Decision 084/2025: Correspondence regarding gates at the junction of two roads

Authority: Inverclyde Council
Case Ref: 202400571


 

Summary

The Applicant asked the Authority for information for any correspondence it had sent to named persons regarding gates at the junction of two specified roads.  The Authority withheld the information requested on the basis it was third party personal data.  The Commissioner investigated and found that the Authority was entitled to withhold some of the information requested, but not all of it.  He required the Authority to disclose the wrongly withheld information. 

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”, “the data protection principles”, “data subject”, “personal data”, “the UK GDPR” and the definition of “environmental information”) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 10(3) (Exceptions from duty to make environmental information available); 11(2), (3A)(a) and (7) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 5 December 2023, the Applicant made a request for information to the Authority.  Having provided the background to his request, he asked, among other things, for 

• Any written communication by the Authority to three named individuals since 1 January 2022 containing reference to the gates at the junction of Barclaven Road and Overton Road, Kilmalcolm. 

2. The Authority responded on 5 January 2024 in terms of the EIRs. It withheld the information requested under regulation 11(2) of the EIRs.
3. Later that day, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the Authority’s decision because he did not agree that regulation 11(2) of the EIRs applied to the extent claimed by the Authority.
4. The Authority notified the Applicant of the outcome of its review on 2 February 2024, which fully upheld its original decision.
5. On 16 April 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that he was dissatisfied with the Authority’s review because he disagreed that regulation 11(2) of the EIRs applied to the extent claimed by the Authority. 

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 23 April 2024, the Authority was notified in writing that the Applicant had made a valid application, and it was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information, and the case was subsequently allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions regarding the searches it had carried out and its application of regulation 11(2) of the EIRs.  Further comments were also sought, and obtained, from the Applicant.

Commissioner’s analysis and findings

9. The Commissioner has considered all the submissions made to him by the Applicant and the Authority.
10. As has been noted in previous decisions, the Commissioner is unable to explain fully his reasoning in respect of all the points below, as to do so may reveal the content of the withheld information. (This factor has been acknowledged by the courts.  In the case of Scottish Ministers v Scottish Information Commissioner [2007] CSIH 8[1], the Court of Session commented that, in giving reasons, the Commissioner is necessarily restrained by the need to avoid disclosing information which ought not to be disclosed.)
11. As far as he can without revealing the content of information that is withheld, the Commissioner will explain his reasons below, but certain factual information is, where necessary, expressed in general terms – with limited reference to specific information. 

Application of the EIRs

12. Having considered the subject matter and the terms of the request, the Commissioner accepts the decision of the Authority to deal with the request under the EIRs rather than under FOISA.
13. The Commissioner is satisfied that the information covered by the request is environmental information, as defined in regulation 2(1) of the EIRs.  He would also note that he can see no detriment to the Applicant by considering his request under the EIRs rather than FOISA, nor has the Applicant disputed the Authority’s decision to handle his request under the EIRs

Section 39(2) of FOISA – Environmental information

14. The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs.
15. In this case, the Commissioner accepts that the Authority was entitled to apply this exemption to the information requested, given his conclusion that it is properly classified as environmental information.
16. As there is a statutory right of access to environmental information available to the Applicant in this case, the Commissioner accepts, in all the circumstances, that the public interest in maintaining this exemption (and responding to the requests under the EIRs) outweighs any public interest in disclosing the information under FOISA.
17. The Commissioner therefore concludes that the Authority was correct to apply section 39(2) of FOISA and consider the Applicant's information requests under the EIRs.   He will therefore consider this case, in what follows, solely in terms of the EIRs.

Regulation 5(1) – Duty to make available environmental information

18. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any Applicant. This obligation relates to information that is held by the authority when it receives a request.
19. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within the scope of the request. Having done so, regulation 5(1) of the EIRs requires the authority to make that information available, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).

