Home Decisions

Decision 237/2026

Decision 237/2026:  Inclusion of Hacking and Paterson on the Property Factors Register

Authority:  Scottish Ministers
Case Ref:  202501126
 

Summary

The Applicant asked the Authority for information about a property management company’s alleged failure to comply with a Property Factor Enforcement Order, and about its inclusion in the Property Factors Register.  The Authority withheld the information requested on the basis that some of it was third party personal data, disclosure of which would breach data protection principles, and that disclosure of the remainder would prejudice the effective conduct of public affairs.

The Commissioner investigated and found that the Authority had correctly withheld the majority of the information requested.  However, he also found that the Authority had wrongly withheld some information which was not third party personal data, which he required the Authority to disclose to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(b) and (2)(e)(ii) (Effect of exemptions); 30(c) (Prejudice to effective conduct of public affairs); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

  1. On 24 April 2025, the Applicant made a six-part request for information to the Authority, relating to a Decision by the First-tier Tribunal for Scotland (Housing and Property Chamber) concerning a property factor’s failure to comply with a Property Factor Enforcement Order (PFEO).  The request included the following parts:
    1. “Request to publish all communications, evidence and reasoning by [the Authority] and [the Authority’s] staff, including the Property Factors Register team, in relation to the failure of Hacking and Paterson to comply with a PFEO in September 2024 in relation to case FTS/HPC/PF/23/3408.  The Property Factors Act makes it clear it is a criminal offence for any property factor to fail to comply with a PFEO and Section 8 of the Property Factors Act makes it clear that failure to comply with a PFEO is sufficient justification for [the Authority] to remove the property factor from the Property Factors Register so details must include all discussions on why [the Authority] ignored the Property Factors Act and allowed Hacking and Paterson to remain on the Property Factors Register despite committing this criminal offence.  All legal guidance sought prior to making this decision must also be provided.” [Part 1 of request.]
    2. “Publish the evidence, justification and reasoning behind the removal of the named individuals from the Property Factors Register website.  The named individuals were visible on the Property Factors Register prior to the new website design around September 2024.  If this was just an oversight as part of the new website design then please explain how these vital details were omitted and confirm that these important details will be re-instated to the Property Factors Register so the public have full transparency over who the named individuals are.  Their names are published on Companies House website so there’s no GDPR [General Data Protection Regulation] or Data Protection issue about publishing the names of the named individuals on the Property Factors Register.”  [Part 6 of request.]
  2. Only parts 1 and 6 of the Applicant’s request (as set out in the preceding paragraph) are under consideration here.  The remaining parts of the request do not form part of the Applicant’s application to the Commissioner.
  3. The Authority responded on 22 May 2025 as follows:
    1. For part 1 of the request, the Authority disclosed some information.  It withheld some information on the basis that disclosure would prejudice substantially the effective conduct of public affairs, where the public interest favoured non-disclosure.  It also withheld some other information on the basis that it was third party personal data.
    2. For part 6 of the request, the Authority disclosed some information and withheld some other information on the basis that it was third party personal data.
  4. On 28 May 2025, the Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that he was dissatisfied with the decision as follows:
    1. For part 1 of the request, the Applicant disagreed with the exemptions applied by the Authority to withhold some of the information requested.  He asked for the withheld information to be disclosed.
    2. For part 6 of the request, the Applicant argued that the Authority’s response did not address the evidence, justification and reasoning behind the removal of the named individuals from the Property Factors Registration website. He believed it was essential for the public to have visibility of those individuals who were responsible for the company.  He asked for this information to be disclosed.

  5. The Authority notified the Applicant of the outcome of its review on 25 June 2025, fully upholding its original decision for parts 1 and 6 of the request with further context.

    1. For part 1 of the request, the Authority explained that it was essential for it to be able to hold open, honest and often confidential discussions with external stakeholders (e.g. property factors) on a range of issues, including reasons for any alleged non-compliance with PFEOs and any steps taken by the property factor to address these.  It argued that disclosure of views would lead to property factors being less likely to provide frank and detailed communications, which would significantly impact the Authority’s ability to make fully informed decisions, thus substantially prejudicing the effective conduct of public affairs (section 30(c) of FOISA).

