Home Decisions

Decision 257/2026

Decision 257/2026:  Gas safety inspection reports at specified residential address


Authority: South Lanarkshire Council
Case Ref: 202501860
 

Summary

The Applicant asked the Authority for information relating to gas safety inspection reports at a specified residential address.  The Authority refused to make the information available as it considered it to be third party personal data. The Commissioner investigated and found that while the Authority had been correct to withhold some of the information requested, it had wrongly withheld other information.  He required the Authority to disclose the information it had wrongly withheld to the Applicant. 

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 39(2) (Health, safety and environment); 47(1) and (2) (Application for decision by Commissioner). 

The Environmental Information (Scotland) Regulations 2004 (the EIRs) regulations 2(1) (definition of “the Act”, “applicant”, “the Commissioner” and “environmental information”) (Interpretation); 5(1) and (2)(b) (Duty to make environmental information available on request); 11(2), (3A)(a) and (7) (Personal data); 17(1), (2)(a), (b) and (f) (Enforcement and appeal provisions). 

United Kingdom General Data Protection Regulation (the UK GDPR) Articles 5(1)(a) (Principles relating to the processing of personal data) and 6(1)(f) (Lawfulness of processing). 

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (5) and (10) (Terms relating to the processing of personal data).

Background

  1. On 17 August 2025, the Applicant made a request for information to the Authority in relation to a specified residential address.  Among other things, he asked for:
    1. “Copies of any gas safety inspection reports for the [specified residential address] carried out since 16.09.2024.” 
  2. The Authority responded on 11 September 2025.  It disclosed some information in response to other elements of the request, but it withheld the gas safety inspection report under the exemption in section 38(1)(b) of FOISA.
  3. On 12 September 2025, the Applicant wrote to the Authority requesting a review of its decision. He stated that he was dissatisfied with the decision because he considered that the exemption in section 38(1)(b) of FOISA had been wrongly applied. 
  4. The Authority notified the Applicant of the outcome of its review on 10 October 2025.  It confirmed that it should have considered the request under the EIRs and substituted its refusal under the exemption in section 38(1)(b) of FOISA with a refusal under the exception in regulation 11(2) of the EIRs. 
  5. Later the same day, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  By virtue of regulation 17 of the EIRs, Part 4 of FOISA applies to the enforcement of the EIRs as it applies to the enforcement of FOISA, subject to specified modifications.  The Applicant stated that he was dissatisfied with the outcome of the Authority’s review because he considered that the exception in regulation 11(2) of the EIRs had been wrongly applied

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 6 January 2026, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was subsequently allocated to an investigating officer. 
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions, related to its reliance on the exception in regulation 11(2) of the EIRs.  

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority. 
  2. As stated in previous decisions, in Scottish Ministers v Scottish Information Commissioner [2006] CSIH 8, at paragraph [18], the Court of Session recognised that:

"… in giving reasons for his decision, [the Commissioner] is necessarily restrained by 
the need to avoid, deliberately or accidentally, disclosing information which ought not 
to be disclosed."

  1. In this decision notice, the Commissioner has endeavoured to give as full an account of his reasoning as he can, but, by necessity, in this case the comments of the Court of Session are applicable to some aspects.

Application of the EIRs

  1. Where information falls within the scope of regulation 2(1) of the EIRs, a person has a right to access it (and the public authority has a corresponding obligation to respond) under the EIRs, subject to the various restrictions and exceptions contained in the EIRs.
  2. Having considered the terms of the request and the nature of the information requested, the Commissioner accepts the decision of the Authority to deal with the request under the EIRs rather than under FOISA. 

Regulation 5(1) of the EIRs – Duty to make environmental information available  

  1. Regulation 5(1) of the EIRs requires a Scottish public authority which holds environmental information to make it available when requested to do so by any applicant.  This obligation relates to information that is held by the authority when it receives a request.
  2. On receipt of a request for environmental information, therefore, the authority must ascertain what information it holds falling within scope of the request.  Having done so, regulation 5(1) of the EIRs requires the authority to make that information available, unless a qualification in regulations 6 to 12 applies (regulation 5(2)(b)).
  3. Under the EIRs, a public authority may refuse to make environmental information available if one of the exceptions in regulation 10 applies and, in all the circumstances of the case, the public interest in maintaining the exception or exceptions outweighs the public interest in making the information available.             

