Home Decisions

Decision 199/2026

Decision 199/2026:  Braes Shopping Centre – receipts and payment rules

Authority: Glasgow City Council
Case Ref: 202501667
 

Summary

The Applicant asked the Authority for the invoices/receipts resulting in the payout of £463,360 from the £3.35 million allocated for the Braes Shopping Centre, along with the policy setting out payment rules.  The Authority provided some information and withheld other information under various exceptions in the EIRs.  The Commissioner investigated and found that the Authority was entitled to withhold some information, but it had wrongly withheld other information.  He required the Authority to disclose the wrongly withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant”, “the Commissioner” and “environmental information”) (Interpretation); 5(1) (Duty to make environmental information available on request); 10(3) and (5)(e) (Exceptions from duty to make environmental information available); 11(2) (Personal information); 17(1), (2)(a),(b) and (f) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) and (b) (Principles relating to processing of personal data) and 6(1)(f) (Lawfulness of processing). 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 28 March 2025, the Applicant made a request for information to the Authority.  She asked for: 
    1. “Can you confirm if the funding of £3.35 million was awarded from the “Place Fund”, which is a Scottish Government fund for local authorities? If it is not this fund, can you advise which one it is? 
    2. What kind of documentary proof does [the Authority] require to make payments under this funding stream? 
    3. If there is a policy setting out the payment rules, I request a copy or be directed to where it appears online. 
    4. How many invoices/receipts merited payout of £463,360? 
    5. I request copies of the individual invoices and receipts which resulted in the payout of £463,360.”
  2. The Authority responded to the information request on 28 April 2025, in the following terms:
  • For part (i), it confirmed that the funding came from the Place Fund
  • For part (ii), it explained what documentary proof it required to make payments under this funding stream
  • For part (iii), it advised that the general principles were published on the Scottish Government’s website and that Committee reports available on the Authority’s website also contained relevant information
  • For part (iv), it stated that 4 claims were made by the Applicant to the Authority and that the Applicant provided copied of 64 receipted invoices
  • For part (v), it withheld the information requested under the exception in regulation 10(5)(e) of the EIRs.
  1. On 12 June 2025, the Applicant wrote to the Authority requiring a review of its decision.  She stated that she was dissatisfied with the decision for the following reasons:
  • For part (iii), she did not agree that the documents the Authority linked her to contained the specific information she requested. 
  • For part (v), she considered the public interest favoured disclosure of the withheld information.
  1. The Authority notified the Applicant of the outcome of its review on 28 August 2025, which partially upheld its original decision:
  • It disclosed (subject to some redactions under regulation 11(2) of the EIRs) copies of grant claims, which it acknowledged it should have provided earlier
  • It informed the Applicant that a Grant Agreement was in place, which managed the relationship between the Authority and the successful applicant for the undertaking of public infrastructure works
  • It continued to withhold the information requested in part (v) of the request under the exception in regulation 10(5)(e) of the EIRs and indicated that the exception in regulation 10(5)(f) of the EIRs also applied.
  1. The Authority’s failure to comply with the Applicant’s requirement for review within the timescale laid down by the EIRs was considered in Decision 223/2025.
  2. On 18 September 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that she was dissatisfied with the outcome of the Authority’s review because she considered the public interest favoured disclosure of the withheld information. 

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 7 October 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was subsequently allocated to an investigating officer. 
  3. During the investigation, the Authority confirmed that it did not wish to rely upon the exception in regulation 10(5)(c) of the EIRs and the Applicant informed the Commissioner that she was not seeking bank details.  The Authority confirmed to the Commissioner that the exception in regulation 10(5)(f) of the EIRs was only being applied to bank details. The Commissioner will therefore not consider the exceptions in regulations 10(5)(c) and 10(5)(f) further in his decision notice.
  4. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to the exceptions relied upon by the Authority. 

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Application of the EIRs 

  1. Having considered the withheld material and the terms of the request, the Commissioner accepts the decision of the Authority to deal with the request under the EIRs rather than under FOISA. 
  2. The Commissioner is satisfied that the information covered by the request is environmental information, as defined in regulation 2(1) of the EIRs.  He would also note that he can see no detriment to the Applicant by considering their request under the EIRs rather than FOISA, nor has the Applicant disputed the Authority’s decision to handle their request under the EIRs.

