UKFTT-GRC 2023 300 [2023] UKFTT 300 (GRC) InformationRights 0.26.10 4e5b81e8233a3b9d756466c593278284ac90d6e316c238466f299ea988d22709 6.0.2
NCN: [2023] UKFTT 00300 (GRC)
Case Reference: EA/2022/0196
First-tier Tribunal
General Regulatory Chamber
Information Rights
Determined on the papers
Decision given on: 16 March 2023
Before
TRIBUNAL JUDGE CL GOODMAN
TRIBUNAL MEMBER MS N MATTHEWS
TRIBUNAL MEMBER MR D PALMER-DUNK
Between
ROGER BIRD
Appellant
and
THE INFORMATION COMMISSIONER
Respondent
Decision:
The appeal is allowed.
Decision Notice IC-144995-X0X8 is not in accordance with the law.
Substitute Decision Notice:
Hythe and Dibden Parish Council is not required to disclose information in response to a request for information from Mr Bird dated 27 August 2021 because the requested information contains personal data of the Appellant and personal data of third parties.
To the extent that the personal data of the Appellant and the personal data of third parties is inextricably linked in the requested information, the Council is entitled to refuse to disclose under Regulation 5(3) Environmental Information Regulations 2004 (‘EIR’).
To the extent that the personal data of the Appellant can be clearly differentiated from the personal data of the third parties, the Council is entitled to refuse to disclose under Regulation 5(3) EIR.
To the extent that the personal data of third parties can be clearly differentiated from the Appellant’s personal data, the Council is entitled to refuse to disclose under Regulation 13(1).
No steps are required.
REASONS
Background
1.
The Appellant represented a number of residents of Valleydene, a road in Southampton, in a dispute with the Hythe and Dibden Parish Council (“the Council”) over responsibility for maintenance of an underground sewer pipe. The Appellant is not a resident, but he has experience of and has campaigned about “riparian rights”, the legal interests of the owners of land on the bank of a natural watercourse.
2.
A “private” meeting was arranged between the Council and residents to discuss the issue on 26 August 2021. Ten councillors attended with council officers and their solicitors, the Appellant and a number of Valleydene residents. The Council informed those present that it was recording the meeting.
3.
On 27 August 2021, the Appellant made a request for information to the Council as follows:
“Under Article 15 of the GDPR the controller shall provide a copy of the personal data undergoing processing.
Please provide a copy of the recording of the meeting held with the Valleydene residents on 26th August 2021. As this request is made by electronic means the information should be provided in a commonly used electronic form.
Please provide confirmation as to whether or not personal data concerning are being processed, and, where that is the case, access to the personal data and the following information:
1.
the purposes of the processing;
2.
the categories of personal data concerned;
3.
the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4.
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5.
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
6.
the right to lodge a complaint with a supervisory authority;
Please pass this request on to the data controller if necessary. I should point out that there is a requirement to identify the data controller both on your website and your emails. The website does not contain the required link to the privacy notice on the home page and the link provided in the email footnote doesn't work.”
This request for information will be referred to in this Decision as the “Request”.
4.
The Council responded to the Request on 27 August 2021 directing the Appellant to its privacy notice. The Council did not disclose the recording to the Appellant on the basis that it did not contain his personal data.
5.
The Appellant made a second request to the Council in October 2021 for the legal advice they had received about the sewer pipe issue. That request was refused on 10 November 2021 on the basis that the information was exempt under section 42 Freedom of Information Act 2000 (“FOIA”) as subject to legal professional privilege.
6.
The Appellant made a single complaint to the Commissioner about the Council’s responses to both requests on 8 December 2021.
7.
The Commissioner wrote to the Council and the Appellant on 21 December 2021 about the Request, using reference IC-144995-X0X8. They advised the Council that the Request should be treated as a request for information under FOIA and directed it to carry out an internal review.
8.