Regulation 11(2) – Personal data

  1. Regulation 10(3) of the EIRs provides that a Scottish public authority can only make personal data in environmental information available in accordance with regulation 11.
  2. Regulation 11(2) provides that personal data shall not be made available where the applicant is not the data subject and other specified conditions apply.  These include that disclosure would contravene any of the data protection principles in the UK GDPR or DPA 2018 (regulation 11(3A)(a)).
  3. The Authority submitted that the withheld information constituted personal data, disclosure of which in response to this request would breach the first data principle in Article 5(1) of the UK GDPR (“lawfulness, fairness and transparency”).

Is the withheld information personal data?

  1. The first question the Commissioner must address is whether the information is personal data.
  2. “Personal data” is defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”.
  3. Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
  4. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.  An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals.
  5. The Authority submitted that all of the information falling within the scope of the request was the third-party personal data of the tenant of the specified residential address because:
  • the inspection report requested related to the boiler of a neighbouring property;
  • information contained in this report was clearly the personal data of third parties in terms of the DPA 2018; and
  • the information related to the neighbour’s tenancy.
  1. The Authority stated that it was not just the personal identifiers of the occupier and the inspector which comprised third-party personal data; the entire certificate related to the tenant and their home and private life. 
  2. The Commissioner has carefully considered the withheld information.  Having done so, he accepts that some of the information comprises personal data.  In particular, names, contact details, job titles and other direct identifiers of living individuals.
  3. The Commissioner is satisfied that living individuals can be identified from these data and that, in the circumstances, the data relate to them.  He is therefore satisfied that this information is personal data as defined in section 3(2) of the DPA 2018.
  4. The Commissioner understands why the Authority considered that, because the request named the tenant of the residential address and the residential address itself, all of the information requested must be the personal data of the tenant.  However, as he found in Decision 157/2026 which regarded similar circumstances, the Commissioner is not satisfied that all of the withheld information is personal data as defined in section 3(2) of the DPA 2018.   
  5. In reaching this conclusion, the Commissioner has taken account of the information already provided to the Applicant by the Authority in its initial response.  In particular, that the boiler and associated accessories fitted at the specified residential address had been passed as safe to use by an independent Gas Safe registered engineer and that there were no remedial works planned and therefore no costs for any works. 
  6. The Commissioner must be careful not to reveal the specific content of the withheld information.  However, the withheld information simply records information relating to the gas safety requirements and status of a gas boiler and meter.  He also notes that the withheld information is a Landlord Gas Safety Record: it is not a report instructed by the tenant and the information therefore principally concerns the Authority’s actions as a landlord.
  7. Considering the above, including the information already provided to the Applicant (as detailed in paragraph 29), and the previous Landlord Gas Safety Record forms provided by the Authority to the Applicant, the Commissioner does not accept that the remaining information withheld as third-party personal data adds anything of biographical significance about the tenant or otherwise has the tenant as its main focus.
  8. In light of the context set out in the preceding paragraphs, the Commissioner does not accept that all of the withheld information can properly be viewed as the personal data of the tenant.
  9. In all of the circumstances, the Commissioner therefore finds that the Authority was not entitled to withhold this information under the exception in regulation 11(2) of the EIRs.
  10. In the absence of another exception being applied by the Authority to withhold this information, the Commissioner requires the Authority to disclose it to the Applicant.  He will specify to the Authority the information to be disclosed to the Applicant.
  11. The Commissioner will go on to consider whether disclosure of the information he has accepted is personal data would contravene one of the data protection principles.

Would disclosure contravene one of the data protection principles?

  1. Article 5(1)(a) of the UK GDPR requires personal data to be processed “lawfully, fairly and in a transparent manner in relation to the data subject”.  The Authority considered that disclosure of such information would contravene Article 5(1) of the UK GDPR.
  2. In terms of section 3(4) of the DPA 2018, disclosure is a form of processing.  In the case of the EIRs, personal data are processed when disclosed in response to a request.  Personal data can only be made available if making the data available would be lawful (i.e. if it would meet one of the conditions of lawful processing listed in Article 6(1) of the UK GDPR) and fair.

Lawful processing: Article 6(1)(f) of the UK GDPR

  1. The Commissioner must now consider whether disclosure of the personal data would be lawful.  In considering lawfulness, he must consider whether any of the conditions in Article 6(1) of the UK GDPR would allow the data to be disclosed.
  2. The Commissioner considers that condition (f) in Article 6(1) is the only condition which could potentially apply in the circumstances of this case.

