Decision 220/2026 | Scottish Information Commissioner

Home Decisions

Decision 220/2026

Decision 220/2026: Correspondence relating to specified people, locations and crofting in the Inner Hebrides

Authority: Crofting Commission
Case Ref: 202300476

Summary

The Applicant asked the Authority for all correspondence related to specified people, locations, apportionment and crofting in a specified island in the Inner Hebrides. The Authority responded to part of the request under data protection legislation and the remainder under FOISA, withholding some information on the basis it was third-party personal data. The Commissioner investigated and found that the Authority’s response failed to comply with Part 1 of FOISA and the EIRs. He required the Authority to issue the Applicant with a revised review outcome in respect of the information it considered solely under data protection legislation and to disclose some information it wrongly withheld as third-party personal data.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) (Effect of exemptions); 16 (Refusal of request); 38(1)(a) and (b) (Personal information); 39(2) (Health, safety and the environment); 47(1) and (2) (Application for decision by Commissioner).

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant” and “the Commissioner” and “environmental information”) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 11(1) and (2) (Personal data); 13 (Refusal to make information available); 17(1), (2)(a) and (b) and (f) (Enforcement and appeal provisions).

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

On 15 February 2023, the Applicant made the following request for information to the Authority:

“I request copies of all or any correspondence received which in any form relates to, and to include the words, [specified name], [specified address #1], Apportionment, [specified address #2], [specified address #3] and in general relates to Crofting in the area known as [specified island in the Inner Hebrides].”

The Authority responded on 16 March 2023, in the following terms:

Due to part of the request being for the Applicant’s own personal data, it had processed that part of the request under the DPA 2018 and the UK GDPR.
It considered the remainder of the request under FOISA and disclosed the information requested, subject to third-party personal data being withheld under the exemption in section 38(1)(b) of FOISA.
It also informed the Applicant that, given the nature of previous requests made by the Applicant (by himself or on his behalf), it would not be disclosing information he had already been provided with.

On 5 April 2023, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision, with particular emphasis on matters which had been redacted yet were the subject of an objection. He considered it against natural justice not to disclose the information requested.
The Authority notified the Applicant of the outcome of its review on 18 April 2023, which upheld its original decision.
On 18 April 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA. By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications. The Applicant stated that he was dissatisfied with the outcome of the Authority’s review, for the reasons set out in his requirement for review.

Investigation

The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
On 25 April 2023, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments.
The Authority was also asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and its comments.
The case was subsequently allocated to an investigating officer.
During the investigation, the Commissioner sought and obtained further comments from the Authority.

Commissioner’s analysis and findings

The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

FOISA or EIRs

The relationship between FOISA and the EIRs was considered at length in Decision 218/2007. Broadly, in light of that Decision, the Commissioner’s general position is as follows:
1. The definition of what constitutes environmental information should not be viewed too narrowly.
2. There are two separate statutory frameworks for access to environmental information, and an authority is required to consider any request for environmental information under both FOISA and the EIRs.
3. Any request for environmental information therefore must be handled under the EIRs.
4. In responding to a request for environmental information under FOISA, an authority must claim the exemption in section 39(2).
5. If the authority does not choose to claim the section 39(2) exemption, it must respond to the request fully under FOISA: by providing the information; withholding it under another exemption in Part 2; or claiming that it is not obliged to comply with the request by virtue of another provision in Part 1 (or a combination of these).
6. Where the Commissioner considers a request for environmental information has not been handled under the EIRs, he is entitled (and indeed obliged) to consider how it should have been handled under that regime.
Given the subject matter of parts of the request and having reviewed the withheld information, the Commissioner asked the Authority to consider whether any of the information requested was environmental information as defined by regulation 2(1) of the EIRs and therefore fell to be considered under the EIRs.
The Authority responded that a significant portion of the information falling within the scope of the request had been previously disclosed to the Applicant. Of the remaining information, the bulk consisted of the Applicant’s own personal data and third-party personal data, “rather than information falling under environmental data regulations”.
In the Commissioner’s view, it is apparent from the withheld information that at least some of the information requested is environmental information as defined by regulation 2(1) of the EIRs. However, the Commissioner accepts that not all of the information requested is environmental information.
Having drawn this conclusion, the Commissioner finds that the Authority correctly responded to the request in terms of FOISA with regard to the information which was not environmental information. However, he finds that the Authority failed to recognise that some of the information requested was environmental information and that it was required to consider disclosure of such information in terms of the EIRs and not in terms of FOISA.

