosed without breaching the first data protection principle.
55. The Commissioner's guidance on regulation 11 of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subjects and carrying out the balancing exercise. He makes it clear that, in line with Recital (47) of the UK GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
(i) whether the information relates to an individual’s public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances)
(ii) the potential harm or distress that may be caused by the disclosure
(iii) whether an individual objected to the disclosure
56. The Authority submitted that the consultation responses were personal data relating to individuals’ private lives, and that the withheld information was directly about them, their activities and their opinions. It submitted that disclosure would put detailed information relating to these matters into the public domain.
57. The Authority submitted that the individuals had a reasonable expectation of privacy and a reasonable expectation that information would not be disclosed into the public domain on the basis that they would not expect all of the details contained within the correspondence to be made public.
58. The Authority argued with the Applicant’s description of the subject of his request as “the mundane matter of access rights on a country lane”. It commented that there are extremely polarised views on this issue within the local community, which had caused disharmony and allegations of bullying and harassment.
59. The Authority submitted that the disclosure of the withheld information into the public domain would cause harm and/or distress to a number of those third parties who responded to the informal consultation.
60. The Authority referred the Commissioner to the terms of the privacy notices that applied to the Authority’s handling of the consultation responses and which contained details of the purposes for which the data subjects’ personal data would be used. The Authority submitted that the privacy notices make it clear that personal data will only be processed where it is appropriate and lawful to do so.
61. The Authority commented that it does not routinely publish copies of representations received in connection with consultations or other statutory processes, unless it is under legal obligation to do so.
62. For some of the withheld information, the Authority submitted that the data subjects had specifically stated that they did not consent to the Authority disclosing their personal data. While the Authority recognised that there was a public interest in making the information available in order to scrutinise the actions it had taken, the ground for objecting to processing as highlighted by these individuals held more weight, in terms of the public interest, than any ground the Authority might have in processing their personal data.
63. The Authority submitted that there was no condition in Article 6 of the UK GDPR that would allow the personal data to be disclosed.
64. The Commissioner has very carefully considered the arguments from both parties. He accepts that the Applicant has a legitimate interest in scrutinising the actions of the Authority in relation to the informal consultation. However, in all the circumstances of the case, he cannot accept that this legitimate interest outweighs the rights of all the data subjects.
65. Having fully considered the competing interests in this particular case, the Commissioner finds that the Applicant's legitimate interest is outweighed by the prejudice to the interests, rights and freedoms of the data subjects that would result from disclosure. He therefore finds that condition (f) in Article 6(1) of the UK GDPR cannot be met.
66. In the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must, therefore, conclude that that disclosure of the personal data would be unlawful and would breach the data protection principle in Article 5(1)(a) of the UK GDPR.
Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs.
Decision
The Commissioner finds that the Authority complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.
Appeal
Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Euan McCulloch
Head of Enforcement
11 November 2024