Scope of the decision

  1. The Commissioner notes that some of the withheld information provided to him by the Authority in relation to part (iii) of the request does not, strictly, relate to payment rules. 
  2. As this information does not fall within the scope of part (iii) of the request, or any other part of the request, the Commissioner will not consider this information further in his decision notice.

Regulation 11(2) – Personal information

  1. The Authority withheld names and contact details of individuals named in these documents under regulation 11(2) of the EIRs.
  2. Regulation 10(3) of the EIRs makes it clear that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11. 
  3. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply.  These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).

Is the withheld information personal data? 

  1. "Personal data" are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable individual".  
  2. Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
  3. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
  4. The Applicant suggested that the information withheld under regulation 11(2) of the EIRs would not be personal data because it would consist of the business names of contractors.
  5. Having considered the withheld information, the Commissioner notes that it goes beyond simply providing the trading names of companies and that it consists of names, signatures and contact details of individuals. He accepts that the withheld information is personal data as it relates to identified individuals.  He is therefore satisfied that the information is personal data in terms of section 3(2) of the DPA 2018.

Would disclosure contravene one of the data protection principles?

  1. Article 5(1)(a) of the UK GDPR requires personal data to be processed "lawfully, fairly and in a transparent manner in relation to the data subject."
  2. The definition of "processing" is wide and includes (section 3(4)(d) of the DPA 2018) "disclosure by transmission, dissemination or otherwise making available".  For the purposes of the EIRs, personal data are processed when made available in response to a request.
  3. This means that the personal data can only be made available if doing so would be both lawful (i.e. it would meet one of the conditions for lawful processing in Article 6(1) of the UK GDPR) and fair.

Lawful processing: Article 6(1)(f) of the UK GDPR

  1. The Commissioner will first consider if disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data to be disclosed.
  2. The Commissioner considers condition (f) in Article 6(1) of the UK GDPR to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

  1. Condition (f) states that the processing will be lawful if it is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
  2. Although Article 6 of the UK GDPR states that this condition cannot apply to processing carried out by a public authority in performance of its tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs.
  3. The tests which must be met before Article 6(1)(f) can apply are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would making the personal data available be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. The Applicant considered that revealing the names of contractors and the work undertaken was necessary to enable accountability and scrutiny for the work completed at the time of the request. 
  2. The Applicant submitted that there was a “legitimate interest” in the information being disclosed because the information was about funding allocated by the Authority from the Place Based Fund, which was designed to enable “collaborative working to ensure that local investment is relevant to local communities and for the benefit of local people”.  She commented that the local community felt excluded through a lack of information and visible activity in progressing a supermarket.
  3. While the Authority commented that it could accept that the Applicant might be pursuing a legitimate interest in trying to ascertain information regarding the spend of the grant funds, it was not satisfied that she had a legitimate interest in the withheld personal data.
  4. The Commissioner notes that none of the information withheld under the exception in regulation 11(2) of the EIRs directly relates to progress on construction.  However, he considers that it does – to a limited extent – provide insight into what work was carried out by what organisations. 
  5. The Commissioner therefore accepts that the Applicant has a legitimate interest in some of the withheld information. 
  6. However, the Commissioner does not accept that the Applicant has a legitimate interest in the withheld signatures or contact details. He is therefore satisfied that the Authority was entitled to withhold that information under the exemption in section 38(1)(b) of FOISA

Is disclosure of the personal data necessary to achieve those interests? 

  1. Having accepted that the Applicant has a legitimate interest in some of the withheld personal data, the Commissioner must consider whether disclosure of the personal data is necessary to meet that legitimate interest. 
  2. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the data subjects.
  3. As rehearsed above, the Commissioner considers that disclosure of the withheld personal data in question would only provide the Applicant with limited additional insight.  However, insofar as it would assist in understanding the other information provided, the Commissioner can identify no less restrictive means to provide this additional insight. 
  4. The Commissioner therefore accepts that disclosure of the withheld personal data in question would be necessary in order to satisfy the Applicant’s legitimate interests.

