Home Decisions

Decision 209/2026

Decision 209/2026:  Insurance policy for canopy structure at a specified address

 
Authority: South Lanarkshire Council
Case Ref: 202501648
 

Summary

The Applicant asked the Authority for information about an insurance policy relating to a canopy structure at a neighbouring property.  The Authority refused to confirm or deny whether the information existed or was held.  The Commissioner investigated and found that the Authority was entitled to refuse to confirm or deny whether the information existed or was held. 

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner”) (Interpretation); 5(1) (Duty to make environmental information available on request); 11(1), (2), (3)(A)(a) and (6) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to processing of personal data) and 6(1) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), 4(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 29 July 2025, the Applicant made a request for information to the Authority.  He asked the following in relation to the construction of a canopy structure at a neighbouring property: 

    (i)  Whether the Authority reminded the tenant he had to take out an insurance policy as a condition of the permission granted for the structure.

    (ii)  Whether such an insurance policy was obtained and remained in effect.

    (iii)  A copy of any policy with any personal information redacted.

  2. The Authority responded on 15 August 2025.  It advised the Applicant that it was applying the exemption in section 38(1)(b) of FOISA on the following grounds:
  • For part (i), disclosing whether such a reminder was issued would reveal information about an identifiable individual’s interactions with the Authority in relation to their tenancy
  • For part (ii), disclosing whether the tenant had taken out insurance (or the details of that policy) would reveal information relating to their private financial and contractual arrangements
  • For part (iii), disclosing whether or not the tenant held such a policy would reveal either that the tenant had or had not taken out insurance, which would reveal information about their private financial arrangements.
  1. On the same date, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he did not consider that disclosure of the information requested would breach data protection principles if appropriately redacted. 
  2. The Authority notified the Applicant of the outcome of its review on 12 September 2025, in the following terms:
  • The information requested was environmental information, so it was now dealing with the request in terms of the EIRs
  • Confirmation of whether or not the information requested existed or was held would involve making personal data available in contravention of the exception in regulation 11(2) of the EIRs, so it was refusing to do so in terms of regulation 11(6)
  1. On 12 September 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he considered the Authority was not entitled to refuse to confirm or deny whether it held the information requested and that the information requested, or some of it, could be disclosed in redacted form.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 23 December 2025, the Authority was notified in writing that the Applicant had made a valid application.  The case was subsequently allocated to an investigating officer. 
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Regulation 11(6) of the EIRs

  1. Regulation 11 of the EIRs relates to personal data.  Regulation 11(6) allows a Scottish public authority to respond to a request for information by not revealing whether the requested information exists or is held by it (whether or not it actually holds that information), if giving such confirmation would involve making information available in contravention of regulation 11.
  2. Regulation 11(2) of the EIRs provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply. These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).

  3. Where regulation 11(6) of the EIRs is applied in conjunction with these provisions, the Commissioner must consider two separate matters: 

    (a)  Would revealing whether the requested information exists or is held make available any personal data of a third party? 

    (b)  Would that disclosure (i.e. revealing whether the information exists or is held) breach any of the data protection principles?

  4. The Commissioner considered whether the Authority’s initial response, which did not rely on regulation 11(6) of the EIRs or section 18 of FOISA, had the effect of confirming whether it held the information requested.
  5. While the Authority’s initial response should have been clearer, the Commissioner accepts that it is worded in such a way that it does not actually confirm or deny whether it held the information requested and therefore does not preclude it from later relying on regulation 11(6) of the EIRs.

Would revealing whether the information requested exists or is held make available personal data?  

  1. “Personal data” are defined in section 3(2) of the DPA 2018 as "any information relating to an identified or identifiable individual". 
  2. Section 3(3) of the DPA 2018 defines "identifiable living individual" as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
  3. Information will "relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is "identified" or "identifiable" if it is possible to distinguish them from other individuals.
  4. The Applicant stated that he could see no reason why the information could not be provided with suitable redactions applied to personal data contained therein.  He also considered that this had been done before by the Authority in response to a previous request and that the information requested related to “enforcement of planning or tenancy conditions not to the private affairs of the tenant”.
  5. The Authority submitted that the information requested, if it existed and were held, would be the personal data of the tenant because any correspondence with the tenant and the question of the existence (or not) of an insurance policy related to the tenant as the occupier of the property.  It did not consider that there would be any expectation by the tenant that whether or not they held an insurance policy would be made available to a requester in response to a request for information.
  6. The Commissioner notes that the request concerns a named property and an identifiable individual (the tenant of the property).  In that context, the Commissioner accepts that confirming or denying whether the Authority holds information falling within scope of any part of the Applicant’s request would reveal information about that tenant’s dealings with the Authority and their compliance with a condition attached to permission for the canopy structure.
  7. The Commissioner acknowledges that part (i) of the request asks whether the Authority reminded the tenant to obtain insurance.  In one sense, this is information principally about the Authority’s actions.  However, because the request concerns a named property and the tenant of that property, the Commissioner accepts that confirming or denying whether such a reminder was issued would also reveal whether the Authority had particular dealings with the tenant about their compliance with the insurance condition.
  8. In all of the circumstances, the Commissioner accepts that the information requested (if it existed and were held) would relate to the tenant and thus would comprise their personal data, as defined in section 3(2) of the DPA 2018.

