Decision 188/2026:  Information relating to a property in Gourock

Authority: Inverclyde Council 
Case Ref: 202201179
 

Summary

The Applicant asked the Authority for information relating to a named property in Gourock made up of three residences.  The Authority disclosed the information requested, subject to some redactions to information it considered was third-party personal data.  The Commissioner investigated and found that the Authority had identified all of the information requested and correctly withheld some of the information on the basis that it was third-party personal data. However, he found that the Authority wrongly withheld other information on the basis that it was third-party personal data and that it was not entitled to extend the timescale for responding to the Applicant’s request.  He required the Authority to disclose the wrongly withheld information to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 39(2) (Health, safety and environment); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant”, “the Commissioner” and “environmental information”) (Interpretation); 5(1), 5(2)(a) (Duty to make environmental information available on request); 7(1) and (3)(b) (Extension of time); 10(3) (Exceptions from duty to make environmental information available); 11(2) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data); 6(1) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 1 August 2022, the Applicant made a request for information to the Authority.  He asked for information relating to a named property in Gourock made up of three residences, including official documents, records, correspondence, recorded drafts, emails, notes, recordings of telephone conversations, CCTV recordings in paper or electronic copies.
2. The Authority wrote to the Applicant on 26 August 2022 to ask for an extension under the EIRs to the response date (30 August 2022) for the request (due by 30 August 2022).  It advised that it expected to respond to the request by 5 September 2022. 
3. The Authority responded on 5 September 2022.  It disclosed the information requested subject to some redactions.  However, it did not explain on what basis it had made these redactions. 
4. On 7 September 2022, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he had not received all of the data he had requested. In particular, he raised concerns around the delay in the Authority’s response, whether had identified all the information falling within the scope of the request and the redactions it had applied to withhold some of the information requested.
5. The Authority notified the Applicant of the outcome of its review on 5 October 2022, in the following terms:  

• Regarding the concern about the delay in its initial response, it stated that the EIRs permitted public authorities to extend the time limit for responding to information requests.  It considered that it was entitled to extend the time limit under the EIRS for responding to the request in this case.
• Regarding the concern about the redactions it had applied to withhold some of the information requested, it acknowledged that it had not explained why it had made these redactions.  It apologised for this and confirmed that regulation 11(2) of the EIRs applied to the withheld information.

6. On 21 October 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he did not agree that the initial response should have been delayed and he considered that the Authority had breached the EIRs by not providing him with all of the information requested. 

Investigation

7. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
8. On 5 December 2022, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments. 
9. The Authority was also asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information.
10. The case was subsequently allocated to an investigating officer.
11. During the investigation, further submissions were sought from and provided by the Authority. 

Commissioner’s analysis and findings

12. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Application of the EIRs

13. Where information falls within the scope of regulation 2(1) of the EIRs, a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.
14. Having considered the terms of the request and the nature of the information requested, the Commissioner accepts the decision of the Authority to deal with the request under the EIRs rather than under FOISA.  He notes that the Applicant has not disputed the Authority’s decision to handle their request under the EIRs.

Section 39(2) – Environmental information

15. The exemption in section 39(2) of FOISA provides, in effect, that environmental information (as defined in regulation 2(1) of the EIRs) is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs.
16. In this case, the Commissioner accepts that the Authority was entitled to apply this exemption to any information falling within the scope of the request under FOISA, given his conclusion that it is properly classified as environmental information.
17. As there is statutory right to access environmental information available to the Applicant in this case, the Commissioner accepts, in all the circumstances, that the public interest in maintaining this exemption (and responding to the request under the EIRs) outweighs any public interest in responding to the request under FOISA.  Both regimes are intended to promote access to information and there would appear to be no reason why (in this particular case) disclosure of the information, were it to be held, should be more likely under FOISA than the EIRs.
18. The Commissioner therefore concludes that the Authority was correct to apply section 39(2) of FOISA and consider the Applicant’s information request under the EIRs.  He will consider this case, in what follows, solely in terms of the EIRs. 

Regulation 7(1) of the EIRs – Extension of time 

19. Regulation 7(1) of the EIRs says the period of 20 working days to respond to a request for environmental information as set out under the EIRs may be extended by another 20 working days if the “volume and complexity of the information requested makes it impracticable for the authority” to comply with the request.

The Applicant’s submissions

20. The Applicant stated that he was unhappy that his request was delayed beyond the statutory time limit and until after a decision had been made on a separate statutory process (related to the same property). 