Information held by the Authority

20. During the investigation, the Authority was asked how it had ensured that it had identified all the information falling within the Applicant's request.
21. The Authority provided details of how it had established what information it held falling within the request.  It also conducted further searches during the investigation (which identified no further relevant information) and provided details of these searches, including the keywords used and the locations searched.
22. The standard of proof to determine whether a public authority holds information is the civil standard of the balance of probabilities.  In determining where the balance lies, the Commissioner considers the scope, quality and thoroughness and the results of searches carried out by the public authority.  He also considers, where appropriate, any reasons offered by the public authority to explain why it does not hold the information.  
23. Having considered the submissions, the Commissioner is satisfied that the Authority carried out adequate searches, and that these were likely to find all the information falling within the scope of the Applicant’s request.
24. In all of the circumstances, therefore, Commissioner is satisfied, on the balance of probabilities, that the Authority does not (and did not, on receipt of the request) hold any further information falling within the Applicant’s request

Regulation 11(2) of the EIRs – Personal data

25. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
26. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply.  These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
27. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would breach the first data protection principle in Article 5(1) of the UK GDPR ("lawfulness, fairness and transparency"). 

Is the withheld information personal data? 

28. The Commissioner must address whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual.  "Identifiable living individual" is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
29. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
30. As stated above, the Applicant did not agree that the exemption in regulation 11(2) of the EIRs applied to the extent claimed by the Authority.
31. In contrast, the Authority submitted that all of the withheld information was personal data as it related to a living person, their home and their private life, and that living person was identifiable from the withheld personal data.
32. The Commissioner has carefully considered the withheld information.  Having done so, he accepts that some of it comprises personal data.  It is clearly possible to identify individuals (i.e. the third-party recipient and employees of the Authority) from this information and some of it has biographical significance for the third party recipient.
33. However, the Commissioner is not satisfied that all of the withheld information comprises personal data.  This is because some of it appears to simply set out the Authority’s position, as an organisation, regarding the matter of gates on at the junction of the two roads in question.  He does not consider this information to constitute the personal data of the third party recipient or of the employees of the Authority – it is not biographical in nature, and it does not inherently relate to, or have as its main focus, any of these data subjects.
34. In the absence of another exception being applied to withhold this information, the Commissioner requires the Authority to disclose it to the Applicant.
35. The Commissioner will go on to further consider the withheld information he has accepted is personal data (as it relates to an identified - or identifiable - individuals).

Would disclosure contravene one of the data protection principles?

36. Article 5(1)(a) of the UK GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject".
37. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available".  In the case of the EIRs, personal data are processed when disclosed in response to a request.  This means that personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
38. As noted above, Article 5(1) of the UK GDPR states that personal data should be processed lawfully, fairly and in a transparent manner in relation to the data subject(s). The Commissioner must therefore consider if disclosure (the processing of the personal data) would be fair, lawful and transparent.  In considering lawfulness, he must consider whether any of the conditions in Article 6 to the UK GDPR would allow the data to be disclosed.
39. The Commissioner considers that, in the circumstances, the only condition in Article 6(1) which could apply is condition (f).

Condition (f): legitimate interests

40. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of the personal data…"
41. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
42. The tests which must be met before Article 6(1)(f) can be met are as follows:

• Does the Applicant have a legitimate interest in obtaining the personal data?

• If so, would making the personal data available be necessary to achieve that legitimate interest?

• Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data? 

43. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
44. The Authority accepted that the Applicant has  a legitimate interest in the personal data as it would assist him in seeking to understand its decision-making and actions in relation to the gate in question. However, it considered his legitimate interest had already been met (this is considered later).
45. The Applicant provided submissions explaining his legitimate interest in obtaining the withheld personal data.  The Commissioner agrees that the Applicant has a legitimate interest in obtaining most of the withheld personal data.  He accepts that the Applicant has a legitimate interest both in the content of the correspondence and the identities of those involved.
46. However, the Commissioner does not accept that the Applicant has a legitimate interest in the contact details of those involved (i.e. email addresses or phone numbers).  In his view, disclosure of these contact details would not advance, to any degree, the legitimate interest he has accepted the Applicant has in both the content of the correspondence and the identities of those involved.  He therefore finds that the Applicant does not have a legitimate interest in obtaining the contact details of the data subjects.

