Decision 189/2026:  List of dissertation titles and authors from 1972

Authority: University of Edinburgh    

Case Ref: 202300035

 

Summary

The Applicant asked the Authority for the names of students who submitted dissertations and the titles of these dissertations in a specific graduating cohort from 1972.  The Authority withheld the information on the basis that it was third-party personal data. The Commissioner investigated and found that the Authority was entitled to withhold some, but not all, of the information requested.  He required the Authority to disclose the wrongly withheld information to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 9(1) (Fees); 12 (Excessive cost of compliance); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles, 5(1)(a) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing). 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 6 September 2019, the Applicant made a request for information to the Authority. He asked for “a list of the dissertations completed which would simply be the title and author”.
2. The context of the request clarifies that the list of dissertations sought relates to students graduating from the Authority with a degree in geography in 1972, the year that the Applicant also graduated from the Authority. 
3. On 18 November 2022, following correspondence over the intervening period, the Applicant wrote to the Authority requesting a review of its failure to respond to his request.
4. The Authority notified the Applicant of the outcome of its review on 16 December 2022.  It advised the Applicant that it was withholding the requested information under section 38(1)(b) of FOISA. 
5. On 19 January 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated that he was dissatisfied with the outcome of the Authority’s review because he did not agree that it was entitled to withhold the requested information and was dissatisfied with the Authority’s handling of his request. 

Investigation

6. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
7. On 8 February 2023, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments. The Authority provided comments. 
8. The case was subsequently allocated to an investigating officer.
9. During the investigation, further comments were sought from, and provided by, the Authority.

Commissioner’s analysis and findings

10. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 38(1)(b) – Personal information

11. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A) (a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR. 
12. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA. 
13. To rely on the exemption in section 38(1)(b), the Authority must show that the information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles in Article 5(1) of the UK GDPR. 

Is the withheld information personal data?

14. The first question the Commissioner must address is whether the specific information withheld by the Authority is personal data for the purposes of section 3(2) of the DPA 2018.
15. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.  Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to –
    1. An identifier such as a name, an identification number, location data, or an online identifier, or
    2. One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual. 
16. The two main elements of personal data are that the information must “relate” to a living individual, and that individual must be identified – or identifiable – from the data, or from the data and other accessible information. 
17. Information will “relate to” an individual if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
18. Information remains personal data even if it has been published, although publication may affect the reasonable expectations of privacy of the data subjects.
19. Given that some of the withheld information consists of names, the Commissioner accepts that these are, clearly, personal data. While dissertation titles may not always constitute personal data (especially in connection with large cohorts of graduates), the Commissioner notes that the Applicant asked for a list of dissertation titles and their authors (i.e. he did not ask for two separate lists).  In this context, the Commissioner accepts that the requested information (i.e. a list of dissertation titles and their authors) constitutes personal data in terms of section 3(2) of the DPA 2018. 

Would disclosure contravene one of the data protection principles?

20. The first data protection principle in Article 5(1) of the UK GDPR requires that “personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”. 
21. “Processing” of personal data is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data.  The definition therefore covers disclosing the information into the public domain in response to a FOISA request.
22. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions of Article 6 of the UK GDPR would allow the data to be disclosed.
23. The Commissioner considers that condition (f) in Article 6(1) of the UK GDPR is the only one which could potentially apply in the circumstances of this case.  This was also the position of the Authority in its submissions to the Commissioner. 

Condition (f): legitimate interests

24. Condition (f) states that the processing shall be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
25. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
26. The tests to be satisfied before Article 6(1)(f) can be met are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would disclosure of the personal data be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

27. The Applicant explained that he, as a member of the class in question, had a biographical interest in this information. He further explained that he was interested in the dissertations of certain specific students (implying they had similar academic interests), but he did not expressly state this for all of the dissertations.
28. The Authority accepted that the Applicant had a legitimate interest but did not agree that his legitimate interest justified public disclosure. 
29. The Commissioner’s guidance on section 38 of FOISA is clear that a purely personal interest in personal data can still constitute a legitimate interest.  In the circumstances, the Commissioner accepts that the Applicant has a legitimate interest in the requested information.

Is disclosure of the personal data necessary?