The Authority’s submissions

21. The Authority stated that the EIRs allow public authorities to extend the 20 working day time limit for responding to an information request if the request if complex and voluminous.  It noted that it had advised the Applicant on 26 August 2022 that it would extend the time limit for responding to the request until 5 September 2022 due to the volume of information being collated to respond to it.  It explained that it was satisfied that it was entitled to extend the time limit under the EIRs for responding to the request.
22. The Authority noted that the Applicant appeared to be of the view that the reason for the delay in responding to the request was related to the timing of the other decision referred to in paragraph 20 above.  It emphasised that these matters were dealt with under two separate statutory regimes and the fact that the other decision was made during the time that the request was being dealt with was “purely coincidental”. 

The Commissioner’s view

23. The Commissioner has considered all the submissions in relation to the extended timescale together with the nature of the information requested and provided.
24. The Commissioner notes that the provision in regulation 7(1) of the EIRs, states:

“The period of 20 working days referred to … may be extended by a Scottish public authority by a further period of up to 20 working days if the volume and complexity of the information requested makes it impracticable for the authority either to comply with the request within the earlier period or to make a decision to refuse to do so”.

25. The Commissioner would highlight that regulation 7(1) of the EIRs can only be applied if the “volume AND complexity” of the information requested makes it impracticable.  Therefore, in order for an authority to rely on this provision it must demonstrate that not only was the information request complex, but the volume of information captured by the request was extensive.
26. Having considered the volume of information that was subsequently provided to the Applicant in response to his request and the level and nature of the redactions applied, the Commissioner does not consider the amount of information captured by the request to be voluminous, nor does he accept that it was complex in nature.  He cannot agree with the Authority’s position that the work involved would be so much that extra time beyond the 20 working days laid out in the EIRs would be necessary.  In the Commissioner’s view the information could have been reviewed and provided within this timeframe.
27. In the circumstances, the Commissioner does not consider that either the volume or the nature of the information that was requested justified extending the time frame for responding.  He therefore finds that the Authority did not comply with regulation 7(1) of the EIRS, and that it was not entitled to extend the response time.
28. In any case, a Scottish public authority needs to comply with regulation 7(3)(b) if it is to apply the provision correctly.  This means the notification given to the applicant when it seeks to extend the time for responding must give the authority’s reasons for considering the information to be voluminous and complex.  The Authority failed to do this in this case, so (even if the Commissioner had accepted that the information was voluminous and complex) its application of regulation 7(1) would have fallen on that basis.

Regulation 5(1) of the EIRs – Duty to make environmental information available

29. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.  This obligation relates to information that is held by the authority when it receives a request.
30. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within scope of the request. Having done so, regulation 5(1) requires the authority to make that information available, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).
31. Under the EIRs, a public authority may refuse to make environmental information available if one of the exceptions in regulation 10 apply and, in all the circumstances of the case, the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.

Whether the Authority holds further information falling within the scope of the request

32. The standard of proof to determine whether a Scottish public authority holds the information is the civil standard of the balance of probabilities.  In determining where the balance lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority.
33. The Commissioner also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information.  While it may be relevant as part of this exercise to explore expectations as to what information the authority should hold, ultimately the Commissioner's role is to determine what relevant information is actually held by the public authority (or was held, at the time it received the request).

The Applicant’s submissions

34. The Applicant did not consider that the Authority had provided him with all of the information that it held falling within the scope of his request, in particular copies of correspondence with parties involved in the property dispute. 

The Authority’s submissions

35. The Authority explained that it identified that the information requested would be held in the Authority’s “Uniform” system, where all correspondence in respect of property standard matters was stored. It confirmed that the email inboxes of each of the Public Protection Officers involved in the property matter were searched.
36. The Authority also explained that all statutory notices were held on an “Investigations” drive within the Public Protection Service.  It confirmed that this drive was also searched for information relevant to the request.
37. The Authority noted that the Applicant alleged that he had not received copies of correspondence from the other parties involved in the property dispute.  However, it explained that the Director in charge of the Public Protection Service had been copied in on all email communication from the property owners to the Public Protection Service and it confirmed that all of this information (subject to redactions under the exception in regulation 11(2) of the EIRs) had been disclosed to the Applicant.
38. While it acknowledged that the Applicant believed it held further information that it had failed to identify and disclose to him, the Authority confirmed that its position remained that it had identified and disclosed (subject to redactions under the exception in regulation 11(2) of the EIRs) all of the information it held falling within the scope of the request.
39. The Authority noted that the Scottish Ministers’ Code of Practice on the Discharge of Functions by Scottish Public Authorities under FOISA and the EIRs (the Section 60 Code) states (at paragraph 6.2.2) that:

“Searches should be proportionate and focus on systems (whether paper based or electronic) where staff with a working knowledge of the records relating to the information request consider that information might be held.”

