Decision 085/2025: Delisting a road

Authority: Inverclyde Council
Case Ref: 202400554
 

Summary

The Applicant asked the Authority for communications about the delisting of a specified road.  The Authority disclosed some information, but withheld other information on the basis that it comprised third party personal data.  The Commissioner investigated and found that the Authority was entitled to withhold the information as personal data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner)

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”) (Interpretation); 5(1) (Duty to make environmental information available on request); 11(2) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions)

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) and (b) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing) 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of data)  

Background

1. On 25 October 2023, the Applicant made a request for information to the Authority.  He asked for any communication (before the Authority published its decision to delist a section of Overton Road) between the Authority and any of the respondents to the public consultation “which contains any mention that Overton Road was listed in error”.
2. The Authority responded on 22 November 2023 in terms of the EIRs.  It disclosed some information but withheld other information under the exception in regulation 11(2) of the EIRs.
3. On 24 November 2023, the Applicant wrote to the Authority requesting a review of its decision.  He was dissatisfied with the Authority’s decision because he had “only been provided with partial information”.
4. The Authority notified the Applicant of the outcome of its review on 20 December 2023, which upheld its original decision.  It also stated that it considered regulation 11(2)(b) of the EIRs applied to some of the information requested and explained why.

5. On 28 March 2024, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review as he could see no reason why the Authority’s communication to members of the public on this subject would, beyond their name, contain personal data.  He therefore considered that the withheld information could be disclosed or disclosed in a redacted form.

    

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 18 April 2024, the Authority was notified in writing that the Applicant had made a valid application, and it was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was subsequently allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions related to its reasons for withholding the information.

Commissioner’s analysis and findings

9. The Commissioner has considered all the submissions made to him by the Applicant and the Authority. 

Application of the EIRs

10. The Commissioner is satisfied that any information falling within the scope of the request is properly considered to be environmental information, as defined in regulation 2(1) of the EIRs.  The Applicant made no comment on the Authority’s application of the EIRs in this case and the Commissioner will consider the request in what follows solely in terms of the EIRs.

Regulation 5(1) – Duty to make available environmental information

11. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any Applicant. This obligation relates to information that is held by the authority when it receives a request.
12. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within the scope of the request. Having done so, regulation 5(1) requires the authority to make that information available, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).

Regulation 11(2) of the EIRs – Personal information

13. Regulation 10(3) of the EIRs makes it clear that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
14. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and another specified condition applies. These include where the disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
15. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would contravene the first and second data protection principles in Article 5(1) of the UK GDPR (“lawfulness, fairness and transparency” and “purpose limitation”).

Is the withheld information personal data? 

16. Personal data" are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable individual".  Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
17. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
18. The Applicant stated that he could see no reason that the Authority’s communication to members of the public on this subject would, beyond their name, contain personal data.  He therefore considered that the withheld information could be disclosed in full or in a redacted form.
19. The Authority submitted that the withheld information was personal data because it related to living persons, their homes, properties and private lives, and that those persons were identifiable from the withheld information.  It also commented that the Applicant knew the identities of the third parties.
20. Having considered the Authority's submissions and the withheld information, the Commissioner accepts that the withheld information is personal data as it relates to identified (or identifiable) individuals.  He is therefore satisfied that information is personal data in terms of section 3(2) of the DPA 2018.  Given the nature of the information, he is satisfied that it would not be practicable to anonymise it. 

Would disclosure contravene one of the data protection principles?

21. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.
22. The definition of “processing” is wide and includes (section 3(4)(d) of the DPA 2018) “disclosure by transmission, dissemination or otherwise making available”. In the case of the EIRs, personal data are processed when disclosed in response to a request.  This means that personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair. 

Lawful processing: Article 6(1)(f) of the UK GDPR

23. The Commissioner will first consider if disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
24. The Commissioner considers that, in the circumstances, the only condition in Article 6(1) which could apply is condition (f). 

 Condition (f): legitimate interests

25. Condition (f) states that processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of the personal data.
26. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
27. The tests which must be met before Article 6(1)(f) can be met are as follows:

28. Does the Applicant have a legitimate interest in obtaining the personal data?

29. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

30. Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data? 

31. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
32. The Authority explained that it did not specifically ask the Applicant why he considered he had a legitimate interest in obtaining the withheld personal data. However, it considered it clear he had a legitimate interest in this information as it would assist him in seeking to understand the Authority’s decision-making and actions in relation to the delisting of a section of Overton Road.
33. The Commissioner agrees with the Authority that the Applicant has a legitimate interest in obtaining the withheld personal data. 

