Home Decisions

Decision 157/2026

Decision 157/2026:  Canopy at specified residential address


Authority: South Lanarkshire Council
Case Ref: 202300002
 

Summary

The Applicant asked the Authority for information relating to a canopy at a specified residential address.  The Authority refused to make the information available as it considered it to be third-party personal data.  The Commissioner investigated and found that, while the Authority had been correct to withhold some of the information requested, it had wrongly withheld other information.  He required the Authority to disclose the information it had wrongly withheld to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 39(2) (Health, safety and environment); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant”, “the Commissioner” and “environmental information”) (Interpretation); 5(1) and 2(b) (Duty to make environmental information available on request); 11(2), (3A)(a) and (7) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to the processing of personal data) and 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data).

Background

  1. On 1 November 2022, the Applicant made a request for information to the Authority.  In relation to a specified address, he asked for:
    1. All papers relating to the application for a canopy including copies of any building warrant or planning consent.
    2. The Miscellaneous Permissions Request Form (MPRF) application for the project
    3. The photograph taken of the canopy by an inspector during his visit on 25 August 2022. 
  2. The Authority responded on 22 November 2022.  It withheld the information requested under the exemption in section 38(1)(b) of FOISA, on the basis that it was third-party personal data which should not be disclosed. However, it provided the Applicant with other information relating to the canopy at the specified residential address.  This included that the Authority had confirmed that a Building Warrant was required for the canopy, that the tenant had agreed to submit one and that it was satisfied that the tenant had genuinely believed a Building Warrant had not been required.
  3. On 23 November 2022, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he did not agree that the Authority was entitled to withhold all of the information requested under the exemption in section 38(1)(b) of FOISA.  He commented that the names of individuals who objected to their identities being disclosed could easily be redacted. 
  4. The Authority notified the Applicant of the outcome of its review on 22 December 2022.  It confirmed that it should have considered the request under the EIRs and substituted its refusal under the exemption in section 38(1)(b) of FOISA for a refusal under the exception in regulation 11 of the EIRs, on the basis that it maintained the withheld information constituted third-party personal data which should not be disclosed. 
  5. On 23 December 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he did not agree with its refusal to provide the information he had requested.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 11 January 2023, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments. The Authority was also asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and its comments on the application. 
  3. The case was subsequently allocated to an investigating officer.

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 
  2. As stated in previous decisions, in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8, at paragraph [18], the Court of Session recognised that:

"… in giving reasons for his decision, [the Commissioner] is necessarily restrained by 
the need to avoid, deliberately or accidentally, disclosing information which ought not 
to be disclosed."

  1. In this decision notice, the Commissioner has endeavoured to give as full account of his reasoning as he can, but, by necessity, in this case the comments of the Court of Session are applicable to some aspects

Application of the EIRs

  1. Where information falls within the scope of regulation 2(1) of the EIRs, a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.
  2. Having considered the terms of the request and the nature of the information requested, the Commissioner accepts the decision of the Authority to deal with the request under the EIRs rather than under FOISA. 

Regulation 5(1) of the EIRs – Duty to make environmental information available

  1. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.  This obligation relates to information that is held by the authority when it receives a request.
  2. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within scope of the request.  Having done so, regulation 5(1) of the EIRs requires the authority to make that information available, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).
  3. Under the EIRs, a public authority may refuse to make environmental information available if one of the exceptions in regulation 10 apply and, in all the circumstances of the case, the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.                                 

Regulation 11(2) – Personal data

  1. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
  2. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply.  These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
  3. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would breach the first and second data principles in Article 5(1) of the UK GDPR (“lawfulness, fairness and transparency” and “purpose limitation”).                                                           

Is the withheld information personal data?

  1. The first question the Commissioner must address is whether the information is personal data.
  2. Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.
  3. Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
  4. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
  5. The Authority submitted that all of the information falling within the scope of the Applicant’s request was the personal data of the tenant of the specified residential address.  It explained that the information related directly to the tenant’s home, revealed their personal details, details of the work to be carried out and timescales as well as the fact that they were a tenant of the Authority. 
  6. The Authority considered that the tenant would undoubtedly be identifiable from the information and that they would not expect this information to be made available to the public at large (the result of a disclosure under the EIRs) in response to a request for information.  It explained that it was not just the personal identifiers which were personal data but the entire application and internal correspondence which related to the tenant and their home/private life. 
  7. The Commissioner has carefully considered the withheld information.  Having done so, he accepts that some of the information comprises personal data.  In particular:
  • Names, contact details, job titles and other direct identifiers of living individuals
  • The photograph requested
  • A small amount of information directly relating to the tenant.
  1. The Commissioner is satisfied that living individuals can be identified from these data and that, in the circumstances, the data relate to them.  He is therefore satisfied that this information is personal data as defined in section 3(2) of the DPA 2018
  2. The Commissioner understands why the Authority considered that, because the request named the tenant of the residential address and the residential address itself, all of information requested must be the personal data of the tenant. However, the Commissioner is not satisfied that all of the withheld information is personal data as defined in section 3(2) of the DPA 2018. 
  3. In reaching this conclusion, the Commissioner has taken account of the information already provided to the Applicant by the Authority in its initial response (as described in paragraph 2 above).  In that context, the Commissioner does not accept that all of the withheld information concerning those same matters can properly be viewed as the personal data of the tenant. 
  4. The Commissioner must be careful not to reveal the specific content of the withheld information.  However, where the withheld information simply records or demonstrates the Authority’s understanding of, or the steps taken as part of, the permission requirements for the installation of the canopy, the Commissioner does not accept – particularly in view of the information already provided to the Applicant – that it adds anything of biographical significance about the tenant or otherwise has them as its main focus.
  5. In all of the circumstances, the Commissioner therefore finds that the Authority was not entitled to withhold this information under the exception in regulation 11(2) of the EIRs. 
  6. In the absence of another exception being applied by the Authority to withhold this information, the Commissioner requires the Authority to disclose it to the Applicant.  He will specify to the Authority the information to be disclosed to the Applicant.
  7. The Commissioner will go on to consider whether disclosure of the information he has accepted is personal data would contravene one of the data protection principles.