Section 39(2) of FOISA – Environmental information

The exemption in section 39(2) of FOISA provides, in effect, that environmental information is exempt from disclosure under FOISA, thereby allowing any such information to be considered solely in terms of the EIRs.
In this case, the Commissioner accepts that the Authority would have been entitled to apply this exemption to the information requested insofar as it comprised environmental information.
As there is a separate statutory right of access to environmental information available to the Applicant, the Commissioner accepts that in this case the public interest in maintaining this exemption (insofar as the information requested comprised environmental information) and in dealing with the request in line with the requirements of the EIRs outweighs any public interest in considering this environmental information under FOISA.

Information falling within the scope of the request

In response to the Commissioner’s request to provide him with the withheld information, the Authority provided 58 documents. The schedule that accompanied this information noted the information in documents 1 to 27 as being out of scope, with the information in documents 28 to 58 noted as falling within the scope of the request.
The Authority explained to the Commissioner that the information in documents 1 to 27 consisted of the Applicant’s own personal data. It therefore considered the information to fall outwith the scope of his FOISA request.
The Commissioner has issued guidance on section 38 of FOISA, and, in particular, the actions that should be taken by a Scottish public authority when it receives a request where someone asks for their own personal data. His guidance is clear that, even if an authority considers a request is for the applicant's own personal data, it should issue a refusal notice in terms of section 16 of FOISA and rely on the exemption in section 38(1)(a) of FOISA: failure to do so is a failure to comply with Part 1 of FOISA.
Similar considerations apply where a request encompasses environmental information. To the extent that the information requested is both the Applicant’s own personal data and environmental information, the duty to make it available under regulation 5(1) of the EIRs does not apply, by virtue of the exception in regulation 11(1). However, the Authority must nevertheless issue a refusal notice in terms of regulation 13 of the EIRs: failure to do so is a failure to comply with the EIRs.
Where the information requested is a mix of the requester’s personal data and the personal data of third parties, the Commissioner’s guidance states:

“If the personal data is difficult to separate, the appropriate way forward is to consider the information under the exemption in section 38(1)(a) [or the provision in regulation 11(1) of the EIRs] …”

However, the guidance makes it clear that a refusal notice must still be issued in such circumstances – and that where the personal data of third parties is clearly distinct from that of the requester, then the third party data should be dealt with separately, under the exemption in section 38(1)(b) [or, as appropriate, the exception in regulation 11(2) of the EIRs].
The Commissioner has considered the information in documents 1 to 27. It clearly falls within the scope of the request and appears to be a mix of the Applicant’s personal data and the personal data of third parties. The Authority therefore should have considered these documents for disclosure under FOISA and the EIRs, taking due account of the relevant guidance, even though it considered these documents under data protection legislation.
In the circumstances, the Commissioner therefore requires the Authority to issue a revised review outcome (in terms of section 21 of FOISA/regulation 16 of the EIRs, depending on whether the information in question is environmental or non-environmental information) in relation to documents 1 to 27.
The Commissioner will now consider whether the Authority was entitled to withhold the information in documents 28-58 as third-party personal data.
For any non-environmental information, the relevant provision is section 38(1)(b) of FOISA; for any environmental information, the relevant provision is regulation 11(2) of the EIRs. In the circumstances of this case and in light of his conclusions at paragraphs 14 and 15 above, the Commissioner will consider both provisions together.

Section 38(1)(b) of FOISA and regulation 11(2) of the EIRs – Third-party personal data

Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption. This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
Similarly, regulation 11(2) of the EIRs provides that personal data shall not be made available where the applicant is not the data subject and another specified condition applies. These include where the disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
To rely on this exemption or exception, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of a disclosure under FOISA or the EIRs) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.

