Decision 237/2025: Responses to consultation on sale of land belonging to the Common Good

Authority:  Highland Council
Case Ref:  202301411
 

Summary

The Applicant asked the Authority for the full responses, including the names and addresses of those who responded, to a consultation on the disposal of a piece of land.  The Authority disclosed the information with some third party personal data redacted. The Commissioner investigated and found that, while the Authority had correctly withheld some third party personal data, it had wrongly withheld some other information under the personal data exemption, which he required the Authority to disclose to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002[1] (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation[2] (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018[3] (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 15 September 2023, the Applicant made a request for information to the Authority.  She asked for a copy of each of the full responses with names and addresses of those who responded to the recent Common Good consultation on the disposal of land at the Seamen’s Hall, Harbour Street, Nairn.  The Applicant stated that, since all respondees to the consultation were informed in the information on the Authority’s website that their details would be published, there was no issue of not having consent to reveal their names and addresses.  In support of her view, the Applicant referred to Section 104 of the Community Empowerment Act 2015[4] (CEA) and the Council’s own policy on the Process for the Disposal of or Change of Use of Common Good Property dated December 2018.
2. The Authority responded on 12 October 2023.  It disclosed the information requested with some third party personal data redacted under section 38(1)(b) of FOISA.
3. On 12 October 2023, the Applicant wrote to the Authority requesting a review of its decision to withhold the identities of the respondents which, in her view, made the consultation anonymous for no apparent reason.  She argued that Common Good law and guidance stated that respondents to consultations must be made aware that all responses would be published in the interests of transparency and, as Common Good consultations were aimed at residents of the area, how could it be verified that a respondent had any right or “interest” to participate if their identities were unknown. As such, she believed that there was a clear breach of both the spirit and the letter of Common Good law and guidance.
4. The Authority notified the Applicant of the outcome of its review on 9 November 2023, fully upholding its original decision.  It explained that, while section 104 of the CEA required it to publish responses to consultations about the change of use or disposal of Common Good land, there was no statutory requirement to identify respondents.  Similarly, Scottish Government Guidance[5] on the disposal/change of use of Common Good land did not stipulate that respondents’ identities must be published alongside their responses.

5. With regard to its own guidance, the Authority informed the Applicant that she had referred to an older version of the process document from December 2018, which had been updated in February 2020, prior to the commencement of the consultation in question.  The Authority explained this document [“Process for disposal or change of use of Common Good property”[6]] now stated:

   “Details of all representations received will be published on the Council’s website in the same place as the proposal.  The person/body making the representation may be identified by name, but no other personal information will be included.”

6. The Authority believed that it had no legal obligation to publish respondents’ identities and that its decision on this was discretionary, provided it met the statutory requirement to publish all responses.  It also believed disclosure would benefit neither the consultation nor the community, as respondents could be reluctant to participate in the future, potentially stifling open and transparent debate about community matters.
7. On 10 November 2023, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated that she was dissatisfied with the outcome of the Authority’s review because she did not agree that the personal data exemption applied, and she believed disclosure would be in the public interest.

Investigation

8. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
9. On 10 January 2024, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments, which the Authority provided.
10. The case was subsequently allocated to an investigating officer.
11. Following consideration of the Authority’s initial comments, the Investigating Officer sought further submissions from the Authority. These focused on the Authority’s justification for withholding the information requested under section 38(1)(b) of FOISA.
12. The Applicant was invited to provide comments on her legitimate interest in accessing the third party personal data being withheld.
13. The Authority was also asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information.
14. Both parties provided further submissions to the Commissioner during the investigation.

Commissioner’s analysis and findings

15. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Section 38(1)(b) (Personal information)

16. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
17. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
18. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
19. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

20. The first question the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018 as a living individual who can be identified, directly or indirectly, in particular by reference to –

    1. an identifier such as a name, an identification number, location data, or an online identifier, or

    2. one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

    This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.

