UKFTT-GRC 2026 784 [2026] UKFTT 784 (GRC) InformationRights 1.9.1 cb97499fd3782e6e9e5ce25024c0f03e567afc137d8759ea67e57fd64a4ae366 7.4.0
NCN: [2026] UKFTT 00784 (GRC) Case Reference: FT/EA/2025/0402
First-tier Tribunal
General Regulatory Chamber
Information Rights
Decided without a hearing
Decision given on: 2 June 2026
Before
TRIBUNAL Judge SOPHIE BUckley
TRIBUNAL MEMBER MARION SAUNDERS
TRIBUNAL MEMBER EMMA YATES
Between
ROGER Wood
Appellant
and
The Information commissioner
Respondent
Decision: The appeal is dismissed
REASONS
Introduction
1.
This is an appeal against the Commissioner’s decision notice IC-388879-Q2R3 of 22 October 2025 which held that the London Borough of Lambeth (‘the Council’) was entitled to refuse to confirm or deny whether it held the requested information on the basis of regulation 13(5A)(a) (personal data) of the Environmental Information Regulations 2004 (EIR).
Factual background to the appeal
2.
In 2021 the Council issued an enforcement notice against the owner of the Property for installing a driveway without planning permission in accordance with section 172 of the Town and Country Planning Act 1990 (TCPA). Thereafter the Council refused a retrospective planning application in respect of the Property.
3.
Failure to comply with an enforcement notice may result in prosecution. Mr Wood wishes to know whether the Council has written to the owner of the Property about legal proceedings.
4.
The Council’s enforcement activities concerning the Property generated a lot of correspondence between Mr Wood and the Council. On 22 November 2021 Mr Wood informed the Council that the boundary wall of the Property had been partly demolished by a vehicle crashing into it that day. Further, Mr Wood informed the Council that following his enquires to it regarding the enforcement matter, in August 2024 his vehicle was damaged and on 11 April 2025, his property was subjected to arson. The latter is being investigated by the Metropolitan Police.
5.
Between 1 April 2025 and 9 July 2025 Mr Wood made several information requests to the Council concerning the enforcement matter regarding the Property, and two requests under the Data Protection Act 2018 (DPA), one formal complaint and eight Members’ Enquiries. In addition Mr Wood contacted the Local Government and Social Care Ombudsman (the Ombudsman) and his local MP about the Council’s enforcement activities in respect of the Property.
Request and response
6.
Mr. Wood has made a number of requests for information. The requests about which he complained to the Commissioner and which are therefore within our jurisdiction are those requests in which he has sought confirmation as to whether or not communications were sent to the owner or occupier of ‘address A’ between 19 March 2025 and 11 April 2025 regarding a planning enforcement case.
7.
Mr Wood had previously made a subject access request. His request of 22 April 2025 read as follows:
“Further to my original request, I would like to formally request copies of all communications—including letters, emails, internal memos or records of phone calls— between Lambeth Council and the owner or occupier of [“address A” redacted], between 1st March 2025 and 11th April 2025, which relate to the planning enforcement case reference [reference number redacted].
In particular, I am requesting disclosure of any communications that: Refer to me by name [complainant’s name redacted],
Refer to my property at [“address B” redacted], or
Make any reference to my involvement in the planning breach report or subsequent enforcement action.”
8.
On 7 May 2025 the Council provided Mr Wood with a response to his previous subject access request.
9.
On 7 May 2025 Mr Wood wrote to the Council as follows:
“I am writing in response to the refusal to disclose communications between Lambeth Council and the owner of [address A], specifically between 19th March and 11th April 2025, which I requested under the Freedom of Information Act 2000 .
Your reply stated that these communications could not be disclosed as doing so would infringe the rights and freedoms of third parties. However, this response is inconsistent with previous FOI disclosures already made by the council. In the past, you have provided me with redacted copies of letters sent to [address A], specifically relating to enforcement activity linked to planning reference [number redacted]. Those documents were supplied in line with FOIA provisions, demonstrating that it is entirely possible for the council to redact third-party personal data while still complying with its legal obligation to disclose information.
This raises the following critical question:
What has changed in the council’s legal interpretation of FOIA that now prevents similar redacted disclosure?
My current FOI request is very narrowly focused. I am seeking:
Any correspondence between the council and [address A redacted] between 19 March and 11 April 2025,
• Specifically in relation to planning enforcement case [reference number redacted],
• And particularly any content that references me personally, either by name [complainant’s name redacted] or address [address B redacted]
This period is of significant public interest as it directly precedes the attempted arson attack…which is now the subject of a CID investigation. Whether or not my name, address, or identity was disclosed in council correspondence during this period is of crucial importance in understanding potential safeguarding failures and the council’s treatment of whistleblowers.