Balancing the legitimate interests of the Applicant and the legitimate interests or fundamental rights and freedoms of the data subjects

  1. The Commissioner has acknowledged that disclosure of the information in question would be necessary to achieve the Applicant’s legitimate interests.  This must be balanced against the interests or fundamental rights and freedoms of the third parties.  Only if the legitimate interests of the Applicant outweigh those of the data subjects could personal data be disclosed without breaching the first data protection principle. 
  2. The Commissioner's guidance on regulation 11 of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subjects and carrying out the balancing exercise.  He makes it clear that, in line with Recital (47) of the UK GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider: 
    1. whether the information relates to an individual’s public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances) 
    2. the potential harm or distress that may be caused by the disclosure
    3. whether an individual objected to the disclosure
  3. The Authority explained that the withheld personal data contained within the invoices related to officers under Grade 9 who were the named recipient of the invoices. It considered that the names of officers under Grade 9 enjoyed a presumption that their personal data would not be disclosed – an expectation that was supported by provisions within the Authority’s staff privacy statement.
  4. The Authority also noted that the withheld personal data contained within the invoices related to third party individuals. It considered that that external individuals should be similarly protected because an individual working for a contractor of the Authority would not expect their name to be entered into the public domain because they had submitted an invoice to the Authority.
  5. The Commissioner accepts that some of the named individuals appear to be junior.   He recognises that individuals occupying junior roles would not have had any reasonable expectation that their personal data would be made public in response to a request under the EIRs.
  6. However, the Commissioner notes that others named individuals occupy senior roles (including at least one Chief Executive) or are spokespersons of their respective organisations.  He considers that these individuals, as public representatives of their organisations, would reasonably expect to be identified in connection with their work for these companies.   In view of their seniority and/or public profile, he does not consider that disclosure of their personal data would be likely to cause these data subjects any particular distress or harm.
  7. After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights and freedoms of the data subjects, the Commissioner finds that the legitimate interests served by disclosure of the names of individuals occupying junior roles are outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of individuals who hold these junior roles. Condition (f) in Article 6(1) of the UK GDPR cannot, therefore, be met in relation to the names of these data subjects.
  8. In the absence of a condition in Article 6 of the UK GDPR allowing personal data to be disclosed, the Commissioner has concluded that disclosing the names of individuals who hold junior roles would be unlawful.
  9. However, in relation to individuals occupying senior roles or who are spokespersons of their respective organisations, the Commissioner finds that the legitimate interests served by disclosure of the withheld personal data are not outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the individuals holding these roles. These individual either have public profiles or a level of seniority whereby their expectations of disclosure of their personal data are significantly greater than those occupying more junior roles.  It is the Commissioner’s view that condition (f) in Article 6(1) of the UK GDPR can, therefore, be met in relation to the names of the individuals occupying senior roles or who are spokespersons of their respective organisations.

Fairness

  1. As the Commissioner has determined that the processing of the personal data of the individuals occupying senior roles or who are spokespersons of their respective organisations would be lawful, and bearing in mind his reasoning in reaching that conclusion, he can identify no reason for finding that the disclosure of the names of these individuals would be other than fair.
  2. In relation to the personal data of those occupying junior roles as the Commissioner has concluded that the processing of this personal data would be unlawful, he is not required to go on to consider separately whether disclosure of their names would otherwise be fair and transparent.

Conclusion on the data protection principles

  1. For the reasons set out above, the Commissioner is satisfied that the disclosure of the names of those occupying junior roles would breach the data protection principles in Article 5(1)(a) of the UK GDPR, but disclosure of the names of individuals with senior or public facing roles would not constitute such a breach.
  2. Consequently, he is satisfied that, while the personal data of junior staff are exempt from disclosure under the exception in regulation 11(2) of the EIRs, the personal data of the individuals with senior or public facing roles has been wrongly withheld under this exception.
  3. The Commissioner requires the Authority to provide the Applicant with the names of the individuals holding senior or public facing roles that have been wrongly withheld under the exception in regulation 11(2) of the EIRs.  He will write to the Authority to specify the information to be disclosed.