Is disclosure of the information necessary for the purposes of these legitimate interests?

47. Having accepted that the Applicant has a legitimate interest in most of the withheld personal data, the Commissioner must consider whether disclosure of those personal data is necessary to meet that legitimate interest.
48. "Necessary" means "reasonable" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities must consider whether disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subjects.
49. The Authority believed that the Applicant’s legitimate interest had already been met by the sending of an email to him on 2 October 2023 from the Authority’s Head of Legal, Democratic, Digital and Customer Services.  It considered this email provided the Applicant with sufficient information regarding the Authority’s position in relation to the gate and was “on substantially similar terms” to the email to the third party that was being withheld in this case.  Disclosure of the withheld information would not add anything further to the Applicant’s understanding of the matter and was therefore not necessary to satisfy his legitimate interest.
50. The Applicant commented that he was concerned (as were his neighbours) that at each stage of this dispute employees of the Authority had sided with the small number of householders/landowners who were attempting to remove access rights.  He considered it was therefore in the public interest that “all of the inputs and process steps involved in making these decisions were made public”.
51. While he acknowledges the Authority’s position that the Applicant has already received substantially similar information through the email sent to him on 2 October 2023, the Commissioner accepts that the Applicant wants to compare what he has been told by the Authority with what it has communicated to other interested parties and what those parties have communicated to the Authority.  There seems no other way to achieve a complete understanding of this without full disclosure of the withheld personal data (excluding the contact details of the data subjects).
52. Having considered all the circumstances, the Commissioner is satisfied that the Applicant has a legitimate interest in most of the personal data and that disclosure of that personal data is necessary to achieve that legitimate interest. 

Interests and fundamental freedom of the data subjects

53. The Commissioner must now balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms.  Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed.
54. The Commissioner's guidance on regulation 11[2] of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subjects and carrying out the balancing exercise.  He makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:

    1. whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances);

    2. the potential harm or distress that may be caused by the disclosure;

    3. whether an individual objected to the disclosure.

55. In this case, there are three data subjects: the third party recipient and two employees of the Authority. 

The employees of the Authority

56. The employees of the Authority both occupy senior positions within the Authority and the correspondence relates to their work in those positions.  It will normally be the case that the higher the position and the greater the authority of an individual, the greater is the argument for openness, transparency and accountability.
57. The Authority has not provided any specific submissions on how the interests or fundamental rights and freedoms of these data subjects would be affected by disclosure of their personal data.
58. Having carefully balanced the legitimate interests of the Applicant against the interests or fundamental rights or freedoms of these data subjects, the Commissioner finds that the legitimate interests served by disclosure of the personal data (excluding their contact details) would not be outweighed by any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of these data subjects.  He finds that condition (f) in Article 6(1) of the UK GDPR can be met in relation to the personal data of these data subjects.
59. The Commissioner must also consider whether disclosure would be fair.  He finds, for the same reasons as he finds that condition (f) in Article 6(1) can be met, that disclosure of the withheld information would be fair.
60. In the absence of any reason for finding disclosure of this information to be unlawful other than a breach of Article 5(1)(a) (and none has been put forward by the Authority) and given that the Commissioner is satisfied that condition (f) can be met, he must find that disclosure would be lawful in this case.  He therefore finds that disclosure of this information would not breach the first data protection principle, and so the Authority was not entitled to withhold this information under the exception in regulation 11(2) of the EIRs

The third party

61. The Applicant provided detailed submissions on why the information should be disclosed.   The Commissioner has considered these submissions in full and has summarised what he considers to be the key points.
62. The Applicant explained that the subject matter of his request related to a long running access dispute as to whether Overton Road and the greenbelt land are areas in which public access rights exist under the Land Reform (Scotland) Act 2003 and/or Roads (Scotland) Act 1984.  He stated that the Authority has a statutory duty to ensure that access rights/rights of public passage are not obstructed under both statutes.
63. Despite this statutory duty, the Applicant, as stated above, submitted that he was concerned (as were his neighbours) that at each stage of this dispute employees of the Authority had sided with the small number of householders/landowners who were attempting to remove access rights.  He considered it was therefore in the public interest that all of the inputs and process steps involved in making these decisions were made public.
64. In terms of the rights of individuals to privacy under the DPA 2018, the Applicant commented that:

