The Environmental Information (Scotland) Regulations 2004

Personal dataS

11.—(1) To the extent that environmental information requested includes personal data of which the applicant is the data subject then the duty under regulation 5(1) to make it available shall not apply to those personal data.

[F1(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if—

(a)the first condition set out in paragraph (3A) is satisfied, or

(b)the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.]

[F2(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—

(a)would contravene any of the data protection principles, or

(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene Article 21 of the [F3UK GDPR] (general processing: right to object to processing).]

[F4(4A) The third condition is that any of the following applies to the information—

(a)it is exempt from the obligation under Article 15(1) of the [F5UK GDPR] (general processing: right of access by the data subject) to provide access to, and information about, personal data by virtue of provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.]

F6(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(6) For the purposes of this regulation, a Scottish public authority may respond to a request by not revealing whether information exists or is held by it, whether or not it holds such information, if to do so would involve making information available in contravention of this regulation.

[F7(7) In determining, for the purposes of this regulation, whether the lawfulness principle in Article 5(1)(a) of the [F8UK GDPR] would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.]

Textual Amendments

F2Reg. 11(3A)(3B) substituted for reg. 11(3) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 312(3) (with ss. 117, 209, 210, Sch. 20 para. 61); S.I. 2018/625, reg. 2(1)(g)