Would revealing whether the information exists or is held breach any of the data protection principles? 

  1. The Authority argued that providing the requested confirmation would breach the first data protection principle in Article 5(1)(a) of the UK GDPR.  This principle requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.   
  2. The definition of “processing” is wide and includes (section 3(4)(d) of the DPA 2018) “disclosure by transmission, dissemination or otherwise making available”. In the case of the EIRs, personal data are processed when disclosed in response to a request.  This means that personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair. 

Lawful processing: Article 6(1)(f) of the UK GDPR

  1. In considering lawfulness, the Commissioner must consider whether any of the conditions in Article 6 of the UK GDPR would allow the personal data, if it existed and were held, to be disclosed.
  2. The Commissioner considers that, in the circumstances, the only condition in Article 6(1) which could apply, assuming the personal data existed and were held, is condition (f).   

Condition (f): legitimate interests

  1. Condition (f) states that processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of the personal data.
  2. Although Article 6(1) of the UK GDPR states that condition (f) cannot apply to processing carried out by a public authority in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under the EIRs. 
  3. The tests which must be met before Article 6(1)(f) can be relied on are as follows: 
    1. Does the Applicant have a legitimate interest in obtaining the personal data? 
    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest? 
    3. Even if the processing would be necessary to achieve the legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subject?

Would the Applicant have a legitimate interest in obtaining the personal data, if held? 

  1. There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
  2. The Authority acknowledged that the Applicant had contacted it in relation to this issue over a prolonged period and had previously detailed why he felt he should be provided with the information requested.  However, it explained that it could not establish any legitimate interest the Applicant had in seeking correspondence, if it existed and were held, between the Authority and the tenant regarding insurance, nor in the existence or not of any insurance policy.
  3. The Applicant explained that a neighbour had been granted permission by the Authority to construct a canopy structure within their garden.  He described a number of issues he had with the structure, including health and safety implications.
  4. The Applicant noted that he had been informed by a local housing officer that a condition of the permission being granted included the requirement for the tenant to obtain an insurance policy to cover any damage the structure may cause.  He explained that the core issue in relation to his request related to whether the Authority had “ensured compliance” with a condition it imposed relating to insurance being taken out for the new structure attached to a neighbouring property. 
  5. Having considered the submissions from both parties, the Commissioner accepts that the Applicant has a legitimate interest in obtaining the personal data, if it existed and were held, to understand whether the Authority took steps to secure compliance with that condition, particularly given the health and safety issues he has claimed. 

Is confirmation necessary for the purpose of this legitimate interest?

  1. Having accepted that the Applicant has a legitimate interest in the information, if it existed and were held, the Commissioner must consider whether disclosure of that information is necessary to meet that legitimate interest.
  2. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant's legitimate interests can be met by means which interfere less with the privacy of the data subject.
  3. The Authority submitted that, even if it was incorrect in its view that the Applicant had no legitimate interest in obtaining the personal data, if it existed and were held, any perceived interest of the Applicant could be met by other means without overriding the right of the data subject to privacy.
  4. The Commissioner accepts that the Applicant wants to know whether the Authority holds information about action taken, or compliance achieved, in relation to a specific condition affecting a neighbouring property. 
  5. The Commissioner notes the Authority’s position that it had already provided the Applicant with full and detailed reassurances about the inspections undertaken in relation to, and the safety of, the canopy structure at the neighbouring property. However, the Applicant appears to be interested in receiving further information (i.e. the information requested, if it existed and were held) in order to achieve an even fuller understanding of the situation. 
  6. Having considered all the circumstances, the Commissioner is satisfied, on balance, that revealing whether the information requested existed or were held would be necessary for the purposes of the legitimate interest pursued by the Applicant. 