Would disclosure contravene one of the data protection principles?

  1. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.  The Authority considered that disclosure of such information would contravene Article 5(1) of the UK GDPR.
  2. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of the EIRs, personal data are processed when disclosed in response to a request.  Personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.

Lawful processing: Article 6(1)(f) of the UK GDPR

  1. The Commissioner must now consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the data to be disclosed.
  2. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

  1. Condition (f) states that processing shall be lawful if it “…is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”
  2. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests made under the EIRs.
  3. The tests which must be met before Article 6(1)(f) can apply are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would making the personal data available be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects? 

Does the Applicant have a legitimate interest in obtaining the information?

  1. There is no definition within the DPA 2018 of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
  2. The Authority considered that the Applicant may have a legitimate interest in obtaining the information falling within the scope of the request as he may be concerned about potential safety issues. 
  3. As stated above, the Commissioner has found that only some of the withheld information is personal data as defined in section 3(2) of the DPA 2018.  The nature of this information is described in paragraph 26 above.
  4. The Commissioner accepts that the Applicant has a legitimate interest in obtaining the substantive information he asked for in his information request given the concerns he expressed about the “dangerous and potentially deadly structure erected” at the tenant’s address, which the Authority had “admitted was erected without a Building Warrant when one was required”.
  5. However, by and large, the information the Commissioner has found to be personal data is not substantive and would not, were it to be disclosed, add to the Applicant’s understanding of the installation of the canopy or discussions surrounding its installation. 
  6. In the circumstances, the Commissioner does not accept that the Applicant has a legitimate interest in the withheld names, contact details, job titles and other direct identifiers of living individuals and the small amount of information directly relating to the tenant. (For the avoidance of doubt, disclosure of the small amount of information directly relating to the tenant would also not add to the Applicant’s understanding of the installation of the canopy or discussions surrounding its installation.)
  7. The Commissioner therefore accepts that the Authority was entitled to withhold, under the exception in regulation 11(2) of the EIRS, the third-party personal data described in the preceding paragraph.
  8. However, given the Applicant’s safety concerns, the Commissioner accepts that the Applicant has a legitimate interest in obtaining the withheld photograph. 

Is disclosure necessary to achieve those legitimate interests?

  1. Having accepted that the Applicant has a legitimate interest in the withheld photograph, the Commissioner must consider whether disclosure of this personal data is necessary to meet that legitimate interest.
  2. "Necessary" means "reasonable" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities must consider whether disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subjects.
  3. The Applicant explained that disclosure of the withheld photograph (as taken by the Authority’s inspector) would prove to the Scottish Public Services Ombudsman (SPSO) that the “so called inspection of the canopy was a farce”. 
  4. As stated above, the Commissioner is only considering whether disclosure of the withheld photograph would be necessary to achieve the Applicant’s legitimate interest. 
  5. Given that the Applicant appears to wish to receive the withheld photograph in order to support a complaint to the SPSO, the Commissioner is not persuaded that disclosure would be necessary to achieve that interest.  This is because, for the purposes of its investigations, the SPSO has the same powers as the Court of Session in respect of the production of documents.  This means that the Applicant can pursue his concerns without the need for the photograph to be disclosed to the world-at large, which would interfere less with the privacy of the data subject.
  6. As the Commissioner is not satisfied that disclosure of the withheld photograph is necessary to satisfy the Applicant’s legitimate interest, he is not required to go on to consider whether the legitimate interests of the Applicant outweigh the interests or fundamental rights and freedoms of the data subject.
  7. Having found that disclosure of the withheld photograph would not be necessary to fulfil the Applicant’s legitimate interests, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met in this case and that disclosure of the information in question would be unlawful.
  8. Given that the Commissioner has concluded that the processing of the personal data, would be unlawful, he is not required to go on to consider whether disclosure of such personal data would otherwise be fair and transparent in relation to the data subject.
  9. In all the circumstances, the Commissioner is satisfied, in the absence of a condition in Article 6 of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful.  The personal data is therefore excepted from disclosure under regulation 11(2) of the EIRs.

Decision 

The Commissioner finds that the Authority partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant. 

The Commissioner finds that the Authority correctly withheld some information under the exception in regulation 11(2) of the EIRs.  

However, the Commissioner also finds that the Authority wrongly withheld other information under regulation 11(2) of the EIRs. 

The Commissioner therefore requires the Authority to provide the Applicant with the information wrongly withheld under the exception in regulation 11(2) of the EIRs, by 3 August 2026.  He will write to the Authority to specify the information to be disclosed.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

 

Euan McCulloch 

Head of Enforcement 


18 June 2026

  1. ^