21. In her application to the Commissioner, the Applicant believed that personal data had to be in the text of the data, where the main focus of that text was the individual themselves or a third party mentioned therein.  She argued that, simply knowing that a named individual had willingly made a representation to an authority about an unrelated topic (in this case the sale of land), in the knowledge that their name (and possibly address) may be published, did not make their name and address “personal data”.
22. In its submissions to the Commissioner, the Authority confirmed that the withheld information comprised the names and addresses of the individuals who had commented on the consultation.  It submitted that a name identifies or enables a person to be identified, and their address is personal information about where they live.  The Authority was therefore satisfied that this information fell within the definition in part 3(2) of the DPA, and the wider definition in Article 4 of the UK GDPR.
23. Information which is capable of identifying individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
24. The Commissioner has carefully considered all of the information being withheld under section 38(1)(b).  Having done so, the Commissioner is not satisfied that certain of this information can be considered to be personal data.  It is either clearly not personal data, or it comprises the names of organisations (as opposed to living individuals).
25. In the Commissioner’s view, disclosure of this particular information would not lead to the identification of individuals and he therefore does not accept that this particular information comprises personal data for the purposes of section 3(2) of the DPA 2018.  He therefore has no option but to conclude that the Authority was not entitled to rely upon section 38(1)(b) of FOISA to withhold that particular information and, by doing so, breached Part 1 of FOISA.
26. For the remainder of the information withheld under section 38(1)(b) (i.e. the names and addresses of the respondents), it is clear to the Commissioner that it “relates to” identifiable living individuals.  The Commissioner is therefore satisfied that the remaining withheld information comprises personal data for the purposes of section 3(2) of the DPA 2018.
27. However, the Commissioner notes that certain of these personal data have already been disclosed in the information released to the Applicant in response to her initial request, or is available in the public domain.  Given this, he can see no valid reason for the Authority’s decision to withhold it under the exemption in section 38(1)(b).  In light of this, the Commissioner finds that the Authority wrongly withheld this particular information under section 38(1)(b) and, in doing so, breached Part 1 of FOISA.
28. The Commissioner therefore requires the Authority to disclose to the Applicant the information which he has found to have been wrongly withheld under section 38(1)(b) (as set out in paragraphs 24, 25 and 27 above).  This will be indicated on a marked-up copy of the withheld information to be provided to the Authority along with this Decision Notice.
29. The Commissioner will now go on to consider the Authority’s reliance on section 38(1)(b) to withhold the remaining information which, he is satisfied, comprises third party personal data for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

30. The Authority stated that disclosure of these personal data would breach Article 5(1)(a) of the UK GDPR, in that it would be unfair and lawful.  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
31. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to a request.
32. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

33. Condition (f) states that the processing will be lawful if it “…is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).”
34. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
35. The tests which must be met before Article 6(1)(f) can be met are as follows:

    1. Does the Applicant have a legitimate interest in obtaining the personal data?

    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

36. In her application to the Commissioner, the Applicant believed there was a public interest in disclosure of the information.  In support of her position, she submitted that Common Good consultations were supposed to be for the community who owned the Common Good assets.  She argued that, for this to be fair and above board, community members had a right to know who was responding to the consultation and where they resided or had their business, otherwise organisations with a financial interest in divesting the Common Good of its assets and profiting thereby could sway a consultation.
37. In its submissions to the Commissioner, the Authority stated that it appeared that the Applicant wished to know the identities of individuals who had submitted comments on their own behalf.  It explained that it had published a breakdown of the responses, which showed that nine of the 19 responses had been submitted by individuals who were not members of community councils (five for and four against the proposal).  The Authority believed that the Applicant wished to discover if any of those five individuals, who were in support of the proposal, had any vested interest in it.  On the basis that this belief was correct, the Authority acknowledged that this would appear to be a legitimate interest in the information.
38. The Commissioner accepts that disclosure of the remaining withheld information would facilitate transparency and accountability to the Applicant (and the wider public) regarding those individuals who were, and who were not, supportive of the proposal, and whether or not they were local to, or had a reasonable connection with, the area (and so would cast some light on their interest in the proposal).  Consequently, the Commissioner accepts that the Applicant has a legitimate interest in the disclosure of the remaining personal data.