The Council upheld their refusal to disclose information in response to the Request on internal review on 31 January 2022. They stated that no information would be provided under the UK General Data Protection Regulation (“UK GDPR”) because the recording contained no personal data of the Appellant “other than his name”. The Request was also refused under FOIA on the basis that the recording contained personal information of the Valleydene residents. As the internal review had upheld the refusal to disclose, the Commissioner’s investigation continued.
9.
The Appellant’s complaint in relation to his request for the Council’s legal advice was given a different reference by the Commissioner, IC-144936-F0L3. On 17 June 2022, the Appellant withdrew that complaint.
10.
On 1 July 2022, the Commissioner issued Decision Notice IC-144995-X0X8 in relation to the Request. The Commissioner upheld the Council’s refusal to disclose the recording under section 40(2) FOIA on the basis that it was personal data of the individuals who attended the meeting. There was a legitimate interest in disclosing the information and disclosure was necessary to meet that interest; however, the legitimate interest was outweighed by the fundamental rights and freedoms of the individuals who attended the meeting. Those individuals had a “strong and reasonable expectation that the information they provided during the meeting will remain confidential” [paragraph 15].
11.
On the same day, the Appellant responded to the Commissioner, protesting that he had withdrawn his complaint in relation to the Request. He was advised that the Decision Notice could only be withdrawn if he appealed, and he therefore appealed to the Tribunal on the grounds that the Request had been wrongly treated as a request for information under FOIA and not as a subject access request under UK GDPR.
12.
In its Response, the Commissioner relied on its Decision Notice.
13.
In Reply, the Appellant complained about the consequences of the publication of the Decision Notice on his relationship with the Council and submitted that:
a.
a substantial part of the recording constituted his personal data and was therefore exempt from FOIA under section 40(1) and should have been dealt with as a subject access request under UK GDPR;
b.
the residents who had attended the meeting had offered to consent to disclosure of the recording;
c.
the recording was not personal data of the Council officers and representatives who attended the meeting because they were not identified; and
d.
the recording could have been redacted to remove the personal data of the residents, who spoke only in the final part of the meeting.
Evidence and paper determination
14.
In reaching its decision, the Tribunal took into account all the evidence before it. The Tribunal had before it an open bundle of 85 pages and a closed bundle of 4 pages. Our findings were made on the balance of probabilities.
15.
The Tribunal did not have a copy or transcript of the recording of the meeting on 26 August 2021.
16.
The appeal came before us for determination on the papers. The Appellant stated in his Notice of Appeal that he wanted his appeal decided on the papers, and the Commissioner agreed. The Appellant subsequently, in his Reply, “invited the Tribunal to consider” whether an oral hearing would be appropriate “in view of the complexity of the case”, but did not withdraw his consent to a paper determination.
17.
The Tribunal therefore considered whether to adjourn for an oral hearing and/or to direct the parties to provide a copy or transcript of the meeting. In doing so, we are required to apply the overriding objective in Rule 2 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2008 which is to deal with cases fairly and justly. Rule 2(1)(e) requires us to avoid delay so far as compatible with proper consideration of the issues and Rule 2(1)(a) requires us to deal with cases in ways which are proportionate to the importance of the issues, avoiding unnecessary formality and seeking flexibility.
18.
It appears that neither party to the proceedings has a copy of the recording. In order to obtain a copy, the Commissioner would have to be directed to obtain the recording from the Council, or the Council would have to be joined as a party. A Rule 14 Order would then have to be made and a closed bundle created. A further session would have to be arranged for the Tribunal with either a completely new panel or at a time when all three members of the current panel were available, causing further delay. All in circumstances where the discussions between the Council and residents about the sewer pipe have moved on and the Appellant had intended to withdraw his complaint over six months ago, before the Decision Notice was even issued.
19.
The Tribunal decided on balance taking these factors into account that we had sufficient information to properly determine the issues without an oral hearing and without a copy or transcript of the recording, and that it was fair and in the interests of justice to do so.
The Law
20.
For the reasons set out in paragraphs 33-34 below, the Tribunal found that the Environmental Information Regulations 2004 (‘EIR’) applied to the Request and not FOIA.