Regulation 10(5)(e) – Confidentiality of commercial or industrial information

  1. The Authority withheld the grant agreement and invoices under regulation 10(5)(e) of the EIRs. However, during the investigation, the Authority indicated that it only considered the commercially sensitive information to consist of “estimates, costs, and any figures contained within the agreement”. 
  2. Regulation 10(5)(e) of the EIRs provides that a Scottish public authority may refuse to make environmental information available to the extent that its disclosure would, or would be likely to, prejudice substantially the confidentiality of commercial or industrial information where such confidentiality is provided for by law to protect a legitimate economic interest.
  3. However, regulation 10(6) of the EIRs states that a Scottish public authority is not entitled to refuse to make information available under a number of exceptions (including that in regulation 10(5)(e)) to the extent that it relates to information on emissions.
  4. The Applicant argued that, as demolitions involve emissions, this information may relate to emissions.
  5. While demolitions do lead to emissions of both noise and particulate matter, the Commissioner does not agree that any of the withheld information directly relates to the actual process of demolition or the emissions thereof, to the extent that regulation 10(6) of the EIRs is engaged.
  6. As with all exceptions under regulation 10 of the EIRs, a Scottish public authority applying the exception in regulation 10(5)(e) must interpret it in a restrictive way and apply a presumption in favour of disclosure (regulation 10(2)).  Even where the exception applies, the information must be disclosed unless, in all the circumstances, the public interest in making the information available is outweighed by that in maintaining the exception (regulation 10(1)(b)).
  7. The Aarhus Convention: an Implementation Guide, which offers guidance on the interpretation of convention from which the EIRs are derived, notes (at page 88) that the first test for considering this exception is whether national law protects the confidentiality of the withheld information.  The law must explicitly protect that type of information as commercial or industrial secrets.  Secondly, the confidentiality must protect a “legitimate economic interest”.
  8. Having taken this guidance into consideration, the Commissioner’s view is that, before regulation 10(5)(e) of the EIRs can be engaged, authorities must consider the following matters: 
    1. Is the information commercial or industrial in nature? 
    2. Does a legally binding duty of confidence exist in relation to the information? 
    3. Is the information publicly available? 
    4. Would disclosure of the information cause, or be likely to cause, substantial harm to a legitimate economic interest?

Is the information commercial or industrial in nature?

  1. Having considered the withheld information, the Commissioner is satisfied that it is commercial in nature for the purposes of regulation 10(5)(e) of the EIRs.

Does a legally binding duty of confidence exist?

  1. In terms of regulation 10(5)(e) of the EIRs, confidentiality “provided by law” will include confidentiality imposed on any person under the common law of confidence, under a contractual obligation, or by statute.
  2. When asked about how the confidentiality of the withheld information was provided for by law, the Authority stated that a legally binding duty of confidence existed regarding the personal data contained in the withheld information where disclosure of names would breach Article 5(1)(a) of the UK GDPR.  
  3. The Authority separately suggested that Decision 123/2018 of the Commissioner indicated (at paragraph 32) information on pricing can be withheld under the exception in regulation 10(5)(e) of the EIRs.
  4. The Commissioner is not satisfied that the information withheld under regulation 10(5)(e) of the EIRs is personal data.  Insofar as any information could be personal data, this would be more appropriately handled under regulation 11 of the EIRs.
  5. In Decision 123/2018 the Commissioner found that a verbal agreement regarding confidentiality could give rise to a duty of confidence.  Given the Authority has not suggested there is any such agreement in this case, the Commissioner considers this decision to be of, at most, limited relevance.
  6. In the absence of any other submissions from the Authority on how the confidentiality of this information is provided for in law, the Commissioner is not satisfied that the Authority has made the case that a legally binding duty of confidence exists in relation to the information withheld under the exception in regulation 10(5)(e) of the EIRs.
  7. Where an authority seeks to rely on an exception under the EIRs or an exemption under FOISA to withhold information, it must be able to demonstrate that the relevant statutory tests are met.  It is for the authority to make the case, not for the Commissioner to make it on behalf of the authority. 
  8. In this case, the Commissioner finds, on the basis of the submissions he has received and in the absence of any obligation of confidentiality, that the Authority was not entitled to withhold the information in question under the exception in regulation 10(5)(e) of the EIRs. Having reached that conclusion, he is not required to on to consider the application of the public interest test in regulation 10(1) of the EIRs in relation to this information.
  9. The Commissioner therefore requires the Authority to disclose to the Applicant the information he has found to be wrongly withheld under regulation 10(5)(e) of the EIRs. 

Decision 

The Commissioner finds that the Authority partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant. 

The Commissioner finds that, by correctly withholding signatures, contact details, and names of individuals occupying junior roles and the signatures and contact details of individuals with senior or public facing roles under the exception in regulation 11(2), the Authority complied with the EIRs.

However, by incorrectly withholding information under the exception in regulation 10(5)(e) and the names of individuals with senior or public facing roles under the exception in regulation 11(2) of the EIRs, the Commissioner finds that the Authority failed to comply with the EIRs.  

The Commissioner therefore requires the Authority to disclose the wrongly withheld information to the Applicant, by 14 September 2026.  

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement  

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

 

Euan McCulloch 

Head of Enforcement 

 

30 July 2026

  1. ^

  2. ^

  3. ^

  4. ^