Home Decisions

Decision 038/2026

Decision 038/2026:  Councillors and senior managers - unpaid council tax


Authority: Highland Council
Case Ref: 202501160
 

Summary

The Applicant asked the Authority for information relating to the number of councillors and senior management team members with unpaid council tax.  The Authority withheld the information on the basis that it was third party personal data.  The Commissioner found that the Authority had wrongly withheld the information and required it to be disclosed.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 38(1)(b) (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data” (Definitions) and 5(1)(a) (Principles relating to processing of personal data). 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 5 May 2025, the Applicant made a request for information to the Authority.  He asked:

    1. How many Authority councillors and members of the Authority’s senior management team currently have unpaid council tax bills?

    2. What’s the total amount they owe? 

    3. In the last two years, between 05/05/2023 to 05/05/2025, how many Authority councillors and members of the Authority’s senior management team have had unpaid council tax bills?

  2. The Authority responded on 13 June 2025.  It withheld all of the information under section 38(1)(b) (Personal information) of FOISA and stated that the very small numbers involved could lead to the identification of individuals.
  3. On 25 June 2025, the Applicant wrote to the Authority, requesting a review of its decision as he did not believe the information could identify individuals, and that in any case he believed there was a legitimate public interest in the information.
  4. The Authority notified the Applicant of the outcome of its review on 16 July 2025, which fully upheld its original decision.
  5. On 17 July 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because there was a legitimate interest in disclosure of the information.  

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 15 August 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to why it considered the withheld information would be likely to identify individuals. 

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.
  2. In this case, the Commissioner is unable to set out the Authority’s arguments (or his own reasoning) in full as doing so could itself lead to the disclosure of the contents of the information which has been withheld by the Authority.  This consideration has been acknowledged by the courts.  
    In the case of  Scottish Ministers v Scottish Information Commissioner (William Alexander’s Application) [2006] CSIH 8 , the Court of Session commented that, in giving reasons for a decision, the Commissioner is necessarily restrained by the need to avoid disclosing information which ought not to be disclosed.
  3. The Commissioner would note that the above is relevant to every case (including those where he requires disclosure of information), because of the possibility that any decision may be appealed to the Court of Session under section 56 (Appeal against notices under Part 4) of FOISA[1].  The Commissioner must therefore ensure he does not include anything within a Decision Notice which would directly, or indirectly, disclose information which has been withheld by an authority. 

The Authority’s comments on its interpretation of the request

  1. The Authority noted that, in relation to requests (i) and (iii), there was no real definition of “unpaid bills” and it argued that all council tax payers had unpaid bills at the point when the bills were first sent out.  It explained that some were on direct debit schemes and did not need to take any action in relation to payment.  Those who were not on direct debit schemes had to take action themselves and those who did not do so within a set period would receive reminders.
  2. The Authority added that (in relation to unpaid bills) it had assumed that the Applicant was interested in cases where the bill had not been paid following a reminder and the debt was automatically transferred to the next stage in the process.  This was where a Sheriff’s warrant was applied for and the debt transferred to the Sheriff’s Officers to follow up.
  3. The Commissioner agrees that the Applicant’s request for unpaid bills relates to cases where a bill has not been paid, following a reminder.

Section 38(1)(b) – Personal information 

  1. The Authority is withholding all of the information falling within the scope of requests (i), (ii) and (iii) under section 38(1)(b) of FOISA.
  2. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data“ (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
  3. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b).
  4. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.

Is the withheld information personal data? 

  1. The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018 i.e. any information relating to an identified or identifiable individual.  
    “Identified living individual” is defined in section 3(3) of the DPA 2018. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
  2. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland (C-582/14)[2].  
    The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified. In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party.  However, there must be a realistic causal chain – if the risk of identification is “insignificant”, the information won’t be personal data.
  3. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply.  As set out in Recital (26) of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly.
  4. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, the available technology at the time of processing and technological developments.  It confirms that data should be considered anonymous (and therefore no longer subject to the UK GDPR) when the data subject(s) is/are no longer identifiable.

The Authority’s comments on identifiability

  1. The Authority provided comments on the reasons why it believed the withheld information could identify individuals.  While he will not include all of these comments here, for the reasons set out in paragraphs 10 and 11, the Commissioner has fully considered these.
  2. The Authority stated that it was concerned that, by disclosing the very low numbers which were requested, the identities of the individuals would be released indirectly as a result of other information held by individuals in their communities.
  3. It argued that publicity was likely to arise from disclosure of the number and that this would increase the likelihood that members of the Authority and the wider community would be able to identify the individuals involved, and that this information could be further distributed via social media.
  4. The Authority also explained that its senior management structure for the relevant time period comprised 17 individuals (the total was 18 but one post was vacant).
  5. The Authority stated that its concern related to people who knew particular individuals through their personal or professional life and who were aware of their personal circumstances.
  6. The Authority argued that in making its comments it had taken into account the Commissioner’s decision 019/2018[3] (and aspects of the reasoning within that Decision Notice) which considered a request made to a different authority for the names of three councillors with council tax arrears.
  7. It also provided the Commissioner with comments in relation to request (ii), which the Commissioner will not detail here but which he has fully considered.