30. The Commissioner must now consider whether disclosure of the personal data would be necessary to meet the Applicant’s legitimate interest. 
31. Here, “necessary” means “reasonably” rather than absolutely or strictly necessary.  The Commissioner must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of individuals.
32. While the Applicant noted that the names of graduates were available from The Scotsman (which routinely published the names of graduates), the precise information requested – names and corresponding dissertation titles – is not otherwise available.
33. The Commissioner is unaware of any less intrusive means by which the Applicant’s legitimate interest can be satisfied.  In all of the circumstances, therefore, he is satisfied that disclosure of the information is necessary for the purposes of the Applicant’s legitimate interest.
34. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the withheld information outweighs the rights and freedoms of the data subjects. 

The data subjects’ interests or fundamental rights and freedoms (and balancing exercise)

35. The Commissioner has concluded that the disclosure of the information would be necessary to achieve the Applicant’s legitimate interest.  However, this must be balanced against the fundamental rights and freedoms of the data subjects.  Only if the legitimate interests of the Applicant outweighed those of the data subjects could the information be disclosed without breaching the first data protection principle.
36. The Commissioner’s guidance on section 38 of FOISA lists certain factors that should be taken into account in balancing the interests of the parties.  He makes it clear that, in line with Recital (47) of the UK GDPR, much will depend on the reasonable expectations of the data subject and that these are some of the factors public authorities should consider:  
    1. Does the information relate to an individual's public life (i.e. their work as a public official or employee) or to their private life (i.e. their home, family, social life or finances)? 
    2. Has the individual objected to the disclosure? 
    3. Would the disclosure cause harm or distress?
37. The Applicant also suggested that these dissertations were made available in the Authority’s library. The Authority could not identify any evidence (other than the Applicant’s memories) that undergraduate dissertations were made available in the Authority’s library.
38. The Commissioner need not make any finding on whether the dissertations were ever available in the Authority’s library.  Disclosure under FOISA is disclosure to the world, not a limited disclosure to individuals with access to the Authority’s library.  He therefore does not consider this purported limited historical disclosure would establish an expectation that this information would be disclosed to the world in response to a request under FOISA.
39. The Applicant commented that The Scotsman had published a list of graduates at the time, putting the information into the public domain.  The Authority confirmed that these lists were published.  However, it argued that some additional information (such as whether the dissertation was retained) would be revealed by the disclosure under FOISA.  Additionally, it noted that some students might have opted out of the lists published by The Scotsman.
40. The Commissioner accepts that it is possible that some of the students would have opted out of the lists published by the Scotsman.  While, given the passage of time, it is conceivable that the attitudes of these students towards the disclosure of the fact they graduated might have changed, the Commissioner agrees that significant weight should be given to the wishes of any students who did object at the time. 
41. The Commissioner finds that, in relation to any students who objected to inclusion in the published list of graduates, where that can be established, the legitimate interests served by disclosure of any information held would be outweighed by the unwarranted prejudice that would result to the rights and freedoms and legitimate interests of any data subjects. If such objection cannot be established, the Commissioner does not consider the likelihood of the option having been available (in the privacy context of 1972 rather than the present) to be sufficiently high that its absence should weigh against disclosure.
42. In the circumstances, the Commissioner does not consider that the remaining students have any significant expectation of privacy regarding the information (their names and the fact they graduated) that was published in The Scotsman, copies of which appear to be available through the British Newspaper Archive.
43. While the main bodies of a dissertation may contain substantive information on a student’s abilities and opinions, the actual title of the dissertation will generally shed little light on this and show little more than the student’s research interests at the time they were studying with the Authority. 
44. The Commissioner accepts that there may be some sensitivity regarding the research interests of recent graduates, particularly those working in contentious fields.  However, he does not agree that there remains a substantial privacy interest in the dissertation titles selected by graduates half a century ago (bearing in mind that their expectations of privacy at the time, in relation to this information, well before there was any general legal protection of privacy in the United Kingdom, are unlikely to have been high – and, are unlikely, in all the circumstances, to have changed substantially in the interim). 
45. The Authority expressed concern that the Applicant may use the requested information, if disclosed, to contact people and seek their consent to read their dissertations.  Although the Applicant has not expressly confirmed or denied this is his intention, the Commissioner accepts that this is a reasonable interpretation of his intentions.
46. The Commissioner does not consider such contact to be inherently improper: class reunions, biographical research and similar activities are broadly accepted.  In any event, were the Applicant to contact them, the data subjects would be entitled to withhold their consent or decline to engage with the Applicant.  It is also questionable whether the requested information would do anything material to facilitate contact, given the passage of time.
47. In all the circumstances, the Commissioner finds that the legitimate interests served by disclosure of the personal data (other than that specified in paragraph 41) would outweigh any unwarranted prejudice that would result to the rights and freedoms and legitimate interests of the data subjects.
48. The Commissioner therefore finds that condition (f) in Article 6(1) of the UK GDPR can be met in relation to the withheld personal data (except insofar as the data relate to individuals who objected to inclusion in the list of graduates).