40. The Authority therefore considered that it had followed good practice in having the officers in the Public Protection Service, who had working knowledge of the property dispute and held all of the information requested, carry out reasonable and proportionate searches in response to the request.

The Commissioner’s view

41. The Commissioner has considered the submissions from both the Applicant and the Authority as well as the information that was identified as being within the scope of the request. 
42. Having considered all relevant submissions and the nature of the information requested, the Commissioner accepts that the Authority took adequate and proportionate steps in the circumstances to establish what information it held falling within the scope of the request. 
43. The Commissioner considers that the Authority’s searches were reasonable in terms of who it asked to carry out the searches and the locations searched; he finds that they would be capable of locating the information requested.  In the circumstances, the Commissioner is therefore satisfied, on balance, the Authority identified and located all the relevant information it held.
44. However, the Commissioner notes that the Authority did not maintain a record of the searches carried out.  His above conclusion is therefore based on the Authority’s description of the searches carried out, the nature of the information requested and the extent of the information the Authority identified and disclosed to the Applicant in response to his request. 
45. While, in this case, he is prepared to accept the Authority’s description of searches as sufficient, the Commissioner must stress that the Section 60 Code states (at paragraph 6.2.6) that:

“Authorities should, wherever possible, maintain a record of searches conducted, including details of who carried out the searches and the systems that were checked.  Records of searches provide helpful evidence to reviewers and, in the event of an appeal, to the Commissioner.  It is also best practice for authorities to keep on record the rationale for key decisions made in relation to the handling of the request, along with any discussions they have with requesters and where relevant, third parties.”

46. While the Applicant may have believed and expected further information to be held by the Authority, the Commissioner is satisfied, on balance, this was not the case.  Whether a public authority should hold information which it does not hold is not a matter for the Commissioner to decide.
47. In all the circumstances, therefore, the Commissioner is satisfied, on the balance of probabilities, that the Authority identified and located all the information it held that fell within the scope of the request.  He therefore finds that, in this respect, the Authority complied with regulation 5(1) of the EIRs in responding to the request.

Regulation 11(2) – Personal data

48. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
49. Regulation 11(2) of the EIRs provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply.  These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
50. The Applicant commented that the Authority in its initial response had failed to explain the redactions in the information it provided to him but that it had acknowledged and apologised for this at review.  He did not provide any further comments to the Commissioner on his concerns about the Authority’s reliance on the exception in regulation 11(2) of the EIRs, although he was asked to. 

Is the withheld information personal data?

51. “Personal data” are defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable individual”. Section 3(3) of the DPA 2018 defines “identifiable living individuals” as a living individual who can be identified, directly or indirectly, in particular with reference to –
    1. An identifier such as a name, an identification number, location data, or an online identifier, or
    2. One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
52. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals. 
53. The Authority explained that the only information that it continued to withhold from the Applicant was third-party personal data and that it had already disclosed all “substantive” information to him.  It confirmed that the withheld third-party personal data comprised names, email addresses, phone numbers and signatures.
54. The Commissioner has considered the withheld information.  He is satisfied that most of it is the personal data of identifiable individuals and, as such, is personal data in terms of section 3(2) of the DPA 2018. 
55. However, the Commissioner is not satisfied that all of the withheld information is personal data in terms of section 3(2) of the DPA 2018.  This is because he does not consider that disclosure of that information would lead to a realistic casual chain of identifiable of living individuals.  Specifically, he does not consider the generic personal or organisational email address suffixes (e.g. “…@exampledomain.com”) withheld by the Authority are personal data.  However, he accepts some of the email address suffixes withheld by the Authority are specific and are personal data in terms of section 3(2) of the DPA 2018 as there is a reasonable prospect that they would, if disclosed, identify living individuals.
56. The Commissioner’s guidance on regulation 11(2) of the EIRs (at paragraph 89) states that:

“… it’s important to keep redactions to the minimum necessary to remove the risk of identification. This is particularly relevant where valuable context would be lost otherwise – consider, for example, whether the full email address needs to be redacted or just that part with the employee’s name (the rest is still likely to help the requester understand where the communications in question originated and were sent to).”

57. The Commissioner must therefore find that the Authority was not entitled to withhold the specific information identified at paragraph 53.  In the absence of another exception being applied to withhold that information, the Commissioner requires the Authority to disclose it to the Applicant.
58. The Commissioner also notes that the Authority acknowledged that it had withheld some names of senior officers in error and that this information should not have been withheld.   He therefore also requires the Authority to disclose this information to the Applicant.
59. For the remaining information that he is satisfied is personal data, the Commissioner considers this further below.

Would disclosure contravene one of the data protection principles?

