Decision 240/2025:  Private sector leasing – information on 10 sample homes

Authority:  City of Edinburgh Council
Case Ref:  202201323
 

Summary

The Applicant asked the Authority for information about residential leases – specifically all records for 10 sample homes, including the leases signed with the owners and information about the tenancies over the last 10 years.  The Authority disclosed some information and withheld the remainder on the basis that it was either commercially confidential, or was third party personal data.

The Commissioner investigated and found that, while the Authority was entitled to withhold the third party personal data, it had wrongly withheld the information identified as being commercially sensitive.  He also found that the Authority had failed to identify all information relevant to the request, that its review outcome was not FOI-compliant and that, in failing to seek clarification, it had failed to comply with the duty in FOISA to advise and assist.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002[1] (FOISA) sections 1(1), (2), (4) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 15 (Duty to provide advice and assistance); 21(4) and (5) (Review by Scottish public authority); 33(1)(b) (Commercial interests and the economy); 38(1)(b), (2A), (5) (definitions of “the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation[2] (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions); 5(1)(a) (Principles relating to the processing of personal data); 6(1)(f) (Lawfulness of processing).

Data Protection Act 2018[3] (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data).

Background

1. On 9 September 2022, the Applicant made a request for information to the Authority.  He referred to the Authority’s response to an earlier request he had made for information about private residential leases, where the Authority had refused to provide that information on the basis that it would be too costly to do so.
2. For context, in that previous request, the Applicant had asked the Authority for all residential leases involving the Authority since 2015, including the Private Sector Leasing (PSL) Scheme, and the leases organised under contract with Link Group.  He had asked the Authority to include both leases in which it paid private landlords, and leases in which the same homes were then rented out to residents.  He had also asked for the rents every year for each home along with (1) a unique property identifier, (2) the year, (3) the monthly rent paid to the private owner, (4) the monthly rent paid by the resident, and (5) the number of bedrooms of the home.  The Applicant had also asked the Authority to exclude addresses and personally identifying information.
3. In his new request of 9 September 2022 (under consideration here), the Applicant asked the Authority for all of the records for 10 sample homes (including the leases signed with the owners and information about the tenancies over the last 10 years) so that he could see for himself, which would give him a qualitative view of how these homes worked.
4. The Authority responded on 18 October 2022.  It apologised for the delay in responding and made available some of the information requested on its disclosure log.  It explained that Curb (previously Link PSL) were the current contractors for the PSL scheme and had been since 2010, that there was a standard Head Lease between the Authority and landlords, and that it entered into a Short Scottish Secure Tenancy (SSST) with the tenant, so the agreements would all be similar.
5. The Authority stated that information on property addresses, rent and management fees had been redacted from the information disclosed, under the exemptions in section 33(1)(b) and section 38(1)(b) of FOISA:

   • For section 33(1)(b), the Authority explained that the information contained sensitive commercial information (such as the management fee) relating to an ongoing contract, which could not be released as the disclosure of information relating to the contract would prejudice the commercial interests of both the provider and the Authority.  The Authority recognised the public interest in promoting transparency and accountability, but believed that this was outweighed by the harm that would be caused, through disclosure of the information, to the Authority (i.e. in seeking to obtain best value for the citizens of Edinburgh) and the provider.

   • For section 38(1)(b), the Authority stated that property addresses and rent details had been withheld as this comprised third party personal data, disclosure of which would breach the first data protection principle.  It believed that disclosure would be unfair and unlawful as tenants would not expect their financial or tenancy arrangements to be released into the public domain in response to an information request.

6. On 18 October 2022, the Applicant wrote to the Authority requesting a review of its decision.  The Applicant stated that he was dissatisfied with the decision for the following reasons:

   1. On tenant privacy, he questioned why publishing the rent would violate a data protection principle.  He argued that, since the information was completely anonymised, it was not personal information.

   2. On commercial confidentiality, he queried how disclosing tenant rents would expose commercially sensitive information, arguing that it would not reveal anything about the provider’s revenue, costs or profits, only the (anonymised) lessors’ revenues.

   3. Given he had asked for all information held by the Authority, he asked whether it held any further information about these tenancies and leases, for example bank records or financial records.  He believed that, if the Authority could not publish this information for some reason, it ought to be able to disclose the kind of information it held.