21.
Regulation 2(1) EIR provides that:
‘ “environmental information” is:
‘any information in written, visual, aural, electronic or any other material form on –
(a)
the state of the elements of the environment, such as… water, soil, land, landscape… and the interaction among these elements;
(b)
factors, such as… waste… affecting or likely to affect the elements of the environment referred to in (a);
(c)
measures.. such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in (a) and (b) as well as measures or activities designed to protect those elements…’
22.
Regulation 5 EIR provides that:
‘ (1) Subject to paragraph (3) and in accordance with paragraphs (2), (4), (5) and (6) and the remaining provisions of this Part and Part 3 of these Regulations, a public authority that holds environmental information shall make it available on request.
…
(3)
To the extent that the information requested includes personal data of which the applicant is the data subject, paragraph (1) shall not apply to those personal data.’
23.
Regulation 12(3) EIR provides:
‘To the extent that the information requested includes personal data of which the applicant is not the data subject, the personal data shall not be disclosed otherwise than in accordance with regulation 13.’
24.
Regulation 13 EIR provides:
‘(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if –
(a)
first condition is satisfied…
(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations –
(a)
would contravene any of the data protection principles…’
25.
The first data protection principle in Article 5(1)(a) UK GDPR is that personal data shall be:
‘processed lawfully, fairly and in a transparent manner in relation to the data subject’
26.
Article 6(1) UK GDPR provides that:
‘Processing shall be lawful only if and to the extent that at least one of the following applies:
(a)
the data subject has given consent to the processing of his or her personal data for one of more specific purposes;
(b)
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child
….’
27.
Article 4(11) UK GPDR provides that consent means:
‘ any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.
28.
For the purposes of EIR and UK GDPR, personal data is defined in Section 3 of the Data Protection Act 2018 (“the DPA” as follows:
‘(2) “Personal data” means any information relating to an identified or identifiable living individual…
(3)
“Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—
(a)
an identifier such as a name, an identification number, location data or an online identifier, or
(b)
one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.’
29.
The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:
‘(1) If on an appeal under section 57 the Tribunal considers -
(a)
that the notice against which the appeal is brought is not in accordance with the law, or
(b)
to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the Tribunal shall dismiss the appeal.
(2)
On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.’
30.
The Tribunal stands in the shoes of the Commissioner and takes a fresh decision on the evidence before us. The Tribunal does not undertake a review of the way in which the Commissioner’s decision was made.
Discussion
31.
This issue for the Tribunal in this appeal is whether Decision Notice IC-144995-X0X8 is in accordance with the law and whether the Council were entitled to refuse to disclose the recording of the meeting of 26 August 2021.
Content of the recording
32.
Although the Tribunal did not have a copy or transcript of the recording, we were able to make the following findings about its content on the balance of probabilities and based on the evidence before us:
a.
the Appellant gave his name (see the Council’s internal review dated 31 January 2022);
b.
the Appellant then asked a number of questions (the Council’s response to the Commissioner dated 24 December 2021);
c.
the Appellant was involved in “two separate lengthy debates” (the Appellant’s Reply);
d.
the Council’s solicitor presented “the case for riparian responsibility” (email from the Appellant to Councillor Dowd on 4 March 2022);
e.
a number of residents “spoke their names, addresses and gave personal details relating to their properties and how it affected them and their lives”, with some becoming very upset or tearful (the internal review).
Do the Environmental Information Regulations apply to the Request?
33.
The Tribunal found that the information requested by the Appellant was ‘environmental information’ as defined in Regulation 2(1) EIR. The requested information is a recording of a meeting which discussed responsibility for maintenance of an underground sewer pipe and flooding to residents’ properties.
34.
The Tribunal was satisfied that this was information in a material form on water and land which are elements of the environment under Regulation 2(1)(a). The recording was also likely to concern factors affecting the elements of water and land, such as the release of sewage and flooding, under Regulation 2(1)(b), and measures affecting those elements and factors, such as legal responsibility and agreements in relation to the maintenance of the sewer pipe to manage flooding, under Regulation 2(1)(c).