Condition (f) – legitimate interests

  1. Condition (f) states that processing shall be lawful if it “…is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”
  2. Although Article 6 states that this condition cannot apply to processing carried out by public authorities in the performance of their tasks, regulation 11(7) of the EIRs makes it clear that public authorities can rely on Article 6(1)(f) when responding to requests made under the EIRs.
  3. The tests which must be met before Article 6(1)(f) can apply are as follows:
    1. Does the Applicant have a legitimate interest in obtaining the personal data? 
    2. If so, would making the personal data available be necessary to achieve that legitimate interest? 
    3. Even if the processing would be necessary to achieve that legitimate interest, would that be overridden by the interests or fundamental rights and freedoms of the data subjects? 

Does the Applicant have a legitimate interest in obtaining the information?

  1. There is no definition within the DPA 2018 of what constitutes a "legitimate interest", but the Commissioner takes the view that the term indicates that matters in which an individual properly has an interest should be distinguished from matters about which he or she is simply inquisitive.
  2. As noted above, the Commissioner has found that only some of the withheld information is personal data as defined in section 3(2) of the DPA 2018.  Given the nature of the information he has accepted is personal data (as described in paragraph 26 above), the Commissioner does not accept that the Applicant has a legitimate interest in obtaining it. 
  3. While the Commissioner accepts that the Applicant has a legitimate interest in obtaining information in relation to what he considers to be potential safety issues associated with the neighbouring property, disclosure of the withheld personal data in question would not shed any further light on, or add to the Applicant’s understanding of, these issues.
  4. Given his conclusion above, the Commissioner finds that condition (f) of Article 6(1) of the UK GDPR cannot be satisfied in relation to the information he has accepted is personal data.  Accordingly, he accepts that making the personal data available would be unlawful.
  5. Given that the Commissioner has found that the processing of this personal data (i.e. making the information available, in response to the Applicant's request) would be unlawful, he is not required to go on to consider separately whether disclosure of the personal data would be necessary to fulfil any legitimate interest or consider the data subject's interests or fundamental rights and freedoms and balance them against any legitimate interest in disclosure.
  6. In all the circumstances of the case, in the absence of a condition in Article 6(1) of the UK GDPR being met, the Commissioner must conclude that making the withheld personal data available would be unlawful and would breach the data protection principle in Article 5(1)(a) of the UK GDPR.  Consequently, he is satisfied that disclosure of the personal data is not permitted by regulation 11(2) of the EIRs.

Other matters

  1. During the investigation, the Authority raised a concern that the Applicant was using FOI law as a mechanism for pursuing his disputes with the Authority and/or the neighbour at the specified residential address. While it did not consider it appropriate in this case to take the view that the request under consideration was vexatious or manifestly unreasonable, it said it was something which would be considered in future should a similar request be received following the next annual inspection.
  2. As the Authority has not specifically sought to rely on the exception in regulation 10(4)(b) of the EIRs, which allows a public authority to refuse to disclose environmental information if the request is manifestly unreasonable, the Commissioner will not consider the Authority’s concerns further as part of the decision notice in this case.
  3. Should the Authority seek to rely upon regulation 10(4)(b) of the EIRs or section 14(1) of FOISA in relation to a future request from the Applicant, the Commissioner will consider any submissions and evidence in support of the application of either provision at that time. Of course, neither regulation 10(4)(b) of the EIRs nor section 14(1) of FOISA should be applied lightly.  Where a public authority seeks to rely on either provision, it must be able to demonstrate, by reference to the circumstances of the particular request and with appropriate supporting evidence, why the request is manifestly unreasonable or vexatious.

Decision 

The Commissioner finds that the Authority partially complied with the Environmental Information (Scotland) Regulations 2004 (the EIRs) in responding to the information request made by the Applicant.   

The Commissioner finds that the Authority correctly withheld some information under the exception in regulation 11(2) of the EIRs.   

However, the Commissioner also finds that the Authority wrongly withheld other information under regulation 11(2) of the EIRs. 

The Commissioner therefore requires the Authority to provide the Applicant with the information wrongly withheld under the exception in regulation 11(2) of the EIRs, by 20 November 2026.  He will write to the Authority to specify the information to be disclosed.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

 

Euan McCulloch 

Head of Enforcement 


6 October 2026

  1. ^

  2. ^