Is disclosure of the personal data necessary?

39. Having accepted that the Applicant has a legitimate interest in the remaining withheld personal data, the Commissioner must consider whether disclosure of those personal data is necessary to achieve the Applicant's legitimate interest.  In doing so, he must consider whether that interest might reasonably be met by any alternative means.
40. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55[7].  In this case, the Supreme Court stated (at paragraph 27):

“A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim.  Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”

41. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities must consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the Applicant’s legitimate interests can be met by means which interfere less with the privacy of the data subject(s).
42. In its submissions to the Commissioner, the Authority explained that, in disclosing the consultation responses to the Applicant (as well as publication on its website), this allowed businesses, community councils and other organisations to be identified, but not individual respondents.  The Authority submitted that it was not possible to disclose the information requested without identifying those individuals.
43. The Authority acknowledged, however, that disclosure of the information would be necessary to satisfy the legitimate interest of the Applicant that it had identified (as set out in paragraph 37 above).
44. The Commissioner accepts that disclosure of the remaining personal data is necessary to achieve the Applicant's legitimate interest.  He notes, however, that the Authority has already disclosed the content of the consultation responses to the Applicant, and has identified where these have been submitted by businesses, community councils and other organisations.  In the Commissioner’s view, this takes the Applicant some way towards satisfying her legitimate interest.  However, more specific details of the identities of the individual respondents might well be considered relevant to fully achieving the Applicant’s legitimate interest and would be quite appropriate matters for transparency and accountability in this context.  The Commissioner can identify no viable means of fully meeting the Applicant's legitimate interest which would interfere less with the privacy of the data subjects than providing the remaining withheld information in full.  In all of the circumstances, therefore, the Commissioner is satisfied that disclosure of the remaining withheld information is necessary for the purposes of the Applicant's legitimate interest.
45. The Commissioner will now consider whether the Applicant’s legitimate interest in obtaining the remaining withheld information outweighs the rights and freedoms of the data subjects.

The data subjects' interests or fundamental rights and freedoms

46. It is necessary for the Commissioner to balance the legitimate interests in disclosure against the data subjects' interests or fundamental rights and freedoms.  In doing so, he must consider the impact of disclosure.  For example, if the data subjects would not reasonably expect that the information would be disclosed to the public under FOISA in response to the information request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override any legitimate interests in disclosure.  Only if the legitimate interests of the Applicant outweigh those of the data subjects can the information be disclosed without breaching the first data protection principle.
47. The Commissioner's guidance on section 38 of FOISA[8] notes factors that should be taken into account in balancing the interests of parties.  He notes that, although no longer applicable in the UK, Recital (47) of the General Data Protection Regulation states that much will depend on the reasonable expectations of the data subjects.  These are some of the factors public authorities should consider:

    1. Does the information relate to an individual's public life (their work as a public official or employee) or to their private life (their home, family, social life or finances)?

    2. Would the disclosure cause harm or distress?

Does the information relate to public or private life?

48. Disclosure under FOISA is public disclosure; information disclosed under FOISA is effectively placed into the public domain.
49. The Commissioner acknowledges that the remaining withheld information relates to the individuals' private lives, in that it comprises their names and addresses, provided alongside their personal views in response to the consultation.
50. The Commissioner therefore concludes that the withheld information relates to the private lives of the data subjects.

Would disclosure cause harm or distress to the data subjects?