    The Authority believed that the public interest in open, transparent and accountable government, and to inform public debate, was outweighed by the need to have a private space to hold such discussions and reach fully informed decisions.  In its view, premature disclosure would therefore likely inhibit these discussions, thereby undermining the exercise of functions under the Property Factors (Scotland) Act 2011 (the PFA) which, the Authority argued, was not in the public interest.

    The Authority also explained that section 38(1)(b) of FOISA applied to a small amount of personal data which comprised the names / contact details of more junior officials and third parties, disclosure of which would breach data protection principles.

    1. For part 6 of the request, the Authority was satisfied that all appropriate searches for relevant information had been carried out, and that section 38(1)(b) had been applied appropriately.
  6. On 11 July 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he disagreed with the exemptions applied to withhold some of the information he had requested.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 28 August 2025, the Authority was notified in writing that the Applicant had made a valid application and was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information and the case was subsequently allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These focused on the Authority’s justification for withholding the information requested (variously) under section 30(c) and section 38(1)(b) of FOISA as well as its application of the public interest test (in respect of its reliance on section 30(c)).
  4. The Applicant was also invited to submit any comments he wished to make on the public interest in disclosure of the information being withheld under section 30(c), and on his legitimate interests in accessing the third party personal data being withheld under section 38(1)(b).
  5. Both parties provided submissions to the Commissioner during the investigation.

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Section 30(c) – Prejudice to effective conduct of public affairs (part 1 of request)

  1. Section 30(c) of FOISA provides that information is exempt information if its disclosure would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
  2. The word "otherwise" distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b).  This is a broad exemption, and the Commissioner expects any public authority applying it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.
  3. There is no definition of "substantial prejudice" in FOISA, but the Commissioner considers the harm in question would require to be of real and demonstrable significance.  The authority must also be able to satisfy the Commissioner that the harm would, or would be likely to, occur: therefore, the authority needs to establish a real risk or likelihood of actual harm occurring as a consequence of disclosure at some time in the near (certainly the foreseeable) future, not simply that the harm is a remote possibility.

The Applicant's submissions on section 30(c)

  1. In his application to the Commissioner, the Applicant disagreed with the Authority’s decision to withhold the information requested in part 1 of his request under section 30(c) of FOISA, in particular its argument that property factors would be less likely to provide the Authority with information in the belief that this would be made public.

The Authority's submissions on section 30(c)

  1. In its submissions to the Commissioner, the Authority explained that, under the PFA, it had a duty to prepare and maintain a publicly available register of property factors, and to set minimum standards of practice in a statutory Code of Conduct [Property Factors (Scotland) Act 2011: Code of Conduct for Property Factors] which registered property factors must comply with.  The PFA required all property factors operating in Scotland to register with the Authority, and operating unregistered (without reasonable excuse) was a criminal offence.  The Authority submitted that, by 24 November 2025, there were 367 registered property factors providing a service to 664,068 properties and 1,917 land parcels which, it argued, demonstrated a significant number of households having some involvement with a property factor (usually involving payment for its services).
  2. In light of this, the Authority submitted, it was obliged to ensure property factor registration functioned in line with legislation, to ensure that businesses operated legally and that homeowners were protected.  It was therefore critical for the Authority to obtain the necessary information, with sufficient candour and detail, to ensure it discharged those duties and that only those property factors meeting the requirements of the Act were allowed to operate in Scotland and to charge homeowners for services.
  3. The Authority considered it was essential to be able to discuss with property factors - openly, honestly and often in confidence - compliance matters and steps taken by them to address any issues or concerns.  In its view, having no space for open and honest discussion would substantially inhibit communications on such matters in future, and this would significantly harm its ability to carry out many aspects of its work and could adversely affect its ability to gather all of the advice and views required to make fully informed decisions.
  4. The Authority explained that when a property factor failed to comply with a PFEO issued by the First-tier Tribunal (FTT), it was obliged to examine that failure in the context of the property factor’s registration obligations.  By being able to understand why a requirement might not have been met and how a property factor intended to remedy the issue, this enabled the Authority to assess the likely risk to compliance.  The Authority argued that, to ensure accurate assessment and robust decision-making, it required to have the fullest and frankest information possible from the property factor.  Having a private space in which to seek information and receive honest answers from property factors enabled the Authority to discharge that responsibility.
  5. In the Authority’s view, were such discussions to be held publicly, these would likely be less frank and honest, with property factors being less willing to disclose information on their business operations or risks.  This, in turn, would compromise the Authority’s assessments and reduce its ability to register property factors and monitor compliance.
  6. As operating as an unregistered property factor was a criminal offence, the Authority further argued that, if it was less able to undertake its obligations, this would lead to an increased risk of criminal liability for businesses and customers, and to households receiving substandard services or having their factoring services removed abruptly.
  7. The Authority explained why it considered the withheld information to be sensitive.  In doing so, it explained that, at the time of responding to the Applicant’s request, the information related to a live case within its registration system, where the renewal application for this property factor was pending, and was therefore time sensitive.  In the Authority’s view, disclosure would equate to the release of incomplete information, which would lead to the property factor (and other businesses on becoming aware of such a disclosure) being unwilling to share any such sensitive information with the Authority in future, thereby prejudicing the effective conduct of public affairs.

