UKFTT-GRC 2025 442 [2025] UKFTT 442 (GRC) InformationRights 0.26.21 130a182d9416628376f4efddf5ee09d7593c06976245cd8fc55a9dcdfa1292f3 7.2.3
Neutral citation number: [2025] UKFTT 00442 (GRC)
Case Reference: EA/2024/0399
First-tier Tribunal
General Regulatory Chamber
Information Rights
Decided without a hearing.
On: 6 March 2025
Decision given on: 28 April 2025
Before
TRIBUNAL JUDGE WILSON
TRIBUNAL MEMBER MURPHY
TRIBUNAL MEMBER COSGRAVE
Between
STEPHEN P WHITESIDE
Appellant
and
INFORMATION COMMISSIONER
Respondent
Decision: The appeal is Dismissed
REASONS
Background to Appeal
1.
This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated 12 September 2024 (IC-302534-T2H1, the “Decision Notice”). The appeal relates to the application of the Environmental Information Regulations 2004 (“EIR”). It concerns information about a building control certificate regarding a specified property requested from the London Borough of Croydon (the “Council”).
2.
The parties opted for a paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing pursuant to rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3.
On 22 September 2023, the Appellant wrote to the Council and requested the following information (the “Request”):
“… the Application Completion Date for works under Initial Notice [property details redacted] was [date redacted] … Please provide a copy of the Final Certificate from the Approved Inspector …
4.
The Council responded on 26 January 2024 . They treated this as a request under the Environmental Information Regulations 2004 (‘the EIR’). The information was withheld pursuant to regulations 12(3), 12(5)(d) and 13(1) of the EIR.
5.
The Appellant requested an internal review on 11 February 2024 . The Council responded on 16 April 2024 and maintained its original position.
6.
The Appellant complained to the Commissioner on 21 April 2024. The Commissioner decided that the EIR applied. The Commissioner decided that the Council had breached the timescale requirements for responding to both the Request and the review. However, the Commissioner concluded that the Council had correctly applied regulation 13(1) EIR. The Commissioner was satisfied that disclosure would not be lawful as it would be in breach of the first data protection principle on the grounds that disclosure was not necessary and that there was an insufficient legitimate interest to outweigh the data subject’s fundamental rights and freedoms. This was on the basis that:
a.
Disclosure under EIR (and to the world at large therefore) is not the appropriate route to obtain such information.
b.
The data subjects, the residents in the property, would not reasonably expect the requested building control Final Certificate to enter the public domain.
c.
There is already a degree of transparency as building control and planning information is available for public inspection via statutory registers. In addition, complaint mechanisms exist, whereby members of the public are able to raise concerns about building control and planning matters.
The Appeal, Response and Reply.
7.
The Appellant appealed on 10 October 2024 and submitted a Reply dated 4 December 2024. So far as is relevant to this decision and reasons the Appellant’s position can be summarised as follows:
a.
The certificate is not personal data as the freehold and leasehold titles of the property are owned by companies.
b.
There is a public interest in the release of the information as it is believed that it will reveal a breach of Building Regulations because works were signed off that were not fit for purpose.
c.
The Appellant’s legitimate interest in the transparency of the building control process outweigh the rights and freedoms of the data subjects. This is particularly so as the building control process concerns issues of health, public safety and environmental protection such as flooding. In addition, the Council’s conduct has prevented the proper investigation of a complaint both during and following construction. The Appellant has legitimate concerns regarding the conduct and performance of the approved company and the Council. The certificate would allow the Appellant to establish if the Council accepted or knew that there had been “ a wholesale breach of planning controls ” in the construction of the drainage system when they considered the application for retrospective planning permission. The certificate will cast doubt on the professional conduct/integrity of those involved in the implementation and enforcement of the relevant statutory processes.
d.
There are no other avenues of complaint or other information available that negate the need for the Final Certificate to be disclosed. The Final Certificate is a key piece of information that allows the Appellant to assess compliance with planning and building regulations.
e.