7. The Authority notified the Applicant of the outcome of its review on 15 November 2022, fully upholding its original decision, and responding to the points raised by the Applicant:

   1. Maintaining its reasons for relying on section 38(1)(b), the Authority stated that personal data could also be information which “relates to” an individual(s), and information which has had identifiers removed or replaced in order to pseudonymise the data was still personal data for the purposes of the UK GDPR.  The Authority stated it would therefore regard public release of this information as unfair processing of information relating to individuals.

   2. Rents were presently set at 70%-80% of market rates; however, Housing Benefit was only recoverable at 90% of the applicable LHA [Local Housing Allowance] rate set in January 2011, so a significant portion of rent was subsidised and therefore disclosure of any rent charged would not provide an accurate reflection.  Given the market itself dictated rent, the Authority’s concerns stemmed from the risk of rents being artificially raised by landlords should they become aware that it paid ‘X’ amount and subsidised rents.  Any artificial rise in rents would be significantly detrimental to the Authority’s ability to provide housing and would expose it to increased financial risk.

   3. Bank records of landlords and tenants were confidential.  Curb published its annual accounts as part of the Link group (available online) and held details of repairs to properties but, as some repairs may have been carried out by landlords themselves, it would likely not hold full details of all work undertaken.  Curb also held information on inventories of furniture provided in properties, complaints and resolutions, annual gas safety certificates, PAT testing, periodic electrical installation checks etc..

8. On 19 November 2022, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he disagreed that his request involved personal or commercially sensitive information, arguing that the public interest lay in its disclosure.  He also believed that the Authority held other records that could be disclosed.

Investigation

9. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
10. On 19 December 2022, and in line with section 49(3)(a) of FOISA, the Commissioner gave the Authority notice in writing of the application and invited its comments.
11. The Authority was also asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the withheld information to the Commissioner, and the case was subsequently allocated to an investigating officer.
12. As the Authority had failed to provide the initial comments requested, it was again invited to comment on this application and to answer specific questions.  These focused on the Authority’s justification for withholding the information requested under the exemptions in section 33(1)(b) and section 38(1)(b), including consideration of the public interest where necessary, and on the Authority’s interpretation of the request, including whether it held any further information relevant to the request.
13. The Applicant was also invited to provide any comments he wished to make on the public interest in obtaining the information withheld under section 33(1)(b), and on his legitimate interests in accessing any third party personal information withheld under section 38(1)(b).
14. The Authority provided submissions to the Commissioner, but no further comments were received from the Applicant.

Commissioner’s analysis and findings

15. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

The Authority’s interpretation of the request and the information held by the Authority

16. In terms of section 1(4) of FOISA, the information to be provided in response to a request under section 1(1) is that falling within the scope of the request and held by the authority at the time the request is received.
17. The standard of proof to determine whether a Scottish public authority holds information is the civil standard of the balance of probabilities.  In determining where the balance of probabilities lies, the Commissioner considers the scope, quality, thoroughness and results of the searches carried out by the public authority.  He also considers, where appropriate, any reason offered by the public authority to explain why it does not hold the information.  While it may be relevant as part of this exercise to explore expectations about what information the authority should hold, ultimately the Commissioner's role is to determine what relevant recorded information is (or was, at the time the request was received) actually held by the public authority.

The Applicant’s submissions

18. The Commissioner has taken account of the arguments in the Applicant’s requirement for review, in which he contended that the Authority held further information falling within the scope of his request.
19. In his application to the Commissioner, the Applicant referred to a previous statement by the Authority in which it claimed that all records were held in a decentralised format that could not be queried in an automated way (which, the Applicant believed, was false).  In his view, while some records may be held in this way, he believed that other records, such as banking records or financial records, were held in a centralised fashion that could be accessed in an automated way.  The Applicant argued that if these records were truly anonymised, they were not protected personal information, and that the Authority must disclose the type of information it held, identify which of this might be personally identifying and disclose the remainder.

