Decision176/2026:  Donor List – Centre for Energy Ethics 

 
Authority: The University of St Andrews
Case Ref: 202501421
 

Summary

The Applicant asked the Authority for a list of sources of non-governmental funding for the Authority’s Centre for Energy Ethics.  The Authority withheld the information on the grounds that it was third party personal data and confidential.  The Commissioner investigated and found that the Authority was entitled to withhold the information. 
 

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 39(2) (Health, safety and environment); 47(1) and (2) (Application for decision by Commissioner)

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”) (Interpretation); 5(1) (Duty to make environmental information available on request); 10(3) (Exceptions from duty to make environmental information available); 11(2) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions)

United Kingdom General Data Protection Regulation (the UK GDPR) articles 5(1)(a) and (b) (Principles relating to processing of personal data); 6(1)(f) (Lawfulness of processing) 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of data)  

Background

1. On 28 June 2025, the Applicant made a request for information to the Authority.  He asked for all information held by the Authority from 2020 onwards which showed the full list of sources of non-governmental funding for the Centre for Energy Ethics (the Centre). 
2. The Authority responded on 28 July 2025.  It disclosed some information and referred the Applicant to the Donor Roll for financial years 2020/21 to 2022/23, which was published on its website.  The Authority stated that it was withholding the name of anonymous donors and the amount they donated under sections 38(1)(b) and 36(2) of FOISA. 
3. On 28 July 2025, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that he was dissatisfied with its decision because he disagreed with the Authority’s reliance on sections 38(1)(b) and 36(2) of FOISA. 
4. The Authority notified the Applicant of the outcome of its review on 19 August 2025. It informed the Applicant that it was relying on the exemption in section 39(2) of FOISA, as it now considered his request to be seeking environmental information.  In its review the Authority disclosed additional information to the Applicant and informed him that it was withholding the remaining information under regulations 10(5)(d) and 11 of the EIRs.
5. On 21 August 2025 the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated he was dissatisfied with the outcome of the Authority’s review because he did not agree that the exceptions applied, and he believed it would be in the public interest for the information to be disclosed.

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
7. On 10 October 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was subsequently allocated to an investigating officer.
8. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment 
   on this application and answer specific questions.

Commissioner’s analysis and findings

6. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Handling in terms of the EIRs

7. In its review outcome, the Authority processed the request under the EIRs, having concluded that the information was environmental information as defined in regulation 2(1) of the EIRs.
8. Where information falls within the scope of regulation 2(1) of the EIRs, a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs. 
9. The Applicant requested information about donations made to the Authority’s Centre for Energy Ethics (the Centre).  
   
   The Commissioner has considered the subject matter of the request, together with the information falling within the scope of the request, along with paragraphs (a) and (c) of the definition of environmental information set out in regulation 2(1) of the EIRs, and he agrees with the Authority in categorising the information as environmental. 
10. The Applicant has not disputed the Authority’s decision to handle his request under the EIRs.

Section 39(2) of FOISA – Environmental information

11. The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined by regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs.
12. The Commissioner finds that the Authority was entitled to apply the exemption in section 39(2) of FOISA to the request, given his conclusion that the information requested was properly classified as environmental information
13. As there is a separate statutory right of access to environmental information available to the Applicant, the Commissioner also accepts that, in this case, the public interest in maintaining this exemption and in handling the request in line with the requirements of the EIRs would outweigh any public interest in disclosing the information under FOISA.

Regulation 5(1) – Duty to make available environmental information 

14. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.  This obligation relates to information that is held by the authority when it receives a request. 
15. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within the scope of the request.  Having done so, regulation 5(1) requires the authority to make that information available, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).

Regulation 11(2) of the EIRs – Personal Information 

16. Regulation 10(3) of the EIRs makes it clear that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
17. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and another specified condition applies. These include where the disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a))
18. In this case, the Authority confirmed that it was withholding the information under regulation 11(2) of the EIRs.  The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would contravene the first data protection principle in Article 5(1) of the UK GDPR (“lawfulness, fairness and transparency” and “purpose limitation”).