The information requested is not contained on statutory registers. In any event the statutory registers maintained by the Council do not include all the information required by legislation such as the name and address of any person who signed the notice or certificate.
f.
There are no negative consequences for the data subjects.
8.
The Commissioner’s response maintains that the Decision Notice was correct. The Commissioner takes the position that the information is personal data and that it is not necessary for the Final Certificate to be disclosed given the other information published and the other avenues of complaint.
Applicable law
9.
The relevant provisions of the Environmental Information Regulations 2004 (“EIR”) are as follows.
2(1) …“environmental information” has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on—
(a)
the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;
(b)
factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in (a);
(c)
measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in (a) and (b) as well as measures or activities designed to protect those elements;
……
5(1) …a public authority that holds environmental information shall make it available on request.
……
12(3) To the extent that the information requested includes personal data of which the applicant is not the data subject, the personal data shall not be disclosed otherwise than in accordance with regulation 13.
……
13(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if— (a) the first condition is satisfied…
……
13(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations— (a) would contravene any of the data protection principles…
10.
Requests for environmental information are expressly excluded from the Freedom of Information Act 2000 (“FOIA”) in section 39 and must be dealt with under EIR, and it is well established that “environmental information” is to be given a broad meaning in accordance with the purpose of the underlying Directive 2004/4/EC. We also note that the test for withholding personal data due to contravention of any of the data protection principles is the same under the EIR as under FOIA.
11.
Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “ any information relating to an identified or identifiable living individual ”. The “processing” of such information includes “ disclosure by transmission, dissemination or otherwise making available” ( s.3(4) (d) DPA), and so includes disclosure under EIR.
12.
The data protection principles are those set out in Article 5(1) of the General Data Protection Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) General Data Protection Regulation (GDPR) is that personal data shall be: “ processed lawfully, fairly and in a transparent manner in relation to the data subject”. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) GDPR. These include where “ processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child .” (Article 6(1)(f)).
13.
This involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 ):
(i)
Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?
(ii)
Is the processing involved necessary for the purposes of those interests?
(iii)
Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
14.
In Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC) , Upper Tribunal Judge Wikeley set out eight propositions taken from case law as to the approach to answering these questions. These include: “necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity; the test is one of “reasonable necessity”, reflecting European jurisprudence on proportionality; and this involves the consideration of alternative measures, so the measure must be the least restrictive means of achieving the legitimate aim in question.
15.
In order for something to be ‘necessary’ there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC) . Second, ‘necessity’ is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin) , para 76. It is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC) , para 23.
Issues and evidence
16.
The issue is whether the Council was entitled to rely on regulation 13(1) EIR to withhold the information.
17.
By way of evidence and submissions we had an agreed open bundle of documents [139 PDF pages], which included the Appeal, Response and Reply and a closed bundle [3 PDF pages]. In making our decision, we have read and taken into account all documents and written submissions.
Discussion and Conclusions
Personal Data
18.
The Appellant accepts that the Final certificate is likely to show the address of the property. However, the Appellant submits that Land Registry entries demonstrate that the Freehold and Leasehold interests in the property are held in company names. Accordingly, as limited companies are not identifiable individuals for the purposes of GDPR then any information is not personal data.
19.
However, we accept (as set out in the Decision Notice) that leases of short terms would not be registered at the Land Registry. Accordingly, the registration of the leases for the freehold and leasehold interests in the property in company names is not determinative that the relevant property is not occupied by individuals.
20.
The Appellant does not dispute that the Final Certificate relates to a residential property. The Appellant accepts that individuals occupy the property. The Appellant accepted that at least three of the flats were occupied by February 2022. That is prior to the request that was made on 22 September 2023. Accordingly, we find that as at the date of the request the property to which the Final Certificate relates was occupied by individuals. We find that at least three of the flats were occupied and that there were at least three separate individuals in occupation as at the date of request and possibly more.
21.