I therefore request that you either:
1.
Provide the correspondence with appropriate redactions, as you have previously done,
2.
Or clearly justify why the FOIA standard previously applied is now being denied in this case.”
10.
Mr. Wood wrote to the Council on 8 May 2025 as follows:
“For the sake of absolute clarity, I am writing to confirm that my current Freedom of Information request is simply seeking the same type of information previously provided to me by Lambeth Council under FOI in relation to the ongoing planning enforcement dispute at [address A redacted]. Previous FOI response attached for reference.
To reiterate:
I am asking whether there was any written communication — including emails, letters, notices, or internal records of correspondence between the council and the homeowner of [address A redacted] between 19th March 2025 and 11th April 2025, specifically in relation to planning enforcement case [reference number redacted].
If such correspondence exists, I am requesting:
• Confirmation of its existence, and
• A copy (with redactions if required), consistent with the council’s previous FOI disclosures.”
11.
Mr Wood wrote to the Council on 20 May as follows:
“I am writing to follow up on my email dated 8 th May 2025, in which I sought confirmation of any written communication between Lambeth Council and the owner of [address A redacted] between 19th March and 11th April 2025, in relation to enforcement case Ref: [number redacted].
As yet, I have received no response or acknowledgment.
To be absolutely clear, I am not requesting the personal data of third parties. I am requesting:
• Confirmation of whether such communication exists;
• And, if so, a copy of it (with redactions as appropriate), consistent with previous FOI responses issued by Lambeth Council.”
12.
On 23 May 2025 the Council responded to this correspondence, asserting that the information provided to Mr Wood in November 2024 should have been withheld under section 40 FOIA and refusing to provide the requested information.
13.
On 10 June 2025, the Council informed Mr Wood that a number of his requests should be dealt with under EIR and relied on regulation 13 to refuse to confirm or deny whether it held information within the scope of those requests.
Decision notice
14.
The Commissioner concluded that the requested information, if held, was likely to be information on measures covered by regulation 2(1)(c) because it was information relating to a planning matter. He therefore dealt with the matter under the EIR.
15.
The Commissioner concluded that confirming whether or not information was held would disclose personal data because confirming whether or not it had written to the owner/occupier of address A about the planning enforcement case between a particular set of enforcement dates would involve the disclosure of personal data of that individual, namely whether that individual had received a letter from the Council about a planning enforcement matter. The Commissioner considered that whether the individual had received such a letter is a matter of biographical significance for them.
16.
The Commissioner accepted that Mr Wood had a legitimate interest in understanding the specific actions the Council might have taken about a planning enforcement matter concerning a neighbouring property. He accepted that the Council confirming whether or not it held the requested information was necessary in order to meet that legitimate interest.
17.
The Commission accepted that property owners would not reasonably expect such specific details about complaints made about their property to be routinely disclosed under EIR. He recognised that there were particular and sensitive circumstances to this request which meant that the reasonable expectations of non-disclosure were even greater, because confirmation or denial could lead to inferences being drawn about that individual and alleged arson. The Commissioner accepted that this could have a harmful impact on the individual.
18.
The Commissioner said that he had significant sympathy with Mr Wood’s position. He accepted that confirmation or denial would contribute to transparency for Mr Wood on this issue, which is one which has a direct impact on his safety and well-being. The Commissioner said that co-ordination between the Council and the police is not one that should be facilitated by disclosure to the world at large under EIR.
19.
The Commissioner concluded that confirmation or denial would not be lawful and that the Council correctly relied on section 13(5A)(a) FOIA.
The grounds of appeal
20.
The grounds of appeal are, in summary:
20.1.
Mr Wood did not request personal data and the Commissioner was wrong to conclude that the fact of whether a letter had been sent discloses personal data.
20.2.
The public interest balance under regulation 13(2A) EIR favours disclosure
20.3.
The Commissioner failed to properly consider the background to the request.
The Commissioner’s response
21.
The Commissioner submitted that the focus of regulation 13(5A)(a) is on whether confirming or denying whether the information is held can be achieved without contravening any of the data protection principles.
22.
The Commissioner said that the EIR requests contain the full address of the owner of the Property and the associated planning enforcement reference so that, together with information known to others including those who live in the vicinity of the Property, the owner can be identified. The Commissioner maintains that confirming or denying whether such correspondence is held risks revealing, to the world under the EIR, if the owner of the Property received correspondence from the Council about a planning enforcement matter contrary to their reasonable expectations of privacy.