Is the information personal data?

The first question the Commissioner must address is whether the information is personal data for the purposes of section 3(2) of the DPA 2018 i.e. any information relating to an identified or identifiable individual. “Identified living individual” is defined in section 3(3) of the DPA 2018. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
The Court of Justice of the European Union looked at the question of identification in Breyer v Bundesrepublik Deutschland (C-582/14). The Court said that the correct test to consider is whether there is a realistic prospect of someone being identified. In deciding whether there is a realistic prospect of identification, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain – if the risk of identification is “insignificant”, the information won’t be personal data.
Although this decision was made before the UK GDPR and the DPA 2018 came into force, the Commissioner expects that the same rules will apply. As set out in Recital (26) of the GDPR (the source of the UK GDPR), the determination of whether a natural person is identifiable should take account of all means reasonably likely to be used to identify the person, directly or indirectly.
In considering what is reasonably likely, the Recital states that all objective factors should be taken into account, such as the costs and amount of time required for identification, the available technology at the time of processing and technological developments. It confirms that data should be considered anonymous (and therefore no longer subject to the UK GDPR) when the data subject(s) is/are no longer identifiable.
The Authority submitted that the information withheld under section 38(1)(b) of FOISA comprised third-party personal data, made up of names, contact details, email addresses and specific contextual content within the correspondence.
The Authority explained that a significant portion of the withheld information related to individuals in a small island community. In its view, in a population of this size, even contextual details could be cross-referenced with local knowledge, making individuals identifiable.

The Commissioner’s view

The Commissioner has carefully considered the submissions from the Authority, together with the information withheld from the Applicant.
The Commissioner accepts that most of the withheld information is clearly personal data as it comprises names, contact details and email addresses of living individuals. He is satisfied that this information is personal data in terms of section 3(2) of the DPA 2018.
For the specific contextual content withheld as personal data, the Commissioner notes the specific terms and subject matter of the request and the relatively small population to which it relates. In that context, and having carefully considered the withheld information, the Commissioner is also satisfied that this information is personal data in terms of section 3(2) of the DPA 2018.
However, the Commissioner is not satisfied that all of the withheld information is personal data in terms of section 3(2) of the DPA 2018. This is because he does not consider that disclosure of that information would provide a realistic causal chain leading to the identification of living individuals.
Specifically, the Commissioner does not consider the generic personal or organisational email address suffixes (e.g. “…@exampledomain.com”) withheld by the Authority are personal data. However, he accepts some of the email address suffixes withheld by the Authority are sufficiently specific that their disclosure would give rise to a reasonable prospect of the identification of living individuals. He therefore accepts that these email address suffixes are personal data in terms of section 3(2) of the DPA.
The Commissioner’s guidance on section 38(1)(b) of FOISA (at paragraph 87) and his guidance on regulation 11(2) of the EIRs (at paragraph 89) states that:

“… it’s important to keep redactions to the minimum necessary to remove the risk of identification. This is particularly relevant where valuable context would be lost otherwise – consider, for example, whether the full email address needs to be redacted or just that part with the employee’s name (the rest is still likely to help the requester understand where the communications in question originated and were sent to).”

The Commissioner must therefore find that the Authority was not entitled to withhold some information as it was not personal data.
In the absence of another exemption or exception being applied to withhold this information, the Commissioner requires the Authority to disclose it to the Applicant. He will provide a marked-up version of the information indicating the information to be disclosed to the Applicant.
For the remaining information that he is satisfied is third-party personal data, the Commissioner considers this information further below.

Would disclosure contravene one of the data protection principles?

The Authority considered that disclosure of the remaining withheld information would contravene the first data protection principle. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.
"Processing" of personal data is defined in section 3(4) of the DPA 2018. It includes (section 3(4)(d)) disclosure by transmission, dissemination or otherwise making available personal data. The definition therefore covers disclosing information into the public domain in response to a request under FOISA or the EIRs.
The Commissioner must consider whether disclosure of the personal data would be lawful. In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.
The Authority considered condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case. The Commissioner agrees.