Fairness

49. The Commissioner must also consider whether disclosure of the withheld information (other than that relating to individuals who objected to inclusion in the list of graduates) would be fair.
50. The Commissioner finds, for the same reasons as he finds that condition (f) in Article 6(1) of the UK GDPR can be met, that disclosure of the withheld information (other than that relating to individuals who objected to inclusion in the list of graduates) would be fair.

Conclusion on the data protection principles

51. For the reasons set out above, the Commissioner is satisfied that the disclosure of the withheld information (other than that relating to individuals who objected to inclusion in the list of graduates) would not breach the data protection principles in Article 5(1)(a) of the UK GDPR.
52. Consequently, the Commissioner is satisfied that, while the personal data of individuals who objected to inclusion in the list of graduates are exempt from disclosure under section 38(1)(b) of FOISA, the personal data of the remaining individuals have been wrongly withheld under this exemption.
53. During the investigation, the Authority indicated that, had it not considered the requested information to be exempt, it “would have charged a fee, or possibly refused the request as excessive, due to the time it would take to compile the requested list of students and titles”.
54. As the Commissioner found in Decision 122/2026, a Fees Notice must be issued within the time permitted by section 10 of FOISA.  Consequently, the Authority would not be able to issue a Fees Notice at this stage. 
55. The Commissioner notes that the Authority did not specifically seek to rely upon section 12 of FOISA, which permits public authorities to refuse to comply with requests if it would exceed the upper cost limit under FOISA (£600) to do so.  In any event, the Authority’s general comment that it would “possibly” have refused the request as excessive and the other remarks on the difficulties of accessing historic records are not sufficiently detailed for the Commissioner to have found section 12 of FOISA would apply, had the Authority sought to rely on it and had he been required to reach a finding on it.
56. The Commissioner therefore requires the Authority to disclose the information he has found it was not entitled to withhold under the exemption in section 38(1)(b) of FOISA.
57. If the Authority seeks not to provide some of the withheld information on the basis that the individual concerned objected to inclusion in the list of graduates, the Commissioner will expect the Authority to provide him with evidence of this.

Handling

58. The Applicant expressed dissatisfaction with the Authority’s handling of his request and awareness of FOI law.
59. The Authority explained that it had treated the Applicant’s correspondence as an ongoing series of inquiries, not requests under FOISA.  It confirmed that it had given advice to both the Applicant and the staff involved to ensure requests are handled properly going forward.
60. The Commissioner recognises that, given the form of the correspondence and conversational tone, treating this as a “business as usual” request was an understandable approach.  However, as the Applicant’s request was strictly (if narrowly) valid under FOISA, it should have been appropriately handled as such within the timescales set out in FOISA.
61. The Commissioner welcomes the Authority’s advice to its staff on improving practice in this regard.  He would also encourage the Applicant to have regard to the guidance in his Tips for Requesters in any future requests he wishes to make.

Decision 

The Commissioner finds that the Authority partially failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

The Commissioner finds that, by correctly withholding the personal data relating to any individuals who objected to inclusion in the list of graduates, the Authority complied with Part 1 of FOISA.

However, by wrongly withholding the personal data relating to individuals who did not object to inclusion in the list of graduates, the Commissioner finds that the Authority failed to comply with Part 1 of FOISA (in particular, section 1(1)).

The Commissioner therefore requires the Authority to disclose the wrongly withheld information, by 10 September 2025.  

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement  

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement 

27 July 2026

1. ^

   https://www.foi.scot/sites/default/files/2025-04/FOISA_Exemption_Guidance_Section_38_Personal_Information_v04_CURRENT_ISSUE_Access_Checked.pdf

2. ^

   https://www.foi.scot/sites/default/files/2026-06/Decision122-2026.pdf

3. ^

   https://www.foi.scot/sites/default/files/2022-03/Tips_for_Requesters.pdf