The Commissioner's views on section 30(c)

  1. The Commissioner has considered the nature and content of the withheld information, along with the submissions from both parties.
  2. Having done so, the Commissioner recognises that disclosure of the information in question would afford transparency on matters relating to the property factor’s requirement to comply with the PFEO.
  3. The Commissioner notes that, at the time of the Authority’s response to the request, the renewal application for this property factor was pending and therefore the information concerned a live case within the Authority’s registration system.  He accepts that the disclosure of incomplete information would prejudice the Authority’s ability to effectively conduct its public affairs in this regard.
  4. The Commissioner also concurs with the Authority’s view that that there needs to be a private space in which it can thoroughly investigate precisely why a property factor has failed to comply with a PFEO and the steps taken by the property factor to remedy this, thus allowing the Authority to reach an informed conclusion on any likely risk to compliance.
  5. In the Commissioner’s view, were detailed information of this nature placed into the public domain, property factors would be inhibited from providing frank, detailed responses, which might include information that could possibly damage their reputation, or disclose operational or risk-related information. Such responses would also adversely impact the Authority’s ability to monitor compliance effectively, thereby compromising the health and safety of the public (i.e. householders), for example, by erroneously retaining property factors on the register that possibly should be removed (i.e. as a result of undetected non-compliance).
  6. Given the amount of properties across Scotland with a property factor, the Commissioner considers that the impact of this would be substantial, were property factors to be inhibited from providing frank, detailed and honest information to the Authority, in the belief that their confidential information would be disclosed in response to a request for information under FOISA.
  7. The Commissioner recognises the need for the Authority to be able to understand the position of property factors to allow it to undertake accurate assessment of any risks of non-compliance with PFEOs.  In doing so, he also recognises the importance of property factors being able to provide open and honest submissions to the Authority, without fear of wider disclosure.  The Commissioner accepts there exists a risk that property factors would likely be less willing to disclose sensitive information to the Authority should they consider such information was to be made publicly available, i.e. in response to an information request under FOISA.  The Commissioner recognises that this would impact the Authority’s ability to make robust decisions and effectively discharge its obligations under the PFA in this regard.  He also accepts that this would, consequentially, likely lead to a reduction in the quality and reliability of services provided to householders by property factors.
  8. The Commissioner is therefore satisfied that the exemption in section 30(c) is engaged for the withheld information.

Public interest test - section 30(c)

  1. Section 30(c) is subject to the public interest test required by section 2(1)(b) of FOISA.  As the Commissioner has found that the exemption in section 30(c) was correctly applied to the withheld information, he is now required to consider whether, in all the circumstances of the case, the public interest in disclosing the withheld information is outweighed by the public interest in maintaining the exemption.