The Applicant’s submissions

51. In her application to the Commissioner, the Applicant referred to Chapter 5 of the Scottish Government guidance on consultations to dispose of Common Good assets which stated:

    “The local authority must invite community councils and other community bodies to consider and give their views on the proposal, making it clear that all representations will be published.  This ensures that the process is carried out in a transparent way.”’  [Paragraph 8], and

    “The final response(s) should then be published online alongside the original representation(s)...”  [Paragraph 11]

52. In the Applicant’s view, this, together with section 104 of the CEA and other legal sources, made it clear that the Common Good consultation was with the owners of the Common Good assets (in this case the residents of Nairn), including those with a local interest (for example, a business or a sports club), otherwise housing developers, landowners and others seeking to benefit financially (such as the local authority) could respond to a consultation in which they had no legal right to participate.  In this respect, she believed her request to identify respondees by name and address was an integral part of the consultation and fulfilled the duty of transparency considered paramount by the Scottish Government.
53. The Applicant further argued that the Authority had not provided any evidence of any respondent having asked for their submission to be anonymised, and that none of the submissions (which she now had copies of) had asked for that.
54. In her submissions to the Commissioner, the Applicant noted that the Authority’s Common Good consultation guidance in 2018 originally stated that “the person/body making the representation will be identified by name and address”, but that this had been changed in 2019 (she believed, by an official without Committee approval) to “the person/body making the representation may be identified by name, but no other personal information will be included”.
55. In this regard, the Applicant referred to a paper submitted to a Council meeting on 7 March 2019 that stated “The person/body making the representation will be identified by name and address but any signature and/or other personal information will be blacked out”.  She argued that this had been approved by the full Council.
56. The Applicant acknowledged that the Authority had confirmed that the wording had been changed in 2020 by an official, with no approval from Councillors (who were Common Good trustees), community bodies or residents in the community.  In her view, this went against the CEA and Scottish Government guidance regarding full transparency.

The Authority’s submissions

57. In its submissions to the Commissioner, the Authority confirmed that section 104 of the CEA required it to consult with the community, relevant community councils and community bodies, and that Scottish Government guidance on the change of use/disposal of Common Good land required the publication of responses to consultations.  It noted, however, that there was no statutory requirement in either to identify respondents.  In addition, the Authority submitted that, while most respondents to Common Good consultations did tend to be local, there was no geographical restriction (statutory or otherwise) on who may or may not comment on a consultation.
58. The Authority acknowledged that the accompanying guidance[9] issued to the public for submitting responses to the consultation in question did not contain text indicating that respondents should expect their identities to be published along with their responses. However, as there was no legal requirement to publish respondents’ identities, the Authority believed it had discretion over that decision.
59. The Authority submitted that, over the years, there had been contention within the Nairn community, both within and outwith community councils, around matters involving the Authority and specifically in relation to the Common Good Fund, and this continued to be the case.  It explained that there had been only one Common Good consultation in Nairn where identities had been disclosed: this was by prior agreement before the consultation had started, and it was stressed to the community at the time that this would not set a precedent.
60. The Authority further confirmed that the Common Good Fund Officer, the Ward Manager and other staff, when manning information points, had received requests for confidentiality in relation to Nairn Common Good matters.  It was concerned that the information, if disclosed, would be used to make contact with the data subjects or to make public comments that would cause distress to those individuals.  It therefore believed that the non-publication of respondents’ identities was vital to protect individuals from distress, and to encourage free engagement in community decisions without fear of confrontation from fellow residents or neighbours.  Recognising that disclosure of the information under FOISA would not be solely to the Applicant, the Authority stated that it was uncomfortable about being seen as the source of such distress and as having gone back on assurances provided regarding the protection of confidentiality.

61. In relation to the Applicant’s belief that withholding respondents’ identities went against its own guidance on Common Good consultations for the disposal/change of use of land, the Authority stated that the guidance she had referred to in her initial information request was an older version of a process document originally written in December 2018.  This older document stated that:

    “All representations received will be published on the Council’s website in the same place as the proposal.  The person/body making the representation will be identified by name and address but any signature and/or other personal information will be blacked out.”