35.
The wording of the relevant provisions in relation to ‘personal data’ are the same under EIR as under FOIA (see for example the Commissioner’s Guidance Note on ‘Personal Information (section 40 and regulation 13)’ 20201124 Version 2.4).
What personal data does the recording contain?
36.
The Tribunal found based on our findings about the content of the recording in paragraph 32 above that information in the recording relates to the Appellant and that he is either identified or identifiable from it, for the following reasons:
a.
The Appellant is identified on the recording by name. Even if name alone is not enough to identify him, he is sufficiently “identifiable” by reference to a combination of his name, his voice and the subject matter and location of the meeting, and the Council’s written minutes of the meeting. He would be identifiable in particular to other residents of the area, Council members and others involved in disputes about riparian rights and responsibilities.
b.
The recording contains information which “relates to” the Appellant. It contains his name, the information that he was present at the meeting, and that he represented residents at that meeting.
c.
The recording also contains the Appellant’s submissions on behalf of the residents. Submissions made by a professional representative may not have a sufficiently personal quality to “relate to” the advocate. However, the Tribunal found that submissions made by the Appellant in this context were likely to be personal to him and strongly held. He has “personally campaigned for public recognition” about riparian rights and responsibilities and it seems unlikely that he was paid to represent the residents. He was “upset by” allegations made at the meeting. Taking all this together, the Tribunal found on the balance of probabilities that the submissions made by the Appellant at the meeting were also his personal data.
37.
The Tribunal therefore concluded, applying section 3(2) and (3) DPA, that the recording contains personal data of the Appellant.
38.
The recording also contains personal data of a number of Valleydene residents. Neither of the parties nor the Council disputes this. The residents give their names and addresses and discuss the impact of the sewer pipe and flooding on their lives and homes. They are identified and identifiable and the information relates to them.
39.
The Tribunal had insufficient information to decide whether or not the recording contained personal data of other attendees at the meeting, such as the councillors, Council officers and solicitors, but found that it was not necessary for us to make a decision about that in order to decide this appeal.
Can the Council refuse to disclose the recording?
40.
The recording therefore contains both personal data of the Appellant, which the Council was entitled to refuse to disclose under Regulation 5(1) in reliance on Article 5(3) EIR, and third party personal data of the Valleydene residents.
41.
The Commissioner suggests in Guidance that Regulation 5(3) will also apply if the third party personal data is “inextricably linked” to the Appellant’s personal data in the recording and cannot be “clearly differentiated” (ICO Guidance on “Personal data of both the requester and others (section 40 FOIA and regulations 5(3) and 13 EIR)” 20201124 Version 2.1). While this Guidance is not binding on the Tribunal, we accept and adopt the approach suggested by the Commissioner which we find to be helpful and consistent with the relevant law.
42.
The positions of the Appellant and the Council differ on the question of whether the Appellant’s personal data and the residents’ personal data is “inextricably linked” in the recording.
43.
The Appellant submits in his Reply that the part of the recording containing his personal data did not contain any personal data of the residents. He says that the residents were only involved for the “final part of the recording” and that this part could be deleted in order to deal with the Request under UK GDPR.
44.
By contrast, the Council said in the internal review that “many residents… spoke throughout the meeting”. It also seems likely that the Appellant would have made reference to the residents and their experiences of flooding in his submissions, from which it might have been possible to identify them.
45.
The Tribunal was unable to make a definitive finding on this issue without hearing the recording or seeing a transcript. However, we concluded that the outcome of the appeal would be the same, regardless of whether or not the Appellant’s personal data is “inextricably linked” with that of the residents, for the following reasons:
a.
if the residents’ personal data is inextricably linked with the Appellant’s personal data throughout the recording, the Council would be entitled to refuse to disclose the recording under Regulation 5(3); and
b.
if the recording can be divided into two distinct parts as the Appellant submits, the Council would be entitled to refuse to disclose the part containing the Appellant’s personal data under Regulation 5(3), and the part containing the residents’ personal data under Regulation 13(1), for the reasons set out below.