The Applicant's submissions on the public interest - section 30(c)

  1. In his application to the Commissioner, the Applicant argued that the PFA required property factors to be “open, honest and transparent” and so, in his view, discussions regarding any failure to comply with the PFA and its associated Code of Conduct must be made public.  The Applicant alleged that this particular property factor had committed multiple criminal offences (failing to comply with a PFEO) and therefore the public, and the property factor’s customers, had a right to know what was happening and any consequences of its failure to comply with the PFA.  As such, he believed this information should be made public.
  2. During the investigation, the Applicant provided further background information in support of the public interest in disclosure of the information.  This included links to articles published on the websites of the Authority, the property factor in question, the UK Parliament, the Scottish Parliament and the Scottish Courts and Tribunals Service, plus media articles in local and national press.
  3. In this regard, the Applicant believed that it was clear that the issues he had raised, and the information that he had requested, stemmed from a wider problem affecting homeowners across Scotland.  He argued that the Authority’s secrecy and attempts to shut down anyone who sought information which would expose its failure to take action on such issues was not helpful and would only make matters worse.

The Authority's submissions on the public interest - section 30(c)

  1. The Authority recognised the public interest in disclosure as part of open, transparent and accountable government, and to inform public debate.  It considered that the public interest in disclosure was partly met by the existence of the FTT, which was an independent body with its own powers to acquire information from property factors and make determinations about their behaviour.  The Authority noted that the service provided by the FTT was open to all.
  2. However, the Authority believed that the public interest in disclosure was outweighed by the public interest in allowing Ministers and officials a private space within which to communicate with appropriate external stakeholders as part of the process of determining compliance with property factor registration requirements.  This, it argued, was essential to enable all options to be properly considered, to enable good decisions to be taken based on fully informed advice and evidence, and to allow it to deliver on its statutory obligations under the PFA.
  3. The Authority also considered that public disclosure of the information at this stage would lead to businesses being inhibited from sharing such sensitive information in future, and this would affect its ability to deliver its statutory obligations.  It further submitted that the disclosure of incomplete information could put at stake property factors’ reputations, their ability to operate legally and criminal liability.

The Commissioner's views on the public interest - section 30(c)

  1. The Commissioner has considered the submissions on the public interest from both parties, along with the withheld information itself.
  2. The Commissioner recognises the public interest in ensuring that property factors comply with relevant legislation and exercise good practice.  However, he notes that a process already exists where a householder can report bad practice to the independent FTT (section 17 of part 2 of the PFA) which is charged with making determinations on this (section 19) and which has the power to issue PFEOs (sections 19 and 20).
  3. The Commissioner also recognises the public interest in ensuring that any property factor that does not comply with a PFEO is dealt with appropriately.  The Authority has explained that it is obliged to investigate any non-compliance with a PFEO, as set out in its advice and guidance document Enforcement of the Property Factors (Scotland) Act 2022 published on its website.  However, ultimately it is for the FTT to decide whether a property factor has breached a PFEO (section 23(1) of the PFA).  Where the FTT decides that this is the case, it must provide the Authority with notice of that failure to comply (section 23(2) of the PFA), so the Authority can take this into account when deciding whether it is satisfied to enter a person on the register or to remove a registered property from it (sections 4 and 8 of the PFA).  This is explained in the Code of Conduct, published on the Authority’s website.
  4. In the Commissioner’s view, disclosure of the withheld information would provide transparency on the steps taken by the property factor to address the Authority’s concerns regarding its compliance with the PFEO, and would also evidence that the Authority was carrying out its obligations in a timely and responsible manner.
  5. However, the Commissioner also considers there is no public interest in the disclosure of the content of the correspondence relating to this particular investigation, which would, or would be likely to, lead to future investigations being less robust, were property factors less inclined to provide detailed, frank and honest information in any similar future investigation as a result of disclosure in this case.
  6. The Commissioner also accepts that such inhibition would lead to less accurate assessments and decisions being made by the Authority, which would have a resultant adverse impact on householders who may experience sub-standard services from property factors operating outwith the standards of the PFA.
  7. The Commissioner has already accepted that disclosure of the withheld information in question would or would be likely to cause substantial prejudice to the effective conduct of public affairs in this case.  He considers that, on balance, disclosure of the withheld information in question would not be in the public interest, as rehearsed above.
  8. In all the circumstances, therefore, the Commissioner is satisfied that the public interest in disclosure is outweighed in this case by that in maintaining the exemption and allowing the information to be withheld under section 30(c) of FOISA.  The Commissioner therefore finds that the Authority was entitled to withhold the information under section 30(c).
  9. The Commissioner would remind the Applicant that he can only consider the withholding of this information in the context of the regulatory regime for property factors as it exists.  It is not for him to comment on the efficacy of that regime.