Condition (f): legitimate interests

Condition (f) states that processing shall be lawful if it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”
Although Article 6 states that this condition cannot apply to processing carried out by a public authority in performance of its tasks, section 38(5A) of FOISA and regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA and the EIRs.
The tests which must be met before Article 6(1)(f) can be met are as follows:
1. Does the Applicant have a legitimate interest in obtaining personal data?
2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

There is no definition within the DPA 2018 of what constitutes a “legitimate interest”, but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
The Applicant explained that the Authority had retained an objection and appeared to have acted on the content of the objection, yet refused to provide him with the opportunity to respond to the content of the objection. He considered this contrary to the principles of natural justice and argued that the information requested should be disclosed.
The Authority considered that, at the time of the request, the Applicant had a legitimate interest in obtaining the personal data.
In the circumstances, the Commissioner accepts, on balance, that the Applicant has a legitimate interest in obtaining the withheld information in order to achieve a full understanding of the matters specified in the request, particularly the circumstances relating to the objection.
However, given that it is already apparent from the information disclosed by the Authority on whose behalf these individuals were acting (e.g. through disclosure of their role and organisation), the Commissioner considers the Applicant’s legitimate interest in the names and contact details of officials acting in their public capacity to be minimal.

Is disclosure of the personal data necessary?

Having accepted that the Applicant has a legitimate interest in the withheld personal data, the Commissioner must consider whether disclosure of this personal data is necessary to meet that legitimate interest.
"Necessary" means "reasonable" rather than "absolutely" or "strictly" necessary. When considering whether disclosure would be necessary, public authorities must consider whether disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subjects.
The Authority submitted that “the relevant cases are all now closed and any appeal deadline has passed”. It therefore considered it difficult to hold that disclosure of the personal data was necessary.
The Commissioner acknowledges the Authority’s position. However, the appeal periods for the relevant cases it referred to all ended after the date of the review outcome. When determining whether information was properly withheld, the Commissioner must make his assessment in relation to the specific circumstances of the case on each occasion and, as recognised by the Court of Session in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8 (at paragraph [31]), at the time of the review (at the latest).
The Commissioner accepts that the Applicant wants to see the actual information that was communicated to the Authority and who communicated that information. There seems no other way to achieve a complete understanding of this information without full disclosure of the withheld personal data.
Having considered all the circumstances, the Commissioner is satisfied, on balance, that disclosure of the withheld personal information would be necessary to achieve the Applicant’s legitimate interest. Consequently, he will go on to consider whether the interest in obtaining the personal data outweighs the rights and fundamental freedoms of the data subjects.

Interests and fundamental freedoms of the data subjects (and balancing exercise)

