Home Decisions

Decision 216/2026

Decision 216/2026:  Allocation of a specified property

Authority: West Dunbartonshire Council
Case Ref: 202501929
 

Summary

The Applicant asked the Authority for information about how a specified property was allocated.  The Authority withheld the shortlist for the property and information about the successful tenancy applicant on the grounds that the information was third party personal data.  The Commissioner investigated and found that some information was properly withheld, but the Authority should have disclosed other information to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 38(1)(b), (2A)(a), (5) (definitions of “the data protection principles”, “data subject”, “personal data”, “processing” and “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to the processing of personal data) and 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).  

Background

  1. On 1 August 2025 the Applicant made a request to the Authority regarding the allocation of a specified property.  He asked for: 
    1. “The full allocation shortlist for the property at the time it became void and was subsequently allocated, including: 
      • Applicant reference numbers (or anonymised identifiers) 
      • Group placement (e.g., Homeless, General, Transfer, etc.) 
      • Priority points are awarded to each applicant considered 
    2. The dates the property was first advertised/considered void, as well as the date it was allocated.
    3. Confirmation of whether medical priority points (Category A/B) or homelessness status were applied to the successful applicant.
    4. Any policies or procedures explicitly used for this allocation, if different from the published Allocations Policy.”
  2. The Authority responded on 29 August 2025, in the following terms:
  • For parts (i) and (iii), it withheld the information requested under the exemption in section 38(1)(b) of FOISA
  • For part (ii), it confirmed the end of tenancy date was 9 June 2025, and the property was allocated on 7 July 2025
  • For part (iv), it stated that no other policies or procedures were used in the allocation.
  1. On 30 August 2025 the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he disagreed that the exemption in section 38(1)(b) of FOISA applied.  In particular, he considered the risk of individuals being identified from the information was low, that similar information had been disclosed to an MP without objection and that his legitimate interests favoured disclosure. 
  2. The Applicant did not receive a response to his requirement for review within the timescale set down by FOISA.
  3. Following the Applicant writing to the Commissioner on 1 October 2025, stating that he was dissatisfied with the Authority’s failure to respond and applying to the Commissioner for a decision in terms of section 47(1) of FOISA, the Authority responded to the Applicant’s requirement for review on 6 October 2025.  The Authority’s review outcome upheld its original decision position but provided the Applicant with further explanation.
  4. On 20 October 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  He stated that he was dissatisfied with the outcome of the Authority’s review because he disagreed that the Authority was entitled to withhold this information, and he did not believe that the Authority provided him with adequate advice and assistance. 
  5. On 12 January 2026, the Commissioner issued Decision 002/2026 in relation to the Applicant’s original application and found that the Authority had failed to respond to the Applicant’s requirement for review within the timescales laid down by section 21(1) of FOISA.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 15 January 2026, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was subsequently allocated to an investigating officer. 
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions, related to its application of the exemption in section 38(1)(b) of FOISA.

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 

Section 38(1)(b) – Personal information

  1. Section 38(1)(b) read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means it is not subject to the public interest test in section 2(1)(b).
  3. To rely on this exemption, the Authority must show that the withheld information is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles found in Article 5(1) of the UK GDPR.

Is the withheld information personal data?

  1. The first question the Commissioner must address is whether the information being withheld under this exemption is personal data for the purposes of section 3(2) of the DPA 2018.
  2. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.  Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to –
    1. an identifier, such as a name, an identification number, location data, or an online identifier, or
    2. one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
  3. The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland (C-582/14).  The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified.  In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party.  However, there must be a realistic causal chain – if the risk of identification is “insignificant”, the information won’t be personal data.
  4. Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply.  As set out in Recital (26) of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly.
  5. In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, the available technology at the time of processing and technological developments.  
    It confirms that data should be considered anonymous (and therefore no longer subject to the UK GDPR) when the data subjects are no longer identifiable.

The Applicant’s comments on identifiability

  1. The Applicant accepted that some of the information requested may amount to personal data.  However, he considered that this did not automatically mean that every part of the withheld information must be withheld in full.  

The Authority’s comments on identifiability

  1. Even without physical occupancy, the Authority considered that the tenancy applicants remained identifiable as data subjects.
  2. The Authority mentioned the detailed information already available to the Applicant, the detailed information requested and the small number of individuals covered as relevant factors. It argued that the information requested, when combined with these factors, would allow identification of the tenancy applicants and for inferences to be made about their personal circumstances, including priority and housing need.
  3. In response to a question from the Commissioner, the Authority confirmed that the withheld information related solely to people who never took up residence in the property specified in the request.