60. The Authority considered that disclosing the withheld personal data would breach the first data protection principle.  Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.
61. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of the EIRs, personal data are processed when disclosed in response to a request.  Personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.
62. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available".  In the case of the EIRs, personal data are processed when disclosed in response to a request.  This means that personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.

Lawful processing: Article 6(1)(f) of the UK GDPR

63. The Commissioner will first consider if disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
64. The Commissioner considers that, in the circumstances, the only condition in Article 6(1) which could apply is condition (f) of Article 6(1) of the UK GDPR.

Condition (f): legitimate interests

65. Condition (f) states that processing will be lawful if it "…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of the personal data…"
66. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
67. The tests which must be met before Article 6(1)(f) can be met are as follows:

• Does the Applicant have a legitimate interest in obtaining the personal data?
• If so, would making the personal data available be necessary to achieve that legitimate interest?
• Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

68. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
69. Neither the Applicant nor the Authority has provided any submissions to the Commissioner on the Applicant’s legitimate interest in obtaining the personal data. 
70. The Commissioner has considered the withheld information.  While he recognises that the underlying subject matter of the request very much concerns the Applicant, the Commissioner is not satisfied - given the nature of the remaining withheld third-party personal data and in the absence of any submissions from the Applicant to persuade him otherwise – that the Applicant has a legitimate interest in obtaining the remaining withheld third-party personal data.
71. As the Commissioner has concluded that the Applicant does not have a legitimate interest in receiving the remaining personal data redacted in this case, he finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied.  Accordingly, he accepts that making the personal data available would be unlawful.
72. Given that the Commissioner has found that the processing (i.e. making the information available, in response to the Applicant's request) would be unlawful, he is not required to go on to consider separately whether disclosure of the remaining personal data would be necessary to fulfil any legitimate interest or consider the data subjects’ interests or fundamental rights and freedoms and balance them against any legitimate interest in disclosure.
73. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the GDPR being met, the Commissioner must conclude that making the remaining withheld personal data available would be unlawful and would breach the data protection principle in Article 5(1)(a) of the GDPR.  Consequently, he is satisfied that disclosure of the remaining withheld personal data is not permitted by regulation 11(2) of the EIRs.

Handling of the request 

74. The Applicant raised a conflict of interest concern on the basis that the staff who had been involved in searching for and responding to his request and requirement for review were the same staff who had been involved in dealing with the other matter referred to at paragraph 20 above. 
75. The Commissioner has considered this concern carefully.  He recognises that, in some circumstances, the involvement of officers connected with the subject matter of a request may give rise to a perception of a conflict of interest.  However, he does not accept that such involvement is, of itself, evidence that searches were inadequate.  On the contrary, in many cases, those with direct working knowledge of the relevant business area will be best placed to identify and locate the information requested.
76. This is consistent with paragraph 6.2.2 of the Section 60 Code, which states that: 

“Searches should be proportionate and focus on systems (whether paper based or electronic) where staff with a working knowledge of the records relating to the information request consider that information might be held”.

77. The Commissioner has also taken account of the Section 60 Code guidance on the review process.  Paragraph 10.3.3 states that review procedures should be fair and impartial and should allow authorities to take a fresh look at their response.  Paragraph 10.3.4 provides that, where possible or practicable, the reviewer should be someone who did not respond to, or advise on, the original request.
78. In this case, the Authority informed the Applicant in its review outcome that the reviewer had not been involved in the initial response to his request and that they had considered it independently of any other officers employed by the Authority.
79. The Commissioner considers that this appears to follow the approach set out in paragraphs 10.3.3 and 10.3.4 of the Section 60 Code.  In the circumstances, he is therefore not persuaded that the Applicant’s concern, of itself, demonstrates a failure in the Authority’s handling of the request.

Decision 

The Commissioner finds that the Authority partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant. 

The Commissioner finds that, by identifying and providing the information falling within the scope of the Applicant’s request and withholding some information under the exception in regulation 11(2), the Authority complied with the EIRs.

However, by wrongly withholding other information under the exception in regulation 11(2) and by wrongly applying regulation 7(1) to extend the deadline for responding to the request, the Authority failed to comply with the EIRs. 

The Commissioner therefore requires the Authority to provide the Applicant with the wrongly withheld information (including that the Authority acknowledged it had withheld in error), by 11 September 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement 

28 July 2026

1. ^

   https://www.gov.scot/binaries/content/documents/govscot/publications/advice-and-guidance/2026/03/foi-eir-section-60-code-practice/documents/foi-eir-section-60-code-practice/foi-eir-section-60-code-practice/govscot%3Adocument/foi-eir-section-60-code-practice.pdf

2. ^

   https://www.foi.scot/sites/default/files/2023-08/EIRsGuidanceRegulation11Personaldata.pdf