23.
The Commissioner said that he considers that the presumption in favour of disclosure in regulation 12(2) EIR does not apply when handling a request for personal data.
24.
The Commissioner submitted that any arguments in support of a public interest in the relevant confirmation or denial were not applicable because regulation 13(5A)(a) is an absolute exception and so is not subject to a public interest test.
25.
To the extent that Mr Wood challenges the Commissioner’s assessment of the legitimate interests in confirming or denying whether the requested information is held and balancing them against the rights and freedoms of the data subject (the owner of the Property) for the purposes of Article 6(1)(f) UK GDPR, the Commissioner noted:
25.1.
The Commissioner accepted that Mr Wood was pursuing a legitimate interest in understanding the specific actions the Council may have taken about a planning enforcement action concerning a neighbouring property.
25.2.
The Commissioner said that he had carefully considered Mr Wood’s submissions and the sensitive context to his request.
25.3.
The Commissioner accepted that confirming or denying was necessary.
25.4.
The Commissioner noted that the Council had advised the appellant that his details were held in confidence, which should allay Mr Wood’s concerns that the Council had disclosed his name, address or identity to the owner of the Property.
25.5.
The Commissioner noted that Mr Wood had used less privacy intrusive means of holding the Council to account by submitting a formal complaint to the Council and reporting the Council to the Ombudsman and his MP.
26.
The Commissioner submitted that in balancing the legitimate interests and the data subject’s interest’s or fundamental rights and freedoms for the purposes of Article 6(1)(f) UK GDPR, he considered factors relevant to the circumstances of this case and that the weight given to those factors in favour of proving confirmation or denial was fully appropriate: significant, but not such as to outweigh the harm to the data subject’s interests and privacy rights caused by providing confirmation or denial to the world under the EIR.
27.
The Commissioner submitted that there is no presumption that the openness and transparency of the activities of public authorities should take priority over personal privacy.
28.
The Commissioner submitted that if the tribunal disagrees that providing confirmation or denial would be lawful, it must go on to consider whether such processing would be fair and transparent.
Legal framework
29.
The relevant provisions of the EIR are regulations 12 and 13(1)
Reg 5 Duty to make available environmental information on request
(1)
Subject to paragraph (3) and in accordance with paragraphs (2), (4), (5) and (6) and the remaining provisions of this Part and Part 3 of these Regulations, a public authority that holds environmental information shall make it available on request.
Reg 12 Exceptions to the duty to disclose environmental information
(1)
Subject to paragraphs (2), (3) and (9), a public authority may refuse to disclose environmental information requested if—
(a)
an exception to disclosure applies under paragraphs (4) or (5); and
(b)
in all the circumstances of the case, the public interest in maintaining the exception outweighs the public interest in disclosing the information.
(2)
A public authority shall apply a presumption in favour of disclosure.
(3)
To the extent that the information requested includes personal data of which the applicant is not the data subject, the personal data shall not be disclosed otherwise than in accordance with regulation 13.
…
Regulation 13 Personal data
(1)
To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if—
(a)the first condition is satisfied, or
(b)the second or third condition is satisfied and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.
(2A)
The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—
(a)would contravene any of the data protection principles, or…
…
(5A)
For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that—
(a)
the condition in paragraph (5B)(a) is satisfied, or
…
(5B)
The conditions mentioned in paragraph (5A) are—
(a)giving a member of the public the confirmation or denial—
(i)
would (apart from these Regulations) contravene any of the data protection principles, or
…
30.
Personal data is defined in s 3(2) of the Data Protection Act 2018 (DPA) as:
Any information relating to an identified or identifiable living individual
31.
‘Identifiable’ means a living individual who can be identified, directly or indirectly. It must be possible to identify an individual using all the information that is reasonably likely to be used, including information that would be sought out by a motivated inquirer. Identifying a pool that contains or may contain a person is insufficient. It is not sufficient to say that a person is reasonably likely to be covered by the data ( NHS Business Services Authority v Information Commissioner and Spivak [2021] UKUT 192 (AAC) ).
32.
Article 5(1) UKGDPR states that personal data must be processed ‘lawfully and fairly’. In order to be lawful, one of the lawful bases of processing in article 6(1) GDPR must apply. The only potentially relevant basis here is article 6(1)(f):
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.
33.
The case law on article 6(1)(f)’s predecessor established that it required three questions to be answered, which we consider are still appropriate if reworded as follows:
1.