The Commissioner’s view

  1. The Commissioner has carefully considered the submissions from both parties, together with the information withheld from the Applicant.
  2. The Commissioner notes that, as the person initially offered the flat ultimately refused the allocation, none of the individuals on the shortlist – even the individual identified as the successful applicant – ever stayed in the flat.  This appears to have been known to the Authority by the time of the review outcome.
  3. In light of the above, the Commissioner considers that obvious means of identification through local knowledge, which he would normally accept as sufficient to identify the resident(s) of an address, do not apply in this case.
  4. In the absence of any of these individuals taking up residence in the specified property, the Authority has not provided any detailed explanation of how the individuals in question could otherwise be identified. 
  5. The Commissioner cannot therefore find that all of the withheld information is personal data.  He requires the Authority to disclose the information that is not personal data to the Applicant.  He will specify to the Authority the information to be disclosed.
  6. However, the Commissioner notes that some of the withheld information consists of names, contact details and addresses.  He is satisfied that this information is the personal data of identifiable individuals and, as such, is personal data in terms of section 3(2) of the DPA 2018.  He will consider this information further below.

Would disclosure contravene one of the data protection principles?

  1. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject.”
  2. "Processing" of personal data is defined in section 3(4) of the DPA 2018.  It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data.  The definition therefore covers disclosing information into the public domain in response to a FOISA request.
  3. The Commissioner must consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
  4. The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

  1. Condition (f) states that the processing will be lawful if it “…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data…”
  2. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
  3. The tests which must be met before Article 6(1)(f) can be met are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would disclosure of the personal data be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. The Commissioner notes that the Applicant has clearly stated his interest is in how the allocation process was carried out, and that, during the investigation, he stated that he was not seeking names.
  2. The Commissioner also notes that, in his indicative list of information he was seeking in the shortlist, the Applicant did not specifically ask for names, addresses or contact details.  In fact, he explicitly requested an anonymised identifier. 
  3. The Commissioner has considered whether this information actually falls within the scope of the request.
  4. While the Applicant explicitly asked for an anonymised identifier, the Commissioner notes that the Applicant also asked for the information in the shortlist, without expressly excluding names, addresses and contact details.   In the circumstances, the Commissioner therefore accepts this information, strictly, falls within the scope of the request. 
  5. However, the Commissioner does not consider that it appears to have been the Applicant’s intention to request these details and considers that this information is likely to offer, at most, limited assistance in the Applicant’s stated goal of understanding the allocation process.
  6. The Commissioner therefore finds that the Applicant does not have a legitimate interest in this information.
  7. As the Commissioner has concluded that the Applicant does not have a legitimate interest in receiving this personal data, he finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied.  Accordingly, he accepts that making the personal data available would be unlawful.
  8. Given that the Commissioner has found that the processing (i.e. making the information available, in response to the Applicant's request) would be unlawful, he is not required to go on to consider separately whether disclosure of these personal data would be necessary to fulfil any legitimate interest or consider the data subjects’ interests or fundamental rights and freedoms, and balance them against any legitimate interest in disclosure.
  9. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that making this personal data available would be unlawful and would breach the data protection principle in Article 5(1)(a) of the UK GDPR.  Consequently, he is satisfied that disclosure of the personal data is not permitted by section 38(1)(b) of FOISA.

Section 15 – Advice and Assistance

  1. Section 15(1) of FOISA requires a Scottish public authority, so far as it is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it. 
  2. Section 15(2) states that a Scottish public authority shall be taken to have complied with this duty where (in relation to the provision of advice and assistance in a particular case) it conforms with the guidance in the Scottish Ministers' Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004 (the Section 60 Code).
  3. The Applicant commented that the Authority’s review outcome accepted that the original response could have provided further information and context.  He considered that the additional information provided in the review outcome – including that the property had not been signed up, was still at repair, that the initial allocation had been refused, and that the property had since been rematched – could and should have been given by the Authority earlier.
  4. The Commissioner notes that the Authority has provided explanation to the Applicant, both in its response and review outcome.  While the Applicant is correct to say that the Authority provided further explanation in the review outcome, the Commissioner recognises that it is often easier to provide advice once there has been an opportunity for applicants to convey more detail on their concerns.
  5. In any event, the purpose of the review stage in FOISA is to provide authorities with the opportunity to reconsider their handling of an initial information request, in order to ensure that they are satisfied that the request has been dealt with fully in accordance with FOISA, prior to an application being made to the Commissioner (if necessary).
  6. Having considered the advice and assistance provided by the Authority to the Applicant in the review outcome, the Commissioner is satisfied that the Authority complied with the duty under section 15(1) of FOISA.

Decision 

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicants. 

The Commissioner finds that by relying on the exemption in section 38(1)(b) of FOISA to withhold the names, contact details and addresses contained in the shortlist, the Authority complied with Part 1 of FOISA.

However, the Commissioner finds that the Authority failed to comply with Part 1 of FOISA (in particular, section 1(1)) by wrongly withholding other information (which was not personal data) under the exemption in section 38(1)(b) of FOISA.

The Commissioner therefore requires the Authority to provide the incorrectly withheld information to the Applicant, by 12 October 2026.  He will specify to the Authority the information to be disclosed to the Applicant.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

 

Euan McCulloch 

Head of Enforcement 

 

27 August 2026

 

  1. ^

  2. ^

  3. ^