Home Decisions

Decision 316/2025

Decision 316/2025:  Number of retention entry requests to Primary 1 for the academic years starting in 2024 and 2025


Authority: East Lothian Council
Case Ref: 202501137
 

Summary

The Applicant asked the Authority for the number of requests made for a retention entry to Primary 1 for two academic years.  The Authority refused to provide the requested information as it considered it was third-party personal data.  The Commissioner investigated and found that the information was not third-party personal data, had been wrongly withheld and should now be provided to the Applicant.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (2)(e)(ii) (Effect of exemptions); 38(1)(b), (2A), (5) (definitions of the data protection principles”, “data subject”, “personal data” and “processing”, “the UK GDPR”) and (5A) (Personal information); 47(1) and (2) (Application for decision by Commissioner).

United Kingdom General Data Protection Regulation (the UK GDPR) articles 4(1) (definition of “personal data”) (Definitions).

Data Protection Act 2018 (the DPA 2018) sections 3(2), (3), (4)(d), (10) and (14)(a), (c) and (d) (Terms relating to the processing of personal data). 

Background

  1. On 16 May 2025, the Applicant made a multi-part request for information to the Authority, only the first part of which is covered by this application.  She asked for the number of requests made for a retention entry to Primary 1 for the academic years starting in 2024 and 2025.
  2. The Authority responded on 13 June 2025.  It stated that although it held the information, it considered it to be exempt from disclosure under section 38(1)(b) of FOISA.  It explained that this exemption related to personal information and that when information was released as the result of a freedom of information request, technically it was released to the general public and not just to the person making the request.  In its view as the Authority is a small, rural authority with close knit communities and the number of requests is low, it feared releasing this detail would lead to the identification of individuals.
  3. On 13 June 2025, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that she was dissatisfied with the decision because she found the Authority’s reasoning inconsistent and unconvincing, particularly when considered alongside the data provided (in response to other parts of her request).  She considered that the notion that disclosing the totals could risk identification appeared to be an overreach, especially when the figures could be presented in aggregate form.  The Applicant did not believe there was any reasonable likelihood that individuals could be identified from a simple numerical total when no other personal or geographical identifiers were attached.
  4. The Authority notified the Applicant of the outcome of its review on 3 July 2025.  It upheld its initial position, maintaining its reliance on section 38(1)(b) to withhold the information.  It considered its decision was further supported by the Education (Schools and Placing Information) Scotland Amendment, etc. Regulations 1993 (No. 1604 (S.201)) regulation 8.  It explained that the numbers in relation to specialist provision (the other part of the Applicant’s request) had been disclosed whilst the retention entry requests were not because the numbers were considerably higher with regards specialist provisions and so the exemption did not apply.
  5. On 15 July 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated she was dissatisfied with the outcome of the Authority’s review because she found it unreasonable that the Authority continued to withhold the retention data whilst simultaneously being able to provide similar information regarding specialist provision.  She considered that the argument that disclosure would risk identifying individuals was unfounded in this context, and that the numbers requested were general and anonymised.  The Applicant did not believe that there was any realistic way individuals could be identified from the data.   

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 12 August 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant.  The Authority provided the information, and the case was allocated to an investigating officer.
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to its reasons for determining that the withheld information constituted personal data and why it considered that individuals might be identified from it.  

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority, together with the information that has been withheld in this case. 

Section 38(1)(b) – Personal information

  1. Section 38(1)(b) read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test in section 2(1)(b) of FOISA.
  3. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of a disclosure under FOISA) would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR.
  4. The Commissioner must decide whether the Authority was correct to withhold the information requested under section 38(1)(b) of FOISA. 

Is the withheld information personal data?

  1. The first question the Commissioner must address is whether the withheld information is personal data for the purposes of section 3(2) of the DPA 2018.

  2. Personal data are defined in section 3(2) of the DPA 2018 as “any information relating to an identified or identifiable living individual”. Section 3(3) of the DPA 2018 defines “identifiable living individual” as a living individual who can be identified, directly or indirectly, in particular by reference to: 

    (a) an identifier such as a name, an identification number, location data, or an online identifier, or

    (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

  3. The two main elements of personal data are that the information must “relate” to a living person, and that person must be identified – or identifiable – from the data, or from the data and other accessible information.
  4. Information will “relate to” a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them, or has them as its main focus.
  5. An individual is “identified” or “identifiable” if it is possible to distinguish them from other individuals (see paragraph 15 above).
  6. In this case the withheld information comprises two numbers (one for each academic year covered by the request) which are greater than zero but less than five. 