The Commissioner must now balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms. Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed.
The Commissioner's guidance on section 38(1)(b) of FOISA and regulation 11(2) of the EIRs notes some of the factors that should be taken into account in considering the interests of the data subjects and carrying out the balancing exercise. He makes it clear that, in line with Recital (47) of the GDPR, much will depend on the reasonable expectations of the data subjects and that these are some of the factors public authorities should consider:
1. whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (e.g. their home, family, social life or finances);
2. the potential harm or distress that may be caused by the disclosure;
3. whether an individual objected to the disclosure.
Broadly, the personal data falls into the following categories: names and contact details of correspondents, names and contact details of those copied into or named within the correspondence and documents, and certain contextual information within the correspondence and documents.
As noted above, the Applicant explained that the Authority had retained an objection and appeared to have acted on the content of the objection, yet refused to provide him with the opportunity to respond to the content of the objection. He considered this contrary to the principles of natural justice and argued that the information requested should be disclosed.
The Authority considered it would be unfair and unlawful to disclose the personal data as it would identify individuals living in a small community where, at the time of the request and review outcome, there was an ongoing dispute. It argued that there was a real risk of harm to third parties if the personal data were to be disclosed and that, as such, this would contravene the rights and freedoms of the data subjects.
The Commissioner has carefully considered the submissions from the Applicant and Authority, as well as the withheld information. He acknowledges the inherent fairness in the Applicant being able to have access to information relating to a regulatory process he may be engaged in with the Authority. The Applicant focused on a key aspect of this information, which, based on the Commissioner’s understanding of the withheld information, falls to be reconsidered by the Authority as part of a revised review outcome as it is contained within documents 1 to 27.
Although there are no absolute rules in this regard, the Commissioner considers that, generally, information which relates to an individual's private life will deserve greater protection than information about the individual acting in an official or work capacity.
To the extent that the withheld information comprises communications from members of the public and certain contextual information, the Commissioner considers that these individuals would have no reasonable expectation that their personal data would be disclosed to the world at large. Given that the information relates to matters within a small geographical community, the Commissioner acknowledges the potential for harm or distress caused as a result of disclosure.
To the extent that the withheld information relates to the individuals' public life (as employees of specific organisations), the Commissioner acknowledges that this adds some weight in favour of disclosure. However, these individuals appear to overwhelmingly occupy more junior roles.
To the limited extent that these individuals appear to occupy more senior roles, the Commissioner does not consider that disclosure of their personal data would assist the Applicant in understanding any better the circumstances of the matters specified in his request. Many of these individuals appear to have simply been copied into correspondence. Where they were more actively involved, it is already apparent from the information disclosed by the Authority on whose behalf these individuals were acting (e.g. through disclosure of their role and organisation).
As highlighted earlier, disclosure under FOISA and the EIRs is not simply disclosure to the person requesting the information; information disclosed under FOISA and the EIRs is effectively placed into the public domain. This must always be borne in mind when considering the effects of disclosure.
Based on the submissions made by the Applicant and the nature of the withheld information in this case, the Commissioner considers that the Applicant’s legitimate interest in relation to the personal data of the limited number of individuals appearing to occupy more senior roles carries little weight. In these particular circumstances, he considers that even the reduced privacy interests of apparently more senior individuals prevail.
After carefully balancing the legitimate interest of the Applicant against the interests or fundamental rights or freedoms of the data subjects, the Commissioner finds that the legitimate interest served by disclosure of the withheld personal data would be outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subjects.
Having found that the legitimate interest served by disclosure of the personal data is outweighed by the unwarranted prejudice that would result to the rights and freedoms or legitimate interests of the data subjects, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met in this case and that disclosure of the information in question would be unlawful.
Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent in relation to the data subject.
The Commissioner is satisfied, in the absence of a condition in Article 6 of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful. He therefore finds that the withheld personal data is exempt from disclosure (and properly withheld) under section 38(1)(b) of FOISA (to the extent it is non-environmental information) and excepted from disclosure (and properly withheld) under regulation 11(2) of the EIRs (to the extent it is environmental information).

Decision

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) and with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.

The Commissioner finds that the Authority failed to comply with FOISA and the EIRs in the following respects:

By failing to recognise that some of the information requested was environmental information and consider that information under the EIRs, the Authority failed to comply with regulation 5(1) of the EIRs.
By solely considering documents 1 to 27 under data protection legislation, the Authority failed to comply with Part 1 of FOISA (in particular, sections 1(1) and 16(1)) and the EIRs (in particular, regulations 5(1) and regulation 13).
By wrongly withholding certain information as third-party personal data, the Authority failed to comply with section 1(1) of FOISA (to the extent the information was non-environmental information) and regulation 5(1) of the EIRs (to the extent that the information was environmental information).

The Commissioner therefore requires the Authority to:

issue a revised review outcome (in terms of section 21 of FOISA/regulation 16 of the EIRs, depending on whether the information in question is environmental or non-environmental information) to the Applicant in relation to documents 1 to 27.
disclose to the Applicant the information wrongly withheld as third-party personal data

The Authority must comply with the above steps by 18 October 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch

Head of Enforcement

3 September 2026