The Authority’s submissions

20. In light of the information sought by the Applicant in his previous request (from which the request under consideration here followed on), and the additional information relating to the 10 sample homes sought in his new request, the Authority was asked to explain how it had determined what information actually fell within the scope of this request.
21. The Authority took the view that in this request, which followed the previous request, the Applicant sought to refine the scope of the volume of information asked for in the previous request.  The Authority submitted that the Applicant had limited this from a full date range to 10 sample document sets.  The type of documents had already been defined in the previous request and, from the communication exchanges with the Applicant, the Authority’s understanding was that, in line with the advice given, he had refined the scope of his original request with respect to volume only.
22. The Authority was asked to explain what consideration it had given to seeking clarification of the request.
23. The Authority took the view that, as this request was a refinement of the original request, there was no requirement to seek clarification, as it was well established in the previous request what document sets the Applicant sought to receive.
24. With reference to the types of additional information listed in its review outcome as being held by the Authority, it was asked to explain why it had failed to make any of that information available to the Applicant or withhold it under an exemption in FOISA.
25. The Authority submitted that unfortunately, the reviewing officer had not maintained centrally-held records in line with its internal policy and processes for handing requests and, as that individual was no longer employed by the Authority, it was unable to scrutinise the reviewing officer’s decision-making.  The Authority confirmed, however, that an exemption had not been applied to that information withheld as part of the review.

The Commissioner’s view on the Authority’s interpretation of the request

26. Section 15(1) of FOISA requires a Scottish public authority, so far as is reasonable to expect it to do so, to provide advice or assistance to a person who proposes to make, or has made, a request for information to it. Section 15(2) states that a Scottish public authority which, in relation to the provision of advice or assistance in any case, conforms with the code of practice issued under section 60 [the Scottish Ministers' Code of Practice on the discharge of functions by Scottish public authorities under FOISA and the Environmental Information (Scotland) Regulations 2004[4]] is, as respects that case, to be taken to have complied with the duty to provide reasonable advice and assistance.

27. The Section 60 Code states, at section 5.1 in Part 2 (under “Authorities should offer advice at all stages of a request”):

    “Authorities have a duty to provide advice and assistance at all stages of a request.  It can be given either before a request is made, or to clarify what information an applicant wants after a request has been made, whilst the authority is handling the request, or after it has responded.” (Paragraph 5.1.1)

28. It further states, in section 5.3 in Part 2 (under “Authorities must provide appropriate advice and assistance to enable applicants to describe clearly the information they require”):

    • “…The authority must provide appropriate advice and assistance to enable an applicant to make their request in a way which will describe the information they want reasonably clearly.  The authority should remember that applicants cannot reasonably be expected to always possess identifiers such as file reference numbers or the description of a particular record.  Applicants should not be expected to always have the technical knowledge or terminology to identify the information they seek.” (Paragraph 5.3.1)

    • “If an authority is unclear about what information the applicant wants, it should obtain clarification by performing its duty to provide reasonable advice and assistance to the applicant.  Where a request is not reasonably clear, advice and assistance could include: providing an outline of the different kinds of information which might meet the terms of the request; providing access to detailed catalogues and indexes, where available, to help the applicant ascertain the nature and extent of the information held by the authority; providing a general response to the request setting out options for further information which could be provided on request; contacting the applicant to discuss what information the applicant wants.” (Paragraph 5.3.3)

    • “The aim of providing advice and assistance is to give the applicant an opportunity to discuss their application with the authority, with the aim of helping the applicant describe the information being sought reasonably clearly, so that the authority is able to identify and locate it.” (Paragraph 5.3.4)

29. The Commissioner notes the Authority’s position is that it interpreted this request to be a refining of the previous request, i.e. seeking the same information as asked for in that previous request but for 10 sample homes only.  However, looking at the wording of the Applicant’s request under consideration here, the Commissioner considers that the Authority appears to have ignored the parts of the new request that also asked for “all records” and “information about the tenancies”, and that it failed to seek any clarification on this.  Furthermore, the previous request also asked for information about the number of bedrooms for each home which, again, the Authority appears to have completely overlooked.
30. In the Commissioner’s view, the Authority ought to have clarified, from the outset, exactly what information the Applicant was expecting to receive, as the terms “all records” and “information about the tenancies” appear, to the Commissioner, to be much wider than the information (or “document sets” as described by the Authority) asked for in the previous request.  The Commissioner questions how, without seeking and obtaining clarification, the Authority was able to determine exactly what additional information fell within the scope of this request.
31. The Commissioner must therefore conclude that, by failing to seek clarification of the Applicant’s request, the Authority failed to comply with the duty in section 15(1) of FOISA to provide advice and assistance.