In assessing whether those occupiers are identified or identifiable it is necessary to consider all of the means reasonably likely to be used by a person who is seeking to identify the individual. The person who is seeking to identify the individual is treated as a person with no prior knowledge but is reasonably competent, has access to public documents and resources such as the Internet and who would make enquiries of people who may have additional knowledge and advertise for people with such knowledge to come forward. This hypothetical person is sometimes known as the motivated intruder. Applying these criteria we find that such a person will have access to the electoral roll and directory databases such as 192. We find that such resources are readily available and are reasonably likely to be used by a motivated intruder. We find that it is more likely than not that such resources would reveal the individual residential occupiers of the property.
22.
Accordingly, in our judgment the information is personal. The information within a Final Certificate for a residential block of flats will include details of the building in which the individual residences are comprised and information about the residences themselves. That will include details of the layout of the building, albeit in limited detail.
23.
For all the reasons set out above, in our judgement the information requested is personal data. It is personal information that relates to a living individual/s who can be identified.
Is the Appellant pursuing a legitimate interest or interests?
24.
The Appellant says that he is pursuing a legitimate interest. In general there is a legitimate interest in the transparency of building control processes and the scrutiny of regulators that administer these processes. This is particularly important in cases where public safety, building compliance and environmental protection are at stake. The Appellant is concerned that the final certificate may have been signed off improperly with possible implications for health and safety in and around the building and the environment more widely. The Appellant raises issues of flooding. The Appellant submits that the Council’s conduct is indicative that it wishes to conceal those who are responsible for implementation of poor quality development within the relevant Borough.
25.
The Respondent accepts the complainant’s desire for transparency regarding the Final Certificate as a legitimate interest in disclosure, as do we.
26.
However, there is nothing in the closed material that would support the Appellant’s assertion that the Council has acted improperly in the issue of the final certificate or has sought to avoid scrutiny. In addition, the evidence produced by the Appellant, to support the assertion that the Final certificate was improperly issued, include statements attributed to Councillors. The statements do not include a statement of truth. In part the Councillors appear to rely on what they have heard from third parties that the drainage as constructed is in breach of planning conditions. As the writers of these letters are relaying what they have been told and have not provided witness statements this reduces the weight that we have placed on this evidence. In addition, there is a complaint made by a resident of odour and assertions of flooding. However, mere assertions of odour and flooding caused by faulty drains, without supporting evidence demonstrating that the odour and flooding are caused by the drainage carry little weight. As such we are not satisfied that there is a legitimate interest in disclosure on account of any specific failure in the final certification process for this specific property nor that as a consequence of such failures the Council has sought to avoid scrutiny. Accordingly, we are not satisfied that the legitimate interest pursued includes an investigation of a failed certification process resulting in drainage issues together with the active concealment of this alleged failed process.
Is the processing involved necessary for the purposes of those interests?
27.
The Appellant’s position is that obtaining the final certificate is necessary to achieve transparency regarding the Final Certificate and more specifically to establish whether there have been specific failures in the final certification process and that as a consequence of such failures the Council has sought to avoid scrutiny. The Appellant asserts that the information available in the public domain via statutory registers is insufficient to establish what the Final Certificate considered and who was responsible for signing the certificate. The Appellant submits that his experience is that any complaint mechanism available to him will not result in the disclosure of the Final Certificate.
28.
The Commissioner’s position is that building control and planning information is available via statutory registers and that complaint procedures exist which the public can use to raise concerns about building control and planning matters. Accordingly, it is not necessary to consider disclosure to “the world” pursuant to EIR.
29.
We have considered whether disclosure is reasonably necessary for the purposes of the Appellant’s legitimate interests. We find it is not.
30.
We remind ourselves that to be ‘necessary’, disclosure must be the minimum interference with the privacy rights of the data subject(s) that will achieve the legitimate aim in question. Disclosure under EIR is to the whole world, with no duty of confidence attaching to the immediate recipient of the information or anyone coming into possession of it thereafter.
31.
