Decision 106/2025: Building warrant application relating to a named property

Authority: South Lanarkshire Council
Case Ref: 202301625
 

Summary

The Applicant asked the Authority for a copy of a specified building warrant for a structure at a named address.  The Authority provided the Applicant with a copy, withholding some information as third party personal data.  The Commissioner investigated and found that the Authority was entitled to withhold the information. 

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”) (Interpretation); 5(1) and 2(b) (Duty to make environmental information available on request); 9 (Duty to provide advice and assistance); 11(2) (Personal data); 17(1), (2)(a) and (b) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing); 9(1), (2) (processing of special categories of personal data).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data). 

Background

1. On 27 August 2023, the Applicant made a request for information to the Authority.  He asked for a copy of the building warrant application referred to in a document from the Authority for the structure in the back garden at a named address.
2. On 14 September 2023 the Applicant wrote again as he had not received an acknowledgement of his request from the Authority.
3. The Authority did not provide a response.
4. On 31 October 2023, the Applicant wrote to the Authority, requesting a review as it had not provided him with a response to his request.
5. The Authority notified the Applicant of the outcome of its review on 28 November 2023.  It acknowledged that it had not responded to the Applicant’s information request and provided a response in terms of the EIRs, giving the Applicant a copy of the building warrant with some information it considered to be third party personal data withheld under regulation 11(2) of the EIRs.  
6. On 20 December 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he did not agree that the information withheld from him was personal data.   In particular, he wished to be provided with the information withheld in box 5 (proposed use) and box 16 (estimated value of the work).

Investigation

7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
8. On 30 January 2024, the Authority was notified in writing that the Applicant had made a valid application.  Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was asked to send the Commissioner the withheld information and to provide its comments on the application.  Following receipt of these, the case was allocated to an investigating officer.
9. Further submissions were sought and received from the Authority during the investigation, in relation to why it considered certain of the withheld information to constitute special category personal information.
10. The Applicant was also given the opportunity to provide the Commissioner with his comments, which he did.

Commissioner’s analysis and findings

11. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Handling in terms of the EIRs

12. The Authority considered and responded to the Applicant’s requirement for review in accordance with the EIRs, having concluded that the information requested was environmental information as defined in regulation 2(1) of the EIRs.
13. Where information falls within the scope of this definition, a person has a right to access the information under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.
14. The Commissioner is satisfied that the information covered by the request is environmental information, as defined in regulation 2(1) of the EIRs (see in particular paragraphs (a),  (c) and (f) of the definition in regulation 2(1) of the EIRs[1]).  The Applicant has not disputed the Authority’s decision to handle his request under the EIRs.

Regulation 5(1) – Duty to make environmental information available

15. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.  This obligation relates to information that is held by the authority when it receives a request.
16. On receipt of a request for environmental information, the authority must ascertain what information it holds falling within the scope of the request.  Having done so, regulation 5(1) requires the authority to make the information available to the requester, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).

 Regulation 11(2) – Personal data

17. The Authority is withholding the information in boxes 5 and 16 of the Application for a Building Warrant in line with regulation 11(2) of the EIRs.
18. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
19. Regulation 11(2) provides that personal data must not be made available where the applicant is not the data subject and other specified conditions apply.  These include that disclosure would contravene any of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018 (regulation 11(3A)(a)).
20. The Authority submitted that the withheld information constituted third party personal data, and special category person data, disclosure of which, in response to this request, would breach the first data protection principle in Article 5(1) of the UK GDPR (“lawfulness, fairness and transparency”).

Is the withheld information personal data? 