Is the data controller or a third party pursuing a legitimate interest or interests?
2.
Is the processing involved necessary for the purposes of those interests?
3.
Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?
The task of the Tribunal
34.
The tribunal’s remit is governed by s.58 FOIA. This requires the tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, whether she should have exercised it differently. The tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.
The issues
35.
The issues we have to determine are:
35.1.
Would confirming or denying that the requested information was held disclose personal data?
35.2.
Would confirming or denying that the requested information was held breach any of the data protection principles:
35.2.1.
Are the conditions in 6(1)(f) met i.e.
35.2.1.1.
Is the data controller or the third party or parties to whom the data is disclosed pursuing a legitimate interest or interests?
35.2.1.2.
Is the processing involved necessary for the purposes of those interests?
35.2.1.3.
Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?
Evidence and submissions
36.
We have read an open and a closed bundle of documents, which we have taken account of where relevant.
Discussion and conclusions
37.
It is not in dispute that the requested information is environmental information.
38.
We have to consider what information would be revealed either by confirming that the information was held or by denying that the information was held. In this appeal it is a confirmation, rather than a denial, that would reveal personal information. If the Council confirmed that the requested information was held, that would reveal that it had communicated in writing with the owner about the enforcement case. An enforcement notice had been issued against the owner in 2021 and retrospective planning permission had been refused. It is an offence not to comply with an enforcement notice. A reasonable inference, if communication had taken place in the relevant period, is that the Council was at least considering taking further action against the owner, which could include prosecution for failure to comply or the use of the authority’s default powers to carry out the steps required in the enforcement notice.
39.
The owner is identifiable from the wording of the request. The information that would be revealed by a confirmation that the information was held, as set out in the previous paragraph, has the owner as its focus. It relates to and is obviously about the owner. We find that it is the personal information of the owner.
40.
We accept that there is a general legitimate interest in ensuring that the Council takes appropriate steps in enforcing planning law. We do not accept that disclosure of this particular information is reasonably necessary for the purposes of that legitimate interest. There are other ways of holding the Council to account including formal complaints to the Council and to the Ombudsman.
41.
We accept that Mr Wood has an individual legitimate interest in understanding the actions the Council may have taken about a planning enforcement matter concerning a neighbouring property. We find that disclosure is reasonably necessary for the purposes of that legitimate interest, because it would enable Mr Wood to understand whether or not the Council was taking steps to ensure that the enforcement notice was effective.
42.
Mr Wood also has a separate individual legitimate interest in understanding the circumstances in the period leading up to the arson attack on his property on 11 April 2025. Disclosure of the requested information would not tell Mr Wood who was responsible for the arson attack, but we accept that it would help him to understand whether there was any correspondence from the Council just before the attack. We accept that disclosure is reasonably necessary for that purpose.
43.
We accept that there is a general legitimate interest in the police having access to any relevant evidence to support their investigation. We do not accept that disclosure is reasonably necessary for the purpose of the legitimate interest. A complaint has been made to the police. The police have powers to obtain relevant evidence from the Council for the purposes of their investigation and could obtain any such correspondence if they thought it relevant. It is not reasonably necessary to disclose any such correspondence to the world for the purposes of the criminal investigation.
44.
Having concluded that disclosure is reasonably necessary for the purposes of some of the legitimate interests, we have considered whether those interests are outweighed by the fundamental rights and freedoms of the owner.
45.
Criminal offence data is treated as particularly sensitive by the UK GDPR. This is not criminal offence data, but confirmation would lead to a reasonable inference that the Council was at least considering taking further action against the owner, which could include prosecution for failure to comply or the use of the authority’s default powers to carry out the steps required in the enforcement notice. For those reasons we take the view that there is a particularly strong legitimate expectation that this information would not be made public. We do not have any evidence of the views of the owner, but we find that a reasonable person would be likely to suffer some upset if the Council made public that they were at the early stages of considering taking further action which could include prosecution for failure to comply or the use of the authority’s default powers to carry out the steps required in the enforcement notice.
46.
Given the lack of a more general public legitimate interest in disclosure, taking into account the ability of the police, if they wished, to obtain any such information in the course of their investigation and taking account of the sensitivity of the personal information and the other matters set out above, in our view the legitimate interests in disclosure are overridden by the interests or fundamental rights and freedoms of the data subject.
47.
For those reasons the public authority was entitled to neither confirm nor deny that the information was held and the appeal is dismissed.
Signed Sophie Buckley Date: 21 May 2026
Judge of the First-tier Tribunal