We accept that there is a general societal interest in ensuring that local authorities properly discharge their statutory duties and in ensuring that local authorities can be scrutinised. In relation to this general societal interest we find that the local authorities are required to ensure that certain building control information is included on statutory registers. We note that the Appellant asserts that in certain instances the statutory registers do not include the full information. However, the remedy for this breach would be a complaint to the Council to require the Council to include information on that statutory register that the Council is required to include but has not, rather than the disclosure of this specific information. There is also the remedy of judicial review. The disclosure of this specific information does little to serve the wider societal interest identified. In addition, we note that in this instance certain information has already been disclosed in relation to the building control process which has allowed some degree of scrutiny of the processes involved.
32.
Even if we were to take the Appellant’s claim at its highest (which for the reasons set out above we do not) that there is a specific legitimate interest in this information due to failures on the part of the Council and/or its approved inspector , we would nonetheless find that disclosure is not reasonably necessary for the purposes of that legitimate interest.
33.
We accept that as the Council has used an approved inspector that the local authority complaint mechanism is not available to the Appellant. There is nonetheless a mechanism through which the Appellant may raise a complaint. The Council has confirmed approved inspectors are required to have their own internal complaints process. If, having used that complaints process, the complaint remains unresolved then there is the opportunity to escalate a complaint to the Building Safety Regulator. The Appellant has disclosed information that this process has proved fruitless in the past in relation to other applications because he has been unable to obtain a copy of the Final Certificate through this mechanism as the relevant approved inspector had indicated that making the Final Certificate available would result in a breach of the Data Protection Act. However, in our judgment that is not to say the complaint mechanism is of itself ineffective. The Appellant can raise concerns that the Final Certificate has been improperly issued in light of the alleged problems in relation to the drainage and seek investigation and remedy through that complaints mechanism irrespective of whether the Final Certificate is disclosed. Accordingly, the Appellant has failed to demonstrate that there would not be appropriate alternative remedies to scrutinise the signoff of the works for building control purposes and the alleged drainage issues that are less intrusive than disclosure of the Final Certificate to the world pursuant to EIR.
34.
In addition, we note that the Appellant is described as a neighbour in some of the documents in the bundle. To the extent that the Appellant is affected by flooding or odour from the property he may in principle have a private law claim. The Appellant has failed to demonstrate that any relevant building control documents would not be disclosable in such civil proceedings. In these circumstances disclosure would not be to the whole world but subject to any requirements of the court limiting further disclosure. The Appellant has failed to demonstrate that there are not less intrusive means, by which disclosure of the Final Certificate could be achieved, than disclosure to the world pursuant to EIR.
35.
For all these reasons we find that disclosure is not necessary for the purposes of the Appellant’s legitimate interests. Having made this finding it is not necessary to consider whether such interest is overridden by the rights and freedoms of the data subjects but we do so in any event in the interest of completeness.
Are such interests overridden by the interests of the data subject?
36.
The Appellant says that the general societal interest in ensuring that local authorities properly discharge their statutory duties and his specific legitimate interest in relation to Final Certificates on account of his belief that the works were improperly “signed off” outweighs the rights of the individuals. However, we agree with the Respondent that the data subjects would not reasonably expect details of the building in which they reside to be disclosed to the world at large under EIR. We accept that local authorities do not routinely disclose Final Certificates and this is relevant to this expectation. In our judgment disclosure of the disputed information would result in a substantial interference with the data subjects’ privacy as the information relates to their living arrangements such as the layout of the building in which they reside. In these circumstances the privacy rights of the data subjects are a weighty consideration which require protections and override any interest in disclosure.
37.
We therefore find that disclosure of the requested information would contravene the data protection principles because there is no lawful condition for processing under Article 6 GDPR. The Council was entitled to rely on regulation 13(1) EIR to withhold the requested information.
38.
As the Council is entitled to rely on regulation 13(1) EIR to withhold the requested information it is unnecessary to consider regulations 12(3) and 12(5)(d.
39.
We dismiss the appeal for the reasons explained above.
Signed: Judge Wilson Date: 23 April 2025