Section 38(1)(b) – Personal information (Parts 1 and 6 of request)

  1. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
  3. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
  4. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA.

Is the withheld information personal data?

  1. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable living individual. "Identifiable living individual" is defined in section 3(3) of the DPA 2018. (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
  2. Information which could identify individuals will only be personal data if it relates to those individuals.  Information will "relate to" a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.
  3. In its submissions to the Commissioner, the Authority stated that the information withheld under section 38(1)(b) comprised job descriptions, names and telephone numbers of staff and third parties.  As those individuals could be identified from that information, the Authority considered it to be personal data as defined by section 3(2) of the DPA 2018.
  4. In his application to the Commissioner, the Applicant disagreed that the names / contact details of Authority staff or third parties comprised personal information.
  5. Having considered the withheld information along with the submissions from both parties, it is clear to the Commissioner that a small amount of this information comprises details relating to a company (namely its contact telephone number and DX details), and is information which is already available in the public domain. The Commissioner cannot accept this particular information to be personal data in terms of the definition in section 3(2) of the DPA 2018.
  6. The Commissioner must therefore find that the Authority was not entitled to withhold this particular information under section 38(1)(b) as it does not constitute personal data, in that it is not capable of identifying a living individual. As the Authority is not relying on any other exemption to withhold that information, the Commissioner requires the Authority to disclose it to the Applicant.
  7. The Commissioner considers it prudent to point out that information relating to companies, such as that referred to in the preceding paragraph, cannot be accepted as constituting personal data, as initially claimed by the Authority, unless (in certain circumstances) it relates clearly to a specific individual.
  8. For the remainder of the information being withheld as personal data which, the Commissioner notes, comprises the names, job titles and contact details of individuals, the Commissioner is satisfied that this “relates to” identifiable living individuals.
  9. The Commissioner therefore concludes that the remaining withheld information is personal data for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

  1. The Authority stated that disclosure of the personal data in this case would contravene the first data protection principle (Article 5(1)(a)).  Article 5(1)(a) states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
  2. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to a request.
  3. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

  1. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data (in particular where the data subject is a child).
  2. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
  3. The tests which must be met before Article 6(1)(f) can be met are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data?
    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data?

