Home Decisions

Decision 094/2025

Decision 094/2025: Correspondence regarding installation of external ventilation ducts

Authority: Fife Council
Case Ref: 202301495
 

Summary

The Applicant asked the Authority for correspondence between an employee of the Authority and a named individual/firm of solicitors regarding the installation of external ducts at a specific property between a specified period. The Authority withheld the information on the basis that disclosure would, or would be likely to, substantially prejudice its ability to conduct an inquiry of a criminal or disciplinary nature.  During the investigation, the Authority disclosed most of the information requested but withheld a small amount of information as third party personal data.  The Commissioner investigated and found that the Authority had complied with the EIRs in responding to the request.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”, “the data protection principles”, “data subject”, paragraphs (a) and (c) of the definition of “environmental information”, “personal data” and “the UK GDPR) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 11(2), (3A)(a) and (7) (Personal data); 17(1), (2)(a),(b) and (f) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing). 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14) (a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 2 October 2023, the Applicant made a request for information to the Authority.  He asked for all correspondence between the Authority’s Head of Protective Services and a named individual/firm of solicitors regarding the installation of ventilation ducts at a specified address from 1 January 2021 to the date of his request.
  2. The Authority responded on 19 October 2023 in terms of the EIRs.  It withheld the information requested under the exception in regulation 10(5)(b) of the EIRs.
  3. On the same day, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he did not agree that the information requested should have been withheld.
  4. The Authority notified the Applicant of the outcome of its review on 21 November 2023, which fully upheld its original decision.
  5. On 27 November 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he did not agree that the cited exception applied, and he considered that the public interest favoured disclosure.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 25 January 2024, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments. The Authority was also asked to send the Commissioner the information withheld from the Applicant.  It provided the information, and the case was subsequently allocated to an investigating officer.
  3. During the investigation, the Authority confirmed that the proceedings relating to the matter specified in the request had now concluded and that the exception in regulation 10(5)(b) no longer applied to the information requested.  It disclosed most of the withheld information to the Applicant, but withheld a small amount of information it considered to be third party personal data under regulation 11(2) of the EIRs.
  4. The Applicant confirmed that he was content for the Commissioner’s decision to only consider the information being withheld under regulation 11(2) of the EIRs.  The Commissioner will therefore only consider this information in his decision, and he will not consider further the information the Authority disclosed to the Applicant during the investigation.

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Application of the EIRs

  1. The information requested appears to fall clearly within the scope of the definition of environmental information contained in regulation 2(1) of the EIRs.
  2. The Applicant made no comment on the Authority’s application of the EIRs in this case, and the Commissioner will consider the request in what follows solely in terms of the EIRs.

Regulation 5(1) – Duty to make environmental information available

  1. Regulation 5(1) of the EIRs requires a Scottish public authority which holds the information to make it available when requested to do so by any applicant. This obligation relates to information that is held by the authority when it receives a request.
  2. On receipt of a request for environmental information, the authority must ascertain what information it holds falling within the scope of the request.  Having done so, regulation 5(1) requires the authority to make the information available, unless a qualification in regulation 6 to 12 applies (regulation 5(2)(b)).
  3. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities. In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority.
  4. The Commissioner considers that the searches carried out by the Authority were thorough, used appropriate keywords and encompassed all areas where information of the type covered by the Applicant’s request would have been likely to be held. The Commissioner is satisfied that all relevant information has been identified.

Regulation 11(2) – Personal data

  1. The Authority relied on regulation 11(2) for withholding some information from what it disclosed to the Applicant following his application to the Commissioner.  Here, the Commissioner will consider the information which remained withheld under this provision at the close of the investigation.
  2. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
  3. Regulation 11(2) of the EIRs provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply.  These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
  4. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would breach the first data protection principle in Article 5(1) of the UK GDPR ("lawfulness, fairness and transparency".)

Is the withheld information personal data?

  1. The first question the Commissioner must address is whether the information is personal data in terms of section 3(2) of the DPA 2018.
  2. "Personal data" are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable individual".  Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
  3. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
  4. In this case, the Authority has withheld a small amount of information in eight emails (which comprise a chain of emails regarding the same matter).  The majority of each of these emails have been disclosed to the Applicant.
  5. Having carefully considered the withheld information, the Commissioner is satisfied that it comprises personal data.  He accepts that living individuals can be identified from the data and that, in the circumstances, the data relate to them.  He is therefore satisfied that the withheld information is personal data as defined in section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles?

