Personal data11
1
To the extent that environmental information requested includes personal data of which the applicant is the data subject then the duty under regulation 5(1) to make it available shall not apply to those personal data.
F12
To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if—
a
the first condition set out in paragraph (3A) is satisfied, or
b
the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.
F23A
The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—
a
would contravene any of the data protection principles, or
b
would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
3B
The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene Article 21 of the F6UK GDPR (general processing: right to object to processing).
F34A
The third condition is that any of the following applies to the information—
a
it is exempt from the obligation under Article 15(1) of the F8UK GDPR (general processing: right of access by the data subject) to provide access to, and information about, personal data by virtue of provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
b
on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.
F45
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6
For the purposes of this regulation, a Scottish public authority may respond to a request by not revealing whether information exists or is held by it, whether or not it holds such information, if to do so would involve making information available in contravention of this regulation.
F57
In determining, for the purposes of this regulation, whether the lawfulness principle in Article 5(1)(a) of the F7UK GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.