Is the withheld information personal data?

19. Personal data" are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable individual".  
    Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to – 
    1. an identifier such as a name, an identification number, location data, or an online identifier, or 
    2. one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
20. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
21. The information being withheld under the exception in regulation 11(2) of the EIRs comprises the names of individuals who made donations to the Authority’s Centre for Energy Ethics, along with the amounts donated.
22. The Authority submitted that the withheld information was personal data because it related to living persons, their private lives and financial interests, and that those persons were identifiable from the withheld information.  
23. Having considered the Authority's submissions and the withheld information, the Commissioner accepts that the withheld information is personal data as it relates to identified (or identifiable) individuals.  He is therefore satisfied that information is personal data in terms of section 3(2) of the DPA 2018.  Given the nature of the information, he is satisfied that it would not be practicable to anonymise it. 

Would disclosure breach one of the data protection principles?

24. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would contravene the first data protection principle in Article 5(1) of the UK GDPR.
25. The first data protection principle requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject" (Article 5(1)(a) of the UK GDPR).
26. The definition of “processing” is wide and includes (section 3(4)(d) of the DPA 2018) “disclosure by transmission, dissemination or otherwise making available”. In the case of the EIRs, personal data are processed when disclosed in response to a request.  This means that personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair. 

Lawful processing: Article 6(1)(f) of the UK GDPR 

27. The Commissioner will first consider if disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
28. The Commissioner considers that, in the circumstances, the only condition in Article 6(1) which could apply is condition (f). 

Condition (f): legitimate interests

29. Condition (f) states that processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of the personal data.
30. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
31. The tests which must be met before Article 6(1)(f) can be met are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

32. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
33. The Applicant stated in his request for review that his legitimate interests included the fact that he was a graduate of the University and he worked in environmental policy.  He further commented that if former senior members of Shell or Exxon were funding the Centre, stakeholders had a right to know. 
34. The Authority accepted that the Applicant had a legitimate interest in obtaining the personal data, given the reasons provided in his requirement for review (his status as a graduate and his role in environmental policy).  The Commissioner agrees with the Authority’s position.

Is disclosure of the personal data necessary to achieve those interests?

35. Having accepted that the Applicant has a legitimate interest in the personal data, the Commissioner must consider whether disclosure of that personal data is necessary to meet that legitimate interest.
36. ‘Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and balanced as to the aims to be achieved, or whether the Applicant's legitimate interests can be met by means which interfere less with the privacy of the data subject.
37. The Authority did not accept that disclosure of the personal data was necessary to achieve the Applicant’s legitimate interest.   It stated that the academic freedom and integrity of the output of the Centre could be tested and verified in other ways, without disclosing the identities of those who had donated to the Centre.  The Authority maintained that the Applicant’s legitimate interests could be achieved by means which interfered less with the privacy of the data subjects. 
    In particular, the Authority noted that the published output of academic staff from the Centre was available, and it noted that it had a suite of policies and procedures in place to defend against the possibility of interference arising. 
38. In his submissions, the Applicant commented that the funding of work cannot be separated from its output, suggesting that even if a donor does not try to influence how their money is spent, managers will be aware of the source of the funding and were likely to take it into account, which could corrupt the Centre’s outputs. The Applicant also commented that he had seen a number of pieces published by the Centre which “write around” climate change as if it was simply not happening.  He submitted that if the Centre was heavily funded by people or organisations associated with oil and gas, it would raise questions for policymakers.
39. Taking the submissions of both parties into account, the Commissioner is satisfied, on balance, that disclosure of the information is necessary to meet the legitimate interests of the Applicant.  In the Commissioner’s view, disclosure of the identity of the donors and the amounts they have donated is necessary to meet the Applicant’s legitimate interests.