  1. Article 5(1)(a) of the UK GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."
  2. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available".  For the purposes of the EIRs, personal data are processed when made available in response to a request. This means that the personal data can only be made available if doing so would be both lawful (i.e. it would meet one of the conditions for lawful processing in Article 6(1) of the UK GDPR) and fair.

Lawful processing: Article 6(1)(f) of the UK GDPR

  1. The Commissioner will first consider if disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
  2. The Commissioner considers condition 6(1)(f) in Article 6(1) of the UK GDPR to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

  1. Condition (f) states that the processing will be lawful if it is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
  2. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in performance of their tasks, regulation 11(7) of the EIRs (see Appendix 1) makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
  3. The tests which must be met before Article 6(1)(f) can apply are as follows: 

    1. Does the Applicant have a legitimate interest in obtaining the personal data? 

    2. If so, would making the personal data available be necessary to achieve that legitimate interest? 

    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
  2. The Authority acknowledged that the Applicant may have a legitimate interest in obtaining any information “in matters relating to them”.
  3. The Applicant submitted that he had a legitimate interest in obtaining the withheld personal data as the data is directly pertinent to a prospective Stage 2 complaint against officers of the Authority regarding “alleged conduct aimed at influencing a property owner to comply with flawed planning applications”.
  4. The Applicant explained that the disclosure of the correspondence between the Head of Protective Services and the named individual/firm of solicitors was crucial, as it would shed light on the efforts of the Head of Protective Services to persuade the named individual/firm of solicitors to permit a ventilation system that could severely impact his health.
  5. The Commissioner accepts that, in the circumstances, the Applicant has a legitimate interest in the matters covered by his submissions.

Is disclosure of the personal data necessary to achieve those interests?

  1. Having accepted that the Applicant has a legitimate interest in the withheld personal data, the Commissioner must consider whether disclosure of the personal data is necessary to meet that legitimate interest.
  2. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests can be met by means which interfere less with the privacy of the data subject(s).
  3. In his application, the Applicant explained that he had previously received information from the named individual/firm of solicitors regarding communication with the Head of Protective Services.  However, it is not clear whether the Applicant has received all the information that is being withheld in this case.
  4. The Applicant submitted that disclosure of the withheld information was necessary to meet his legitimate interest.  He explained that the information requested formed a “critical evidentiary basis” for evaluating the extent of the Head of Protective Services’ involvement and for “sustaining claims that procedural irregularities occurred”.  Without access to this information, he argued that his ability to present a comprehensive and credible complaint would be significantly impaired, frustrating the pursuit of accountability and due process.
  5. The Applicant explained that the correspondence discussed a ventilation system, which related to a civil dispute between the tenant of the specified premises and the owner of the wall.  He stated that the Authority should not have involved itself in this matter as it fell outside of its remit and that he had the “right to know” why the Head of Protective Services was so involved in this matter.
  6. As stated above, the withheld information in this case comprises a small amount of information withheld in an email chain – the majority of which has been disclosed to the Applicant.  What has been withheld comprises the name of the private individual who is party to the correspondence, some information comprising the opinion of that private individual and the names of two other data subjects.
  7. The Applicant’s arguments regarding the necessity of the disclosure of the withheld information are focused on the involvement of the Head of Protective Services. The Commissioner does not consider that any of the withheld information would, if disclosed, meaningfully add to that already disclosed by the Authority.
  8. Most of the content of the Head of Protective Services’ responses have already been disclosed.  While a small amount of information has been withheld, this information either repeats the personal data (i.e. opinion) of the private individual who is party to the correspondence or contains the name of that private individual (or, in one instance, the names of two other data subjects).
  9. In the circumstances, the Commissioner considers it is possible for the Applicant to pursue any concerns he has about the Head of Protective Services or their involvement in this matter without disclosure of the withheld personal data.
  10. The Commissioner does not accept that the Applicant’s ability to present a comprehensive and credible complaint would be significantly impaired without disclosure of the withheld personal data.  As stated above, disclosure of the withheld personal data would not meaningfully add to the information the Applicant has already received regarding the Head of Protective Services’ involvement in this matter.
  11. The Commissioner is therefore satisfied that, although the Applicant has a legitimate interest in the matters covered by his submission, disclosure is not necessary to achieve that legitimate interest.
  12. In the absence of a condition in Article 6 of the UK GDPR which would allow the withheld personal data to be disclosed lawfully, disclosure would breach Article 5 of the UK GDPR.  The withheld personal data are, therefore, exempt from disclosure under the exception in regulation 11(2) of the EIRs.

Decision 

The Commissioner finds that the Authority complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch

Head of Enforcement 


25 April 2025