  1. In his application to the Commissioner, the Applicant argued that the names and contact details of Authority staff were required to be made public so that the public could contact them with any concerns or questions.  He further argued that property factors were legally required to provide the name and contact details of responsible persons for inclusion in the Property Factors Register, and that these details were published until September 2024 but had since been removed by the Authority.  In his view, this information should be in the public domain under the PFA.
  2. During the investigation, the Applicant made further submissions.  He argued that refusing to disclose communications on the basis that they might contain the names and contact details of junior staff was not a valid excuse, and this information could be redacted.
  3. The Applicant was also concerned about the involvement of junior staff in the process. He argued that only Scottish Ministers should be involved in any discussions or decisions taken on the inclusion or removal of a property factor from the Property Factors Register, as stated in the PFA and in responses to previous FOI requests.
  4. The Applicant also submitted that the PFA placed a statutory duty on the Authority to publish the application data submitted by property factors (i.e. names and contact details) on the Property Factors Register website for public viewing.  In this regard, he made reference to the information published on the Privacy Page of the Property Factors Register website which, he submitted, made clear that the personal data submitted by property factors would be used by the Authority “To be displayed as required on the public register”, and that where a property factor did not wish its personal data to be made public, it could withdraw its application to register and be removed from the register, leaving it unable to operate as a property factor in Scotland.  He further submitted that the privacy page also made clear that “Any request for information other than what is available through the public register will be considered under Freedom of Information legislation”.  As such, the Applicant argued that there was no excuse for not publishing the names of the responsible persons of property factors, given the property factors were well aware and had consented to their personal data being published when making their application to register.
  5. In its submissions to the Commissioner, the Authority stated that it was not aware of any legitimate interests the Applicant had in the names of officials, or that identifying the individuals would aid in the understanding of the withheld information.  It explained that the Applicant’s request formed part of a large body of correspondence relating to the registration of property factors, in the course of which the Applicant had made numerous accusations of staff dishonesty, incompetence, criminality and maladministration against named individuals, the team and civil servants in general.  The Authority submitted that the Applicant had explicitly stated that he would not stop until his allegations had been proven which, in the Authority’s view, amounted to a pattern of threatening and harassing behaviour.
  6. The Authority submitted that it had, on multiple occasions, provided the Applicant with information on the process by which decisions about the registration of property factors were made.  In its view, he was only feasibly requesting this information to add further elements to his harassment of staff and his continued allegations of criminality and impropriety, including specific allegations and threats against named individuals.  As such, the Authority did not consider the Applicant to have any legitimate interest in the withheld information.
  7. The Commissioner has considered the submissions from both parties. Having done so, he recognises that the Applicant may have a legitimate interest in knowing how decisions regarding property factors are considered and dealt with, and there is clearly a legitimate interest in the wider public being aware of such matters.  He accepts that disclosure of the personal data would assist in the understanding of these.  The Commissioner therefore accepts that the Applicant has a legitimate interest in the withheld information.

Is disclosure of the personal data necessary?

  1. Having accepted that the Applicant has a legitimate interest in the withheld information, the Commissioner must consider whether its disclosure is necessary for the Applicant's legitimate interests.  In doing so, he must consider whether these interests might reasonably be met by any alternative means.
  2. The Commissioner has considered this carefully in light of the decision by the Supreme Court in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.  In this case, the Supreme Court stated (at paragraph 27):

“A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim.  Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less.”

  1. "Necessary" means "reasonably" rather than "absolutely" or "strictly" necessary.  When considering whether disclosure would be necessary, public authorities should consider whether the disclosure is proportionate as a means and fairly balanced as to the aims to be achieved, or whether the requester's legitimate interests can be met by means which interfere less with the privacy of the data subject.
  2. In its submissions to the Commissioner, the Authority argued that the personal details of the individuals were not relevant to the Applicant’s issue and would add nothing further to how the matter he was concerned about had been approached.
  3. Having fully considered the withheld personal data itself, the Commissioner accepts that disclosure of the personal data would assist the Applicant in understanding which individuals were involved and the extent of their involvement (within the context of the information which the Authority has already disclosed to the Applicant).  However, he does not consider it necessary for the third party personal data to be disclosed to the Applicant to fulfil his identified legitimate interest.
  4. In all the circumstances, therefore, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met and disclosure of the information would therefore be unlawful.
  5. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent.
  6. The Commissioner is satisfied, in the absence of a condition in Article 6(1) of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful.  He finds that the personal data is therefore exempt from disclosure (and was properly withheld) under section 38(1)(b) of FOISA.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that the Authority correctly withheld the majority of the information being withheld, variously, under section 30(c) and section 38(1)(b) of FOISA, and in doing so it complied with Part 1 in this respect.

However, the Commissioner also finds that the Authority was not entitled to withhold certain information under section 38(1)(b) of FOISA, and by doing so, it failed to comply with Part 1 (specifically, section 1(1)) in this respect.

The Commissioner therefore requires the Authority to disclose to the Applicant the information he has found to have been wrongly withheld under section 38(1)(b) of FOISA by 2 November 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

Euan McCulloch 

Head of Enforcement

 

17 September 2026

  1. ^

  2. ^

  3. ^

  4. ^

  5. ^

  6. ^

  7. ^

  8. ^

  9. ^