The Commissioner’s view on the information held by the Authority

32. The Commissioner accepts that the information gathered by the Authority for this request largely satisfies what the Applicant asked for in his previous request in that it includes some form of property identifier, the monthly rent paid to the owner, the monthly rent paid by the tenant and the date these monthly rates applied from.  However, he notes that it does not include the number of bedrooms for each home.
33. As rehearsed above, it is clear to the Commissioner that, in asking for “all records” and “information about the tenancies”, the Applicant was seeking further information. This is also evidenced by the fact that, in his request for review, the Applicant raised the question of whether any further relevant information was held by the Authority.  In the Commissioner’s view, the Authority clearly holds further information, as evidenced by its review response in which it listed certain types of additional information held.  However, the Authority neither disclosed that additional information, nor withheld it under an exemption in FOISA.  Furthermore, the Authority failed to consider any information held relating to the number of bedrooms in each home (as asked for in the previous request).
34. The Commissioner cannot, therefore, be satisfied as to the extent of the further information held by the Authority falling within the scope of this request.  This is not clear from the Authority’s handling of the request or the request for review.
35. In light of the above, the Commissioner must conclude that by, failing to identify and consider all relevant information falling within the scope of this request, the Authority failed to comply with section 1(1) of FOISA.
36. The notice requirements set out in section 21(4) and (5) of FOISA provide that an authority’s review outcome must inform the requester of what steps it has taken (i.e. confirm its original decision; substitute a different decision, or reach a decision where no decision has been reached) (section 21(4)), and why it has taken these steps (section 21(5)).
37. By not considering, as a minimum, the additional information held by the Authority as listed in its review outcome, and by failing to confirm its decision with regard to the disclosure of that information (i.e. by either disclosing it or withholding it under any provision or exemption in FOISA), the Commissioner must also find that the Authority‘s review outcome was not fully compliant with sections 21(4) and (5) of FOISA.

Action required by the Authority – Interpretation of request and the information held

38. The Commissioner therefore requires the Authority to engage with the Applicant with a view to seeking and obtaining full clarification of the additional information requested, to undertake the necessary searches for that additional information and to carry out a fresh review and issue a revised review outcome to the Applicant in respect of that additional information (to also include consideration of information relating to the number of bedrooms asked for in the previous request, given this was not addressed in the Authority’s review outcome).
39. The Commissioner will now go on to consider the application of the exemptions in section 33(1)(b) and section 38(1)(b) which the Authority had applied, in its review outcome, to certain of the information it had identified and considered at review stage.

Section 38(1)(b) – Personal information

40. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is "personal data" (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
41. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
42. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.
43. As rehearsed previously, in his previous request, the Applicant explicitly stated that he did not wish to receive addresses or any personally identifying information. As this condition was not included in the Applicant’s new request, the Commissioner considers it prudent to consider the Authority’s reliance on section 38(1)(b) to withhold third party personal data in the information identified and considered at review stage.

Is the withheld information personal data?