The Applicant’s comments on identifiability

  1. The Applicant stated that there were 74 Highland councillors across a number of wards and the chance of individuals being identified was really low.
  2. It addition, he argued that a similar information request had been submitted to another authority in 2017 and he provided the text of this request.  (There were some differences between the requests, including that the earlier request had asked for councillors’ names.)
  3. The Applicant included a link to the older request and the other authority’s response[4] which included disclosure of the number of reminders and final notices issued for each of three separate years.  (Names were withheld under section 38(1)(b) of FOISA.)
  4. The Applicant argued there was therefore already an example of another authority disclosing the information he sought from this Authority, and he commented that the other authority had fewer councillors, so there was more chance of individuals being identified, but that it still disclosed the information.

The Commissioner's view

  1. The Commissioner has carefully considered the submissions from both parties, together with the information withheld from the Applicant.

  2. The Commissioner’s guidance on section 38(1)(b) of FOISA[5] advises that in most cases it will be easy to tell if information is personal data but in some cases it can be more difficult. Furthermore, the guidance notes that it can be difficult to know whether disclosing numbers will lead to living people being identified.  Paragraph 24 of the guidance states: 

    “Public authorities responding to requests for numbers will therefore have to determine whether members of the public would be able to identify individuals from the statistics if they are disclosed.”

  3. In all the circumstances of this case, the Commissioner does not consider that the Authority has successfully argued that the withheld information would identify living individuals.  While the Authority stated that individuals could be identified as a result of other information held by individuals in their communities, the Authority did not specify what sort of information it believed this to be and how that information would lead to the identification.
  4. The Commissioner considers that, while the Authority has stated that it strongly believes that the information could lead to identification, it has failed to present specific arguments about, or examples of, situations where it believed identification was likely to arise.  The Commission finds that the Authority has not evidenced a realistic causal link between the withheld information and how that would identify a living individual. 
  5. Given the pool of 91 potential individuals to which the withheld information could relate (in terms of both councillors and members of the senior management team), the large geographical area covered by the Authority and its councillors (mostly of relatively low population density), and on the basis of the submissions received, the Commissioner considers that it is unlikely that particular individuals could be identified.  His view is that the risk of identification is insignificant and that, consequently, the information requested would not be personal data.
  6. The Commissioner notes that an authority can provide him with whatever additional contextual information it deems necessary so that its submissions can be fully evidenced.  However, in this case the Authority did not specify examples of the means of identification it had in mind, and the Commissioner finds it difficult to be clear about exactly what that might be.  He has to bear in mind that the withheld information would need to be capable of making a material contribution to identification (i.e. of adding significantly to what is known already) and he is not satisfied, from the submissions provided, how it might do so.
  7. The Commissioner also notes the Authority’s reference to Decision 019/2018[6].  However, he considers that, while that decision occupies similar territory to this one, in terms of background subject matter, the previous decision is not equivalent to this current one.  The reason for this is that in relation to the previous decision notice, the number of individuals concerned was already in the public domain (in relation to councillors only) and the request in that instance had asked for the names of those councillors.
  8. In this current appeal, in contrast, requests (i) and (iii) encompassed both councillors and senior officials and did not ask for names, only numbers.  Furthermore, in request (ii), the Applicant sought a total number in relation to money owed.  The Commissioner does not agree that this number alone would identify a living individual and therefore he cannot accept that the exemption was properly applied to this information.
  9. The Commissioner would note that it is for the Authority to provide the required evidence of how such identification would be likely to occur, not for him to go out and find it or to make the case on behalf of the Authority.  Consequently, in this case, the Commissioner is not satisfied that the information requested was properly withheld under this exemption.
  10. In all the circumstances of the case, and in light of all the submissions provided, therefore, the Commissioner is not persuaded that a realistic causal chain exists where living individuals could be identified as a result of disclosing the withheld information.  As such, he does not agree that this is personal data as defined in section 3(2) of the DPA 2018.
  11. The Commissioner must therefore find that the Authority was not entitled to withhold information falling within the scope of requests (i), (ii) and (iii) under section 38(1)(b) of FOISA.  He requires the Authority to disclose the withheld information to the Applicant.

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that the Authority was not entitled to withhold the information as personal data and, by doing so, failed to comply with section 1(1) of FOISA.

The Commissioner therefore requires the Authority to disclose the requested information to the Applicant, by 24 April 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

 

Euan McCulloch 

Head of Enforcement 

 


10 March 2026