Is disclosure of the information necessary for the purposes of these legitimate interests?

34. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of that personal data is necessary to meet that legitimate interest.
35. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests can be met by means which interfere less with the privacy of the data subject.
36. The Authority considered the Applicant’s legitimate interest had already been met by him having had sight of the summary note of representations made which was sent to all frontagers on 18 October 2023.  While the summary note was not sent directly to the Applicant, the Authority said that it was aware that he had had sight of it and explained why it believed this.
37. The Authority explained that disclosure of the withheld personal data into the public domain would not add to the Applicant’s understanding of the matter and was therefore not necessary to achieve his legitimate interests.
38. While he acknowledges the Authority’s position that the Applicant has already received information that meets his legitimate interest, the Commissioner accepts that the Applicant wants to see the actual information that has been communicated to the Authority.  There seems no other way to achieve a complete understanding of this information without full disclosure of the withheld personal data.
39. Having considered all the circumstances, the Commissioner is satisfied that the Applicant has a legitimate interest in the personal data and disclosure of that personal data would be necessary to achieve that legitimate interest.  Consequently, he will go on to consider whether the interest in obtaining the personal data outweighs the rights and fundamental freedom of the data subjects. 

Interests and fundamental freedom of the data subjects

40. The Commissioner must now balance the legitimate interests in disclosure against the data subjects’ interests or fundamental rights and freedoms.  Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed.
41. The Commissioner's guidance[1] on regulation 11 of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subjects and carrying out the balancing exercise.  He makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:

    1. whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances);

    2. the potential harm or distress that may be caused by the disclosure;

    3. whether an individual objected to the disclosure.

42. The Authority submitted that the disclosure of the withheld personal data into the public domain would cause unwarranted prejudice to the rights and freedoms of the data subjects, which override the Applicant’s legitimate interest.   It explained that the withheld personal data related to individuals’ private lives and was directly about them and their activities.  It submitted that disclosure would put detailed information relating to these matters into the public domain.
43. The Authority argued that the individuals had a reasonable expectation of privacy and a reasonable expectation that the withheld personal data would not be disclosed into the public domain, on the basis that they would not expect all of the details contained within the correspondence to be made public.
44. The Authority considered that disclosure of the withheld information, particularly certain specified documents, into the public domain would cause harm and/or distress to the data subjects.  It explained in detail why it believed this to be the case.  The Commissioner is unable to reproduce these reasons, within this Decision Notice, without breaching the obligation of confidentiality in section 45 of FOISA.
45. The Authority also referred the Commissioner to the terms of its privacy notice and the Traffic Regulation Order privacy notice, both of which provide details of the purposes for which data subjects’ personal data will be used.  It considered it clear that personal information will only be processed where it is appropriate and lawful to do so.
46. The Authority stated that it does not routinely publish copies of letters of representations received in connection with statutory processes such as delisting notices, stopping up orders and planning applications, unless it is under a legal obligation do so.
47. The Applicant provided submissions on why he considered the information should be disclosed. He suggested that this matter related to potential bias shown by the Authority in conducting a public consultation and therefore there was a strong public interest in understanding what information was provided both in advance of and during the consultation to all parties.  He also submitted that some of the withheld information would be a response to a public consultation, there was no facility offered for confidentiality of responses to this consultation and anyone providing a response would have done so on the basis that any response could be requested under FOISA or the EIRs.
48. The Commissioner has very carefully considered the arguments from both parties.  He has already accepted that the Applicant has a legitimate interest in obtaining the personal data. However, in all the circumstances of the case, he cannot accept that this legitimate interest outweighs the rights of the data subjects.
49. Having fully considered the competing interests in this particular case, the Commissioner considers that disclosure of the withheld personal data would cause harm and/or distress to the data subjects, and he accepts that they would have had a reasonable expectation that this information would not be placed in the public domain.
50. In all the circumstances, the Commissioner finds that the Applicant’s legitimate interest is outweighed by the prejudice to the interests, rights and freedoms of the data subjects that would result from disclosure.  He therefore finds that condition (f) in Article 6(1) of the UK GDPR cannot be met.
51. In the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must, therefore, conclude that that disclosure of the personal data would be unlawful and would therefore breach the data protection principle in Article 5(1)(a) of the UK GDPR.  Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs.

Decision 

The Commissioner finds that the Authority complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant and was correct to withhold the information requested.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch 

Head of Enforcement 

7 April 2025