44. The first question that the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018, i.e. any information relating to an identified or identifiable individual.  "Identifiable living individual" is defined in section 3(3) of the DPA 2018.  (This definition reflects the definition of personal data in Article 4(1) of the UK GDPR.)
45. In his application to the Commissioner, the Applicant argued that there was a misunderstanding of the GDPR regulations and the DPA 2018. He contended that anonymised data was not personal information and was therefore not regulated.  The question was whether removing names and addresses would make the data truly anonymous.
46. The Applicant submitted that, in the absence of a plausible threat to anonymity, the personal [data] exemption was not applicable and information which could identify individuals would only be personal data if it related to those individuals.
47. The Authority was asked to explain its statement, in its review outcome, that “information which has had identifiers removed or replaced in order to pseudonymise the data is still personal data for the purposes of UK GDPR”, i.e. specifically why the Authority believed that information, which was no longer capable of identifying an individual (i.e. through anonymisation or pseudonymisation), could still be considered to be personal data.
48. In response, the Authority stated that the reviewing officer’s interpretation of data protection matters was incorrect.  The personal data within these documents had become anonymised rather than pseudonymised, as there was no key that may allow the data subject to be identified through another means.
49. In its submissions to the Commissioner, the Authority stated that the information included the names, addresses and signatures of landlords, witnesses and council officers. As this information would allow the reasonable identification of an individual, the Authority considered it met the criteria of being personal data.
50. The Authority further stated that the information also comprised property addresses. It recognised that, while an address without a corresponding occupant was not personal data, these properties were used to accommodate vulnerable individuals including, for example, those who may have fled domestic violence.  Therefore, the Authority considered that information to be sensitive and that additional precautions should be taken to ensure its security.
51. Information will "relate to" a person if it is about them, is linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.  It is clear that the information withheld in this case (i.e. names, addresses and signatures of owners, tenants and council officers along with property addresses) "relates to" identifiable living individuals.
52. Having considered the withheld information, the Commissioner therefore concludes that the information withheld is personal data, for the purposes of section 3(2) of the DPA 2018.

Which of the data protection principles would be contravened by disclosure?

53. The Authority stated that disclosure of this personal data would contravene the first data protection principle (Article 5(1)(a)).  Article 5(1)(a) of the UK GDPR states that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
54. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of FOISA, personal data is processed when it is disclosed in response to a request.
55. The Commissioner must now consider if disclosure of the personal data would be lawful (Article 5(1)(a)).  In considering lawfulness, he must consider whether any of the conditions in Article 6 of the UK GDPR would allow the data to be disclosed.  The Commissioner considers condition (f) in Article 6(1) to be the only one which could potentially apply in the circumstances of this case.

Condition (f): legitimate interests

56. Condition (f) states that the processing will be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (in particular where the data subject is a child).
57. Although Article 6 states that this condition cannot apply to processing carried out by a public authority in the performance of their tasks, section 38(5A) of FOISA makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests under FOISA.
58. The tests which must be fulfilled before Article 6(1)(f) can be relied upon as a lawful condition of processing are as follows:

    1. Does the Applicant have a legitimate interest in obtaining the personal data?

    2. If so, would the disclosure of the personal data be necessary to achieve that legitimate interest?

    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects?

Does the Applicant have a legitimate interest in obtaining the personal data and is disclosure of the personal data necessary?

59. The Authority submitted that it did not consider the Applicant to have a legitimate interest in obtaining this information, and that it had not sought to confirm whether he had a legitimate interest.
60. It considered, however, that the data subjects would have no reasonable expectations that their personal data, relating to the arrangements of a tenancy, would be publicly disclosed, as the information was provided with an implicit presumption of confidentiality, given the type of arrangements being entered into.
61. As stated above, in his previous request, the Applicant did not ask for any personal information, rather he asked for a “unique property identifier”, and had stated that he did not wish to receive addresses or any personally identifying information.  While the Applicant did not specifically replicate this condition in his new request, a number of the points raised in his application to the Commissioner concerned the anonymisation of the personal data present in the information being withheld.
62. The Authority was asked why it considered that, with redaction of the information deemed to be personal data, the disclosure of the remaining information would be harmful. In response, the Authority agreed that redaction of the personal data would mitigate any harm against these individuals (the data subjects), although it maintained that the harm described in point 2 of its review outcome [relating to commercial confidentiality] would occur if the remaining information was disclosed.
63. In the Commissioner’s view, it is clear that the Applicant appears to be arguing to have at least some of the information requested disclosed to him in an anonymised way.  Given this, the Commissioner is unable to identify any legitimate interest in the Applicant having access to the personal data being withheld. i.e. the names and details of the owners, tenants or council officers, or the property addresses.
64. Having found that the Applicant does not have a legitimate interest in the personal information withheld, the Commissioner finds that condition (f) in Article 6(1) of the UK GDPR cannot be met and that disclosure of the information in question would be unlawful.
65. Given that the Commissioner has concluded that the processing of the personal data would be unlawful, he is not required to go on to consider whether disclosure of the personal data would otherwise be fair and transparent in relation to the data subjects.
66. The Commissioner must therefore conclude, in the absence of a condition in Article 6 of the UK GDPR which would allow the data to be disclosed, that disclosure would be unlawful.  The personal data is therefore exempt from disclosure under section 38(1)(b) of FOISA.