• the basic details of the individuals named in the request (e.g. addresses) were already in the public domain and their land holdings were held in public registers

• he considered there to be little, if any, additional “private information” that would be contained in the withheld information

• his request focused on what the Authority had communicated to the individuals named in his request, so he did not understand why the withheld information would contain “private data” concerning these individuals.

65. The Applicant also commented that the information requested was “materially similar” to the type of disclosure that would be publicly available in connection with a planning application/decision.  He therefore saw no reason why this information should be excepted from disclosure under the EIRs and considered that disclosure was instead necessary to ensure transparency and accountability, good decision-making by public bodies, the upholding of standards of integrity, justice and fair treatment for all and the best use of public resources.
66. The Authority argued that, were the Commissioner to decide that disclosure of the personal data into the public domain was necessary to achieve the Applicant’s legitimate interest, the unwarranted prejudice that would result to the rights and freedoms of the data subject overrode his legitimate interest.
67. The Authority noted that disclosure of the withheld personal data would place in the public domain information relating to the data subject’s private life.  It considered that the data subject had reasonable expectation of privacy and reasonable expectations that the withheld personal data information would not be disclosed into the public domain.
68. The Authority also considered that disclosure of the withheld data into the public domain would cause harm and/or distress to this data subject.  It explained why it was of this view.  The Commissioner is unable to reproduce these reasons, within this Decision Notice, without breaching the obligation of confidentiality in section 45 of FOISA.
69. In the Commissioner's view, there would be no expectation on the part of this data subject that personal data of this nature would be disclosed into the public domain in response to a request made under the EIRs.  He accepts that the information relates to this data subject’s private life. In the circumstances, the Commissioner is satisfied that disclosure of the information would have the potential to cause considerable harm and distress to the data subject.
70. The Commissioner has carefully considered the arguments from both parties.  He has already accepted the Applicant has a legitimate interest in the personal data of this data subject (excluding their contact details).  However, in all the circumstances of the case, he cannot accept that this legitimate interest outweighs the rights of this data subject.
71. Having fully considered the competing interests in this case, the Commissioner finds that the Applicant's legitimate interest is outweighed by the prejudice to the interests, rights and freedoms of the data subject that would result from disclosure.  He therefore finds that condition (f) in Article 6(1) of the UK GDPR cannot be met.
72. In the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that that disclosure of the personal data would be unlawful and would therefore breach the data protection principle in Article 5(1)(a) of the UK GDPR. Consequently, he is satisfied that disclosure of the personal data of this data subject is not permitted by regulation 11(2) of the EIRs.
73. The Authority also argued that disclosure of the personal data of this data subject would contravene Article 21 of the UK GDPR.  Article 21 gives data subjects the right to object to the processing of their personal data concerning him or her.  Where a data subject has exercised their rights under Article 21, the controller (here, the Authority) can no longer process the data unless there are compelling grounds for doing so which override the interests, rights and freedoms of the data subject.
74. As the Commissioner has already concluded that disclosure of the personal data of this data subject would be unlawful and would therefore breach the data protection principle in Article 5(1)(a) of the UK GDPR, he has not gone on to consider whether disclosure would also contravene Article 21.

Decision 

The Commissioner finds that the Authority partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant. 

The Commissioner finds that, by correctly withholding some third-party personal information under regulation 11(2) of the EIRs, the Authority complied with the EIRs.

However, by wrongly withholding other information under regulation 11(2), the Authority failed to comply with regulation 5(1) the EIRs. 

The Commissioner therefore requires the Authority to disclose the information wrongly withheld under regulation 11(2) of the EIRs, by 22 May 2025. 

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement 

 7 April 2025