The interests or fundamental rights and freedoms of the data subject (and balancing exercise)

  1. The Commissioner must now balance the legitimate interests in disclosure against the data subject’s interests or fundamental rights and freedoms.  Only if the legitimate interests of the Applicant outweigh those of the data subject can the Authority disclose whether or not the information exists or is held without breaching the first data protection principle.
  2. The Commissioner's guidance on regulation 11 of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subject and carrying out the balancing exercise.  He makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subject and that these are some of the factors public authorities should consider:
    1. whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances); 
    2. the potential harm or distress that may be caused by the disclosure; 
    3. whether an individual objected to the disclosure.
  3. The Authority explained that there did not appear to be any compelling reason which would override the rights of the data subject in terms of privacy regarding their home.  It reiterated that it had provided full and detailed reassurances to the Applicant about the inspections undertaken in relation to, and the safety of, the canopy structure at the neighbouring property.
  4. While the Authority recognised the general public interest in making information available and in keeping the public adequately informed of any danger to public health and safety, it considered that these interests did not outweigh the interest in protecting an individual’s right to privacy.  It also commented that it did not consider the Applicant had demonstrated a link between the information requested and his concerns around safety and property damage.
  5. The Applicant noted that even where information constitutes personal data, disclosure is allowed where it is necessary for a legitimate interest and that interest is not overridden by the data subject’s rights.  He submitted that the Authority could take “a proportionate approach” by confirming “yes” or “no” to the existence of an insurance policy, or by providing a redacted policy showing only the scope of cover. 
  6. The Applicant also noted that the Authority had previously disclosed compliance documents, such as building warrant applications and gas safety certificates, with redactions, without breaching privacy.
  7. The Commissioner has carefully considered the arguments from both parties.  He has already accepted that the Applicant has a legitimate interest in obtaining the information, if it existed and were held. However, in all the circumstances of the case, he cannot accept that this legitimate interest outweighs the rights of the data subject. 
  8. The Commissioner does not consider that the tenant would reasonably expect the Authority to disclose publicly whether it holds the information requested about their insurance arrangements or compliance with a particular condition. Disclosure under the EIRs is disclosure to the world-at-large, not only to the Applicant.  The Commissioner considers that confirming or denying whether the information exists or is held would reveal information about the tenant’s private dealings with the Authority and would enable inferences to be drawn about their compliance with a particular condition.
  9. As stated above, the Commissioner accepts that part (i) of the request principally relates to the Authority’s actions.  However, because the request concerns a named property and the tenant of that property, the Commissioner accepts that confirming or denying whether such a reminder was issued would also reveal whether the Authority had particular dealings with the tenant about their compliance with the insurance condition.
  10. While the Commissioner acknowledges that prejudice to the interests, rights and freedoms of the tenant is less strong in relation to part (i) of the request, he is satisfied that this prejudice is still present.   
  11. In all of the circumstances, the Commissioner considers that revealing whether or not the information requested by the Applicant exists or is held would cause some intrusion into the privacy of the tenant and into matters regarding their home. 
  12. The Commissioner accepts that the Applicant is pursuing a legitimate interest and that confirmation or denial of whether or not the information requested existed and were held would be necessary to achieve that interest.  However, he finds that such a confirmation or denial would be counter to the tenant’s reasonable expectations and would be unwarranted by reason of prejudice to the tenant’s rights, freedoms and legitimate interests.
  13. After carefully balancing the legitimate interests of the Applicant against the interests or fundamental rights and freedoms of the data subject, the Commissioner finds that the legitimate interests served by confirmation or denial of whether the information requested existed or were held would be outweighed by the unwarranted prejudice that would result to the rights, freedoms and legitimate interests of the data subject.  While acknowledging the legitimate interest, he does not accept (in all the circumstances) that it would be strong enough to outweigh the prejudice.
  14. In all the circumstances of this particular case, the Commissioner concludes that condition (f) in Article 6(1) of the UK GDPR could not be met in relation to the personal data sought by the Applicant (assuming it existed and were held).
  15. Given that the Commissioner has concluded that the processing of the personal data, if it existed and were held, would be unlawful, he is not required to go on to consider whether confirmation or denial of whether the information requested existed or were held would otherwise be fair and transparent in relation to the data subject.
  16. For the reasons set out above, the Commissioner is satisfied that revealing whether or not the information requested existed or were held would breach the data protection principle in Article 5(1)(a) of the UK GDPR.
  17. Accordingly, the Commissioner concludes that the Authority was entitled to refuse to reveal whether the relevant information existed or were held in terms of regulation 11(6) of the EIRs.
  18. In conclusion, the Commissioner is satisfied that revealing whether the information existed or was held would contravene regulation 11(2) of the EIRs, and therefore, the Authority was entitled to refuse to do so in terms of regulation 11(6) of the EIRs.

Decision 

The Commissioner finds that the Authority complied with the Environmental Information (Scotland) Regulations 2004 in responding to the information request made by the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

 

 

Euan McCulloch 

Head of Enforcement 


14 August 2026

  1. ^