Section 33(1)(b) – Commercial interests and the economy

67. Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
68. There are a number of elements an authority needs to demonstrate are present when relying on this exemption.  In particular, it needs to establish:

    1. whose commercial interests would (or would be likely to) be harmed by disclosure,

    2. the nature of those commercial interests and

    3. how those interests would (or would be likely to) be prejudiced substantially by disclosure.

69. The prejudice must be substantial, in other words of real and demonstrable significance.  Where the authority considers that the commercial interests of a third party would (or would be likely to) be harmed, it must make this clear.  Generally, while the final decision on disclosure will always be one for the authority, it will assist matters if the third party has been consulted on the elements referred to above.

The Applicant’s submissions – section 33(1)(b)

70. In his application to the Commissioner, the Applicant believed that the Authority’s logic was incoherent.  He questioned, if the market dictated rent (as claimed by the Authority), how the disclosure of rents paid by the Authority would lead to an artificial rise in rents demanded from landlords.  He believed it was reasonable to assume that rental accommodation was a competitive market and so landlords were in no position to negotiate anything above the competitive market rent.
71. On the other hand, the Applicant submitted, an alternative assumption was that the Authority had oligopsony market power, and could artificially decrease market rents by rationing landlord access to its PSL programme.  In such a case, he argued, it would be the Authority’s market power, not its (supposedly) commercially sensitive information that would determine how much it could suppress market rents.  More importantly, he stated, the PSL programme only involved about 1,500 homes out of about 240,000 homes in Edinburgh and the Authority was simply not a big enough player to manipulate market rents.  He therefore argued that these details were not commercially sensitive and not exempt from disclosure.
72. In the Applicant’s view, the general principal was that disclosing market data could only cause significant harm in the context of market power, where prices were determined by negotiation rather than competition.

The Authority’s submissions – section 33(1)(b)

73. In its submissions to the Commissioner, the Authority confirmed that it wished to maintain reliance on section 33(1)(b) to withhold certain of the information requested, i.e. the monthly and total rent values.

Commercial interests

74. “Commercial interests” are not defined in FOISA, but the Commissioner’s guidance on the exemption in section 33(1)(b)[5] states that an organisation’s commercial interests will usually relate to the commercial trading activity they undertake.
75. The Authority submitted that the sole party whose commercial interests were of concern was the Authority itself.  It explained that it leased properties on an individual basis and did not want lease rates paid to landlords to become common knowledge, as this allowed it to achieve best value when leasing properties as landlords could not compare lease rates provided to other landlords.
76. Having considered the Authority’s submissions on this point, the Commissioner is satisfied that the Authority has identified commercial interests, relating to the Authority, for the purposes of the exemption in section 33(1)(b) of FOISA, which might be adversely impacted should disclosure affect its ability to achieve best value in leasing properties.  The Commissioner recognises that the Authority must be able to freely enter into lease arrangements with third party providers, where disclosure of the rental values for the corresponding properties may be commercially sensitive.
77. The Commissioner must now go on to consider whether the commercial interests identified by the Authority would, or would be likely to, be prejudiced substantially by disclosure of the information.

How would disclosure prejudice these commercial interests substantially?

78. The Authority explained that disclosure of the lease rates would allow landlords to compare these rates.  It submitted that, if landlords were able to freely compare rates negotiated with other landlords, this would interfere with the Authority’s ability to achieve best value as landlords would seek to obtain a rate that matched other landlords or would refuse to engage with the Authority.  This, the Authority submitted, would impact its ability to lease residential property.
79. The Authority provided the Commissioner with a copy of the “Terms and Conditions for Services – Private Sector Leasing – Ref CT2628” which (at paragraph 28.1) evidenced the requirement on all parties to keep confidential all confidential information of the other party, and to use reasonable endeavours to prevent their representatives from making any disclosure to any person of any of the other party’s confidential information, subject to specified exceptions, including the Authority’s obligations under FOI law.
80. The Authority was asked to explain, in the event that any personal information present in the information identified and considered at review stage was redacted (i.e. the names and details of owners, tenants and council officers, along with the property addresses) and so the remaining information could not be attributed to any individual property, why the Authority considered that disclosure of the rental values, unlinked to any other details regarding any particular property, other than dates, would lead to the harm claimed by the Authority.