21. The first question the Commissioner must address is whether the information is personal data.
22. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.
23. Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
24. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
25. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
26. The Commissioner must also consider whether some of the withheld information is special category data as defined in Article 9(1) of the UK GDPR[2].  This includes data that concerns the health of an individual.
27. The information being withheld is that entered into two specific boxes (box 5 - proposed use and box 16 - estimated value of the works) contained within a particular building warrant application.  The Authority has provided the Applicant with the rest of the information entered into this form, except for a telephone number, email address and signature (which the Applicant has not challenged).
28. The Authority considered the withheld information in boxes 5 and 16 to be third party personal data, and in one instance, special category personal data. In his submission, the Applicant did not agree that the withheld information was third party personal data.
29. The Applicant did not see how the proposed use and the estimated cost could be personal to the person making the building warrant application.
30. The form disclosed to the Applicant contains the name and address of the person making the building warrant application.  In this regard all of the other information on the form, including that in boxes 5 and 16, can easily be related to that named individual.   
31. The Commissioner understands the Applicant’s confusion as to how the type of information that might be contained in each of these boxes (5 and 16) on the form, in and of itself, could be personal information.  However, the information cannot be considered in isolation but must be considered in the context of the other information on the form that has been provided in response to the request.
32. Having considered this as well as the submissions from both the Applicant and the Authority, the Commissioner accepts that the withheld information is personal data in terms of section 3(2) of the DPA 2018 as it relates to an identified (or identifiable) living individual.  The Commissioner also accepts, given the nature of the entry, that the information in box 5 would fall within the definition of special category personal data as defined in Article 9(1) of the UK GDPR. 

Special category personal data 

33. Having considered the information in question, the Commissioner accepts that some of the withheld information (that contained in box 5, in this particular case) would be special category data for the purposes of Article 9(1) of the UK GDPR.  
34. The Commissioner’s guidance[3] on regulation 11 of the EIRs notes (paragraphs 71 to 73) that Article 9 of the UK GDPR only allows special category personal data to be processed in very limited circumstances.
35. Although Schedule 1 to the DPA 2018 contains a wide range of conditions which allow authorities to process special category data for the purposes of FOI, the only situation where it is likely to be lawful to disclose third party special category data in response to an information request is where the condition in Article 9(2)(e), where the data subject has made the personal data manifestly public, applies.
36. The Applicant has not suggested that the personal data have manifestly been made public by the data subject(s).
37. The Authority has considered all of the conditions in Article 9(2) including 9(2)(e) and does not believe any of these conditions would be met by the processing of this personal data in response to the Applicant’s request.
38. Having considered the terms of the condition in Article 9(2)(e), the Commissioner is satisfied that the information has not been made public as a result of steps deliberately taken by the data subject and therefore this condition of processing could not be met in this case.  The Commissioner notes that although information in relation to building warrant applications does become publicly available on the Authority’s planning portal (which gives access to the Building Standards Register), information of the nature contained in box 5 would not be made public in such a way.
39. Consequently, the Commissioner finds that in the absence of a condition in Article 9(2) of the UK GDPR allowing the special category personal data to be processed, disclosure of the information in box 5 would be unlawful.
40. Given that the Commissioner has determined that the processing of the special category personal data would be unlawful, he is not required to go on to consider whether any such disclosure would otherwise be fair or transparent in relation to the data subject. 

Non-special category personal data – will disclosure contravene one of the data protection principles?

41. The Authority considered disclosure of the information in box 16 would breach the data protection principle in Article 5(1)(a) of the UK GDPR, in that disclosure would not be lawful, fair or transparent. 

Would disclosure contravene one or more of the data protection principles?

42. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.
43. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of the EIRs, personal data are processed when disclosed in response to a request.  Personal data can only be disclosed if disclosure would be both lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
44. The Authority noted that the data subject would have the legitimate expectation that only the required information would be published online, and personal data of the type redacted in this case would be excluded.  Furthermore, applicants submitting a building warrant application are advised by the Authority’s Privacy Notice that their personal data will only be processed where it is lawful to do so.
45. The Commissioner must now consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the data to be disclosed.
46. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

47. Condition (f) states that processing shall be lawful if it “…is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”
48. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests made under the EIRs.

49. The tests which must be met before Article 6(1)(f) can apply are as follows:

    (i)       Does the Applicant have a legitimate interest in obtaining the personal data?

    (ii)      If so, would making the personal data available be necessary to achieve that legitimate interest?

    (iii)     Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects? 

Does the Applicant have a legitimate interest in obtaining the information?

50. There is no definition within the DPA 2018 of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive. The Commissioner's guidance on regulation 11 states: 

    "In some cases, the legitimate interest might be personal to the applicant, e.g. he or she might want the information in order to bring legal proceedings.  For most requests, however, there are likely to be wider legitimate interests, such as the scrutiny of the actions of public bodies or public safety."