The Authority's submissions about the exemption

  1. In its submissions, the Authority stated that where the number was greater than zero but less than five, it was not disclosed to avoid identification of individuals.
  2. It explained that it was a small, rural authority with close-knit communities. It considered that due to the very low number of requests, the decision was taken not to disclose the information because it believed disclosing the information into the public domain could lead to the identification of the individuals concerned, which would be a breach of the fairness principle of the DPA.  The Authority also submitted that this decision was further supported by Regulation 8 of the Education (School and placing Information) (Scotland) Amendment, etc. Regulations 1993 (No. 1604 (S.201)).
  3. The Authority confirmed to the Commissioner that it had 36 primary school establishments, of which 34 schools were operating and receiving pupils in 2024/25 and 2025/26, with two schools mothballed.
  4. It provided other statistics, including: the number of Primary 1 pupils enrolled at the September Pupil Census in 2024/25 was 1,137 and in 2025/26 there were 1,166. In addition, the number of children within the Authority catchment area eligible for Primary 1 enrolment (based on data captured during the annual P1 enrolment process) was 1,327 in 2024/25 and 1,384 for 2025/26.
  5. The Authority argued that it had a small community which might be known on local social media, where information was capable of being shared.  As a result, it considered there was a real risk that disclosure may lead to identification of the children involved. 

The Applicant's submissions about the exemption

  1. The Applicant did not agree that the number of retention requests constituted personal data. She argued that the figures requested were aggregated and did not identify any individuals.  She considered that disclosure of such numbers would not compromise the privacy of any child or parent, especially if no additional details were provided.  She did not believe the Authority’s reliance on section 38(1)(b) was justified in this context, given it had provided her with the data in relation to specialist provision. 

The Commissioner's view about the exemption

  1. The Commissioner has carefully considered the submissions from both the Applicant and the Authority and is not satisfied that the withheld information is personal data.
  2. In the case of Breyer v Bundesrepublik Deutschland[1] the Court of Justice of the European Union looked at the question of identification.  The Court took the view that the correct test to consider is whether there is realistic prospect of someone being identified.  When making that determination, account can be taken of information in the hands of a third party. However, there must be a realistic causal chain - if the risk of identification is insignificant, the information will not be personal data.
  3. Although this decision was made before the GDPR, UK GDPR and the DPA 2018 came into force, the Commissioner considers the same rules should apply.  Although no longer applicable in the UK, recital (26) of the GDPR bears this out – and confirms that data should be considered anonymous (and therefore no longer subject to the GDPR) when the data subject(s) is/are no longer identifiable.
  4. In this instance, the Authority has argued that the figure is personal data as there is a realistic prospect of identification of individuals due to the small, rural nature of its authority area, and the fact that the number may be shared on social media.  However, it has not provided any submissions on how the disclosure of the aggregated figure for each of the two academic years (even if this number is low) would lead to the identification of the children involved.
  5. The Commissioner notes that the Applicant is looking for an aggregated figure for the whole of the authority area for each of the academic years, not a breakdown per school.
  6. The Commissioner has taken account of the numbers of children who were eligible for entry into Primary 1 over the two academic years in question, which would be over 1,000 for each year, together with the number of primary schools involved.  In addition, while the Commissioner notes the Authority’s remarks about the nature of its area, and while there are certainly small rural communities within that area, the Commissioner considers it evident that the area includes a mix of community sizes, across a reasonably substantial geographical spread.  
  7. The Commissioner has also considered the legislation the Authority referred to as supporting its position.  That is, Regulation 8 of The Education (School and Placing Information) (Scotland) Amendment, etc. Regulations 1993 (No. 1604 (S.201))[2].  The Commissioner notes that these Regulations refer, at Regulation 1(2), to the “principal Regulations” (those which were subject to amendment) as being the Education (Schools and Placing Information) (Scotland) Regulations 1982.  However, Schedule 3 of the Education (School and Placing Information) (Scotland) Regulations 2012[3] revokes The Education (School and Placing Information ) (Scotland) Regulations 1982 and parts of the Education (School and Placing Information) (Scotland) Amendment, Etc., Regulations 1993, including regulation 8.
  8. As a result, the Commissioner cannot accept the position of the Authority that the content of these regulations supports its application of the exemption in section 38(1)(b).
  9. What the Commissioner must determine is whether the Authority has demonstrated a realistic causal chain to show how disclosure of the aggregated number for each of the two academic years covered by the request could lead to the identification of those individuals who made a request for a retention entry to Primary 1.
  10. Having considered the number of pupils who were eligible for enrolment into Primary 1 in each of the academic years covered by the request, together with the number and geographic spread of the primary schools concerned (in a range of different communities), the Commissioner is not satisfied that the Authority has provided sufficient evidence to demonstrate that there would be a realistic prospect of identification of the individuals concerned if the withheld information were to be disclosed.
  11. Consequently, even acknowledging that a degree of caution is appropriate when considering the personal data of children, the Commissioner does not agree that the withheld information in this case is personal data as defined in section 3(2) of the DPA 2018.
  12. For the reasons given above. the Commissioner finds that the Authority was not entitled to withhold the information under section 38(1)(b) of FOISA and requires it to be disclosed to the Applicant. 

Decision 

The Commissioner finds that the Authority failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant. 

The Commissioner finds that the Authority was not entitled to withhold the information as personal data and, by doing so, failed to comply with section 1(1) of FOISA.

The Commissioner therefore requires the Authority to provide the withheld information to the Applicant, by 5 February 2026.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply. The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

Euan McCulloch 

Head of Enforcement 

 

22 December 2025