81. In response, and as rehearsed previously, while the Authority agreed that redaction of the personal data would mitigate any harm against the individual data subjects, it maintained that the harm described in point 2 of its review outcome would occur if the remaining information was disclosed, i.e.:

    “The Service has noted that at the present time rents are set at 70% - 80% of market rates, however Housing Benefit is only recoverable at 90% of the applicable LHA rate set in January 2011, and so a significant portion of rent is subsidised, therefore disclosure of any rent charged would not provide an accurate reflection.  Given the market itself dictates rent, [the Authority’s] concerns stem from the risk of rents being artificially raised by Landlords should they become aware [the Authority] will pay ‘X’ amount and subsidise rents.  Any artificial rise in rents would have a significantly detrimental impact on [the Authority’s ability] to provide housing and expose [the Authority] to increased financial risk.”

The Commissioner's view – section 33(1)(b)

82. The Commissioner has considered the submissions from both parties, along with the withheld information identified and considered at review stage.
83. As set out above, the Commissioner has already found that certain information (i.e. the names and details of owners, tenants and council officers, along with the property addresses) had been correctly withheld as personal data under section 38(1)(b) of FOISA.  In light of this, the Commissioner is struggling to see how the disclosure of the remaining rental values (withheld under section 33(1)(b)), unlinked to any other details relating to the corresponding properties, other than dates, would lead to the harm claimed by the Authority.
84. In the Commissioner’s view, the Authority’s arguments about being less able to achieve best value, or lease residential property, are somewhat overstretched for this remaining information in isolation.  That said, the Commissioner does recognise that these arguments would likely carry more weight were it possible to link the rent with the corresponding property; however, this is not the case here.
85. The Commissioner therefore concludes that the information on rental amounts, in isolation of any other link to a particular property other than dates, is capable of being safely disclosed, and has been wrongly withheld by the Authority under section 33(1)(b) of FOISA.
86. As the Commissioner has found that section 33(1)(b) has been wrongly applied to this information, he is not required to go on to consider the public interest in regulation 2(1)(b) of FOISA.
87. The Commissioner therefore requires the Authority to disclose this information (i.e. the monthly and total rental values) to the Applicant.

Decision

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.

The Commissioner finds that, by withholding the personal data identified and considered at review stage under section 38(1)(b) of FOISA, the Authority complied with Part 1.

However, the Commissioner also finds that the Authority failed to comply with Part 1 in the following respects:

• By failing to seek clarification of the Applicant’s request, the Authority failed to comply with the duty in section 15 of FOISA to provide advice and assistance.

• By failing to identify and consider all relevant information falling within the scope of this request, the Authority failed to comply with section 1(1) of FOISA.

• By not considering, as a minimum, the additional information held by the Authority as listed in its review outcome, and by failing to confirm its decision with regard to the disclosure of that information (i.e. by either disclosing it or withholding it under any provision or exemption in FOISA), the Authority‘s review outcome was not fully compliant with sections 21(4) and (5) of FOISA.

• By withholding the information on rental amounts under section 33(1)(b), in isolation of any other link to a particular property other than dates, the Authority failed to comply with section 1(1) of FOISA.

The Commissioner therefore requires the Authority to 

• engage with the Applicant with a view to seeking and obtaining full clarification of the additional information requested, to undertake the necessary searches for that additional information and to carry out a fresh review and issue a revised review outcome to the Applicant in respect of that additional information (to also include consideration of information relating to the number of bedrooms asked for in the previous request, given this was not addressed in the Authority’s review outcome), and

• disclose to the Applicant the information found to have been wrongly withheld under section 33(1)(b) of FOISA (i.e. monthly and total rent amounts).

He requires the Authority to take these steps by 17 November 2025.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

Euan McCulloch

Head of Enforcement

1 October 2025