Application of Regulation 13(1) to the residents’ personal data
46.
The Tribunal was satisfied that disclosure of any part of the recording which contains the residents’ personal data would contravene the first data protection principle in Article 5(1)(a) UK GDPR.
47.
The first data protection principle requires that personal data is processed lawfully, fairly and in a transparent manner in relation to the data subject. The relevant “processing” in this case is the disclosure of the residents’ personal data under EIR. Disclosure under EIR is free of any duty of confidence and potentially to the world, not only to person requesting the information.
48.
The Appellant submitted that the residents had consented to the processing under Article 6(1)(a) UK GDPR. The open bundle contained an email from an individual identified as the Chairman of the Valleydene and Highlands Way Residents Association confirming that “all the individuals identified in the recording had agreed that the recording should be released”. However, there was no evidence that any officer of the Residents Association had authority to give such consent on behalf of the residents, nor that the residents understood that they were giving consent for the recording to be disclosed to the world at large and not only to the Appellant. Applying Article 4(11) UK GDPR, the Tribunal found that the residents had not given “specific, informed and unambiguous indication” of their wishes, and therefore Article 6(1)(a) did not apply.
49.
The Tribunal also found that there was no lawful basis for processing under Article 6(1)(f). The Tribunal agrees with the Commissioner that there was a legitimate interest in disclosure of the recording, in relation to the public interest in transparency of the Council’s actions and the environmental issues of flooding and release of sewage. We accepted that disclosure was reasonably necessary to achieve that interest.
50.
However, applying the balancing test in Article 6(1)(f), the Tribunal found that the legitimate interest was overridden by the interests and fundamental privacy rights of the residents who attended the meeting. This was a private meeting with the Council concerning a “very sensitive and contentious” issue (see the Council’s internal review). The residents shared personal details about how their properties and lives had been affected by flooding. Some became upset and tearful. By contrast, while there is a legitimate interest, it primarily concerns a relatively small geographical area and small number of individuals and properties. In this context, the Tribunal found that the fundamental right of the residents to keep the recording of what they said at the meeting private, and not have it published to the world at large, overrode the legitimate interests. Article 6(1)(f) did not apply.
51.
None of the other lawful bases in Article 6 UK GDPR applied.
52.
The first condition in Regulation 13(2A) EIR is therefore satisfied and applying Regulation 13(1), the Council must not disclose to the Appellant under EIR any part of the recording which contains the residents’ personal data.
Conclusion
53.
The Tribunal therefore concluded that:
a.
the recording contained personal data of the Appellant and personal data of third parties;
b.
to the extent that the personal data of the Appellant and the personal data of third parties is inextricably linked in the recording, the Council was entitled to refuse to disclose it under Regulation 5(3) EIR;
c.
to the extent that the personal data of the Appellant could be clearly differentiated from the personal data of the third parties, the Council was entitled to refuse to disclose it under Regulation 5(3) EIR;
d.
to the extent that the personal data of third parties could be clearly differentiated from the Appellant’s personal data, the Council was entitled to refuse to disclose it under Regulation 13(1) EIR; and
e.
the Council is therefore entitled to refuse to disclose the recording to the Appellant in response to the Request.
54.
The Decision Notice issued by the Commissioner was therefore not in accordance with the law because it was based on section 40(2) FOIA. The appeal is allowed and a new Decision Notice is substituted as set out at the head of this Decision. However, no steps are required because the Council is entitled to refuse to disclose the recording.
55.
To the extent that the Council refused to disclose the recording under Regulation 5(3) EIR, it should have then dealt with the Request as a subject access request under Article 15 UK GDPR, as the Appellant has submitted from the very start. However, the Tribunal has no jurisdiction in relation to how the Council deals with the Request under UK GDPR.
Signed Judge CL Goodman Date: 15/03/2023