62. The Authority confirmed that this document had been updated in February 2020 (a copy of which was publicly available on its website), prior to the commencement of the consultation in question, and this now stated:

    “Details of all representations received will be published on the Council’s website in the same place as the proposal.  The person/body making the representation may be identified by name, but no other personal information will be included.”

63. The Authority explained that this document was not a policy document, but a process document, designed to assist anyone wishing to make a representation by summarising the guidance for easy reading.  This explanatory document was provided to assist the public, and did not attract the same formality as a policy document which would require Council/Committee approval.  The Authority further confirmed that it was under no legal obligation to produce such a document.
64. The Authority concluded that it had no legal obligation to publish respondents’ identities, provided it met the statutory requirement to publish all responses, to ensure that the varied opinions of the community were properly and fully represented (a requirement which, it believed, it had met in this case).
65. The Authority believed that disclosure of the respondents’ identities would be of no benefit to the consultation, or to the community where Common Good matters continued to be contentious, given this might cause distress or lead to individuals being reluctant to voice their opinion in the future, and potentially stifle open and transparent debate about community matters.
66. In the Authority’s view, its obligations to protect the personal information of individuals outweighed the Applicant’s legitimate interest in knowing the identities and addresses of the respondents.

The Commissioner’s views

67. The Commissioner has considered the harm or distress that might be caused by disclosure.  He notes that disclosure of any information under FOISA – although in response to a request made by a specific applicant – effectively places that information into the public domain.  As such, in doing so, he must also consider the effects of publicly disclosing any personal data under FOISA.
68. The Commissioner has considered the relevant submissions from both parties, together with the remaining withheld personal data.  He recognises that it identifies the individuals concerned, corresponding with their individual personal views on the consultation.
69. The Commissioner has considered what reasonable expectations these individuals would have in relation to the disclosure of their personal data in response to the request under consideration here.  He has taken into account:

    1. the Authority’s guidance (dated February 2020) advising that respondents may be identified by name and that no other personal information will be included which, the Commissioner acknowledges, does not confirm that respondents’ identities will be made publicly available when publishing responses;

    2. the guidance issued by the Authority accompanying the consultation in question which, the Commissioner notes, did not include any confirmation that respondents’ identities would be published along with their responses;

    3. the Scottish Government guidance on the disposal/change of use of Common Good property advising that the final response(s) should then be published online alongside the original representation(s) which, again the Commissioner notes, does not recommend publication of respondents’ identities, and

    4. section 104 of the CEA, in which the Commissioner can see nothing requiring the publication of respondents’ identities.

70. In the Commissioner’s view, none of these would have led to the data subjects having any reasonable expectation that their personal data, as contained in the withheld information, would be published, or disclosed in response to an information request under FOISA.  He accepts, therefore, that the individual respondents would have a reasonable expectation that their personal data would remain confidential.

Balance of legitimate interests

71. The Commissioner has carefully balanced the legitimate interests of the data subjects against that of the Applicant.  He has concluded that the Applicant’s legitimate interest in the remaining personal data is overridden by the interests or fundamental rights and freedoms of the data subjects and that the requirements of condition (f) cannot be met here.  In the absence of a condition which would permit disclosure of the remaining withheld personal data, the Commissioner must conclude that disclosure would be unlawful.
72. Given that the Commissioner has concluded that the processing of the remaining third party personal data would be unlawful, he is not required to go on to consider whether disclosure of that personal data would otherwise be fair.

Conclusion on the data protection principles

73. The Commissioner finds that disclosure of the remaining third party personal data under consideration here would breach the first data protection principle and that this information is therefore exempt from disclosure (and was properly withheld) under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that, by correctly withholding some information under section 38(1)(b) of FOISA, the Authority complied with Part 1.

However, he also finds that the Authority failed to comply with Part 1 by wrongly withholding some other information under section 38(1)(b) of FOISA.

The Commissioner therefore requires the Authority to disclose to the Applicant the information which he has found to have been wrongly withheld, by 14 November 2025.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch 

Head of Enforcement

30 September 2025