Interests and fundamental freedom of the data subjects

40. The Commissioner must now balance the legitimate interests in disclosure against the data subjects’ interests or fundamental rights and freedoms.  Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed.
41. The Commissioner's guidance on regulation 11 of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subjects and carrying out the balancing exercise.  He makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
    1. whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances);
    2. the potential harm or distress that may be caused by the disclosure;
    3. whether an individual objected to the disclosure.
42. The Authority submitted that disclosure of the withheld personal data into the public domain would cause unwarranted prejudice to the rights and freedoms of the data subjects, which overrode the Applicant’s legitimate interests.  The Authority referred to Commissioner’s Decision 112/2016, specifically paragraphs 40 through 44.  In this decision, the Commissioner had considered whether the identity of donors to the Royal Academy of Music and Drama, and the amounts they donated should be disclosed.  He found, based on the submissions and evidence provided by the authority in that case, that the individual donors had a reasonable expectation that their donation would remain anonymous.  He also concluded that the applicant’s legitimate interest in transparency was outweighed by the prejudice to the rights and freedoms of the data subjects that would result from disclosure. 
43. The Authority contended that even if the processing was necessary to meet the Applicant’s legitimate interests in this case, disclosure, would nevertheless, be unwarranted, by reason of prejudice to the rights and freedoms of the data subjects.
44. In wider submissions, the Authority argued that the donors (in this case) had a reasonable expectation that the withheld personal data would not be disclosed into the public domain.  It referred to one specific donor and commented that the donation was private and personal in nature, in that it concerned the donor’s personal finances and their free choice to donate their monies to the Authority, for a specific purpose.  It noted that there was an established convention for philanthropic giving to be undertaken anonymously, if that was the wish of the individual, adding that many people seek to do good by giving, while seeking nothing in return.
45. The Authority explained that it only published details of financial giving when it had the donor’s consent, and it noted that this consent was limited to the naming of an individual in the published “Donor Roll” alongside their cumulative giving of the period.  The Authority stated that they make clear to donors that details of funded projects or exact amounts donated do not form part of the publicly accessible Donor Roll. 
46. To support its position, the Authority provided the Commissioner with a copy of its Gift Acceptance Policy, along with its Privacy Notice for Development activities.
47. The Commissioner has very carefully considered the arguments from both parties.  He has already accepted that the Applicant has a legitimate interest in obtaining the personal data. However, in all the circumstances of the case, he cannot accept that this legitimate interest outweighs the rights of the data subjects.
48. Having fully considered the competing interests in this particular case, the Commissioner considers that disclosure of the withheld personal data would cause harm and/or distress to the data subjects, and he accepts that they would have had a reasonable expectation that this information would not be placed in the public domain.  In reaching this conclusion, he has borne in mind that the request (insofar as relating to personal data) cannot be fulfilled simply by disclosing the identities of individuals (if any) whose interests or connections actually engage the Applicant’s concerns (and, for that matter, that a degree of value judgement would inevitably arise in determining whether these concerns were engaged or not in any given case).  For those individuals with no evident connection with these concerns (and, potentially, for others, whose actual views cannot be identified readily, whatever their backgrounds), it is all the more difficult to see why their reasonable expectations of anonymity should be disturbed.
49. In all the circumstances, the Commissioner finds that the Applicant’s legitimate interest is outweighed by the prejudice to the interests, rights and freedoms of the data subjects that would result from disclosure.  He therefore finds that condition (f) in Article 6(1) of the UK GDPR cannot be met.
50. In the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must, therefore, conclude that that disclosure of the personal data would be unlawful and would therefore breach the data protection principle in Article 5(1)(a) of the UK GDPR.  Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs.
51. Having reached this conclusion, the Commissioner is not required to go on to consider whether the exception in regulation 10(5)(d) of the EIRs applies to the information he has found to be excepted under regulation 11(2).  

Decision 

The Commissioner finds that the Authority complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Euan McCulloch 

Head of Enforcement 

1 July 2026

1. ^

   https://www.foi.scot/sites/default/files/2023-08/EIRsGuidanceRegulation11Personaldata.pdf

2. ^

   https://www.st-andrews.ac.uk/policy/external-relations-fundraising-fundraising-campaigns/gift-acceptance-policy.pdf

3. ^

   https://www.st-andrews.ac.uk/policy/information-governance-and-management-data-protection-privacy-information/university-privacy-notice-development.pdf