51. The Authority stated that although the Applicant had not shared any personal interest in obtaining this third party personal data, there was a public interest in ensuring that the Authority was accountable for decisions and actions/inactions in relation to its regulatory functions.  Consequently, it considered that the Applicant did have a legitimate interest in the requested information.
52. The Applicant stated that he wished the information in order to share it with another regulator and was concerned that the building warrant application was fraudulent and that information was being covered up.
53. The Commissioner is satisfied that the Applicant has a legitimate interest in the third party personal data, for the reasons acknowledged by the Authority and shared by the Applicant.

Is disclosure necessary to achieve the legitimate interest?

54. The Commissioner will now consider whether disclosure of the third party personal data requested is necessary for the Applicant’s identified legitimate interest.  In doing so, he must consider whether these interests might reasonably be met by any alternative means.
55. The Commissioner has considered this carefully in light of the decision of the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[4].
56. Here, “necessary” means “reasonably” rather than “absolutely” or “strictly” necessary.  The Commissioner must, therefore, consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the data subject.
57. The Authority considered that disclosure of the information was necessary to achieve the Applicant’s legitimate interest.
58. It did explain to the Commissioner, in its submissions, that the estimated value of the works is not necessarily the actual value of the work but rather something that is used to determine any application fee.
59. It stated that fees for building warrants, and amendments to building warrant applications are set by the Building (Fees) (Scotland) Regulations 2004 and the fees relate to the “value of the work”.
60. The Authority submitted that “value of work” is in relation to the fee payable and should actually state a band (i.e. under or over set amounts).
61. It added that in this case, the building warrant applicant had entered a figure for the costs but that if, and when, the information from the building warrant was placed in the public domain (i.e. on the planning portal) it would only be the band of values the work would fall into that would be available.
62. As mentioned above, the Applicant believed that he required the information from box 16 (the total cost of the project) in order to provide it to another regulator to enable them to determine if the building warrant application was genuine or misleading to the point of being fraudulent.
63. The Commissioner has considered the submissions from both the Applicant and the Authority, together with the fact that the Authority has accepted that provision of the information is necessary for the Applicant to achieve his legitimate interest. 
64. The Commissioner appreciates that the Applicant considers provision of the information in box 16 would be necessary to enable him to furnish this to the other regulator to assist with their investigation of the matter.  However, the Commissioner is of the view that should this other regulator require access to this specific information or, for that matter, any other information relating to this building warrant application, they would be able to request this directly from the Authority.
65. As noted above, in its submissions, the Authority informed the Commissioner as to the nature of the information that would be expected to be contained within box 16 and the fact that this would not record the actual value of the work required, but instead an amount within a band (with this information being used to assess the fee that the applicant submitting the building warrant would require to pay to the Authority for the warrant to be processed).
66. The Commissioner is of the view that had the Authority shared this explanation (regarding actual value versus banding in respect of the payment of a fee) with the Applicant, in line with its duty to provide advice and assistance, this might have aided the Applicant’s understanding of the process and might have fulfilled his legitimate interest.
67. Because the regulator to whom the Applicant wishes to provide the information in box 16 would be able to request this, if necessary, from the Authority directly, the Commissioner does not consider it necessary for this information to be disclosed to the Applicant to fulfil his legitimate interest.
68. As the Commissioner has concluded that it is not necessary for the personal data in box 16 to be made available in order to fulfil the Applicant’s legitimate interest, he finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied (and so making the information available would be unlawful).
69. Given that the Commissioner has concluded that the processing of personal data in box 16 would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject.
70. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that disclosure of the personal data would breach the data protection principle in Article 5(1)(a) of the UK GDPR.  Consequently, he is satisfied that the personal data is excepted from being made available under regulation 11(2) of the EIRs. 

Decision 

The Commissioner finds that the Authority partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.

The Commissioner finds that the Authority correctly withheld personal data under regulation 11(2) of the EIRs.  

However, he also finds that the Authority failed to comply with its duty to provide advice and assistance to the Applicant, in line with regulation 9, by not providing the Applicant with the explanation given to the Commissioner around the nature of the information in box 16.   

Given that this explanation is detailed in the Decision Notice, the Commissioner does not require the Authority to take any action in respect of this failure. 

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch 

Head of Enforcement 

30 April 2025