First-tier Tribunal (General Regulatory Chamber)

First-tier Tribunal

(General Regulatory Chamber)

Information Rights

NCN: [2023] UKFTT 723 (GRC)

Appeal Reference:  EA/2023/0060

 

Decided without a hearing

On 23 August 2023

 

Before

 

Judge ANTHONY SNELSON

TRIBUNAL MEMBER EMMA YATES

TRIBUNAL MEMBER ANNE CHAFER

 

 

Between

 

EMYR GWYN

Appellant

and

 

THE INFORMATION COMMISSIONER

Respondent

 

 

 

Decision

 

 

The unanimous decision of the Tribunal is that the appeal is dismissed.

 

 

Reasons

 

Introduction

 

1.                  The Appellant, Mr Emyr Gwyn, lives in Cardiff. In late 2021 or early 2022 his next-door neighbour had some building work carried out, which included the construction of a Dormer extension. It seems that this resulted in some damage to Mr Gwyn’s property.

 

2.                  On 13 February 2022 Mr Gwyn wrote to Cardiff Council (‘the Council’) requesting information in the following terms:

 

This is a request for information under the Environmental Information Regulations 2004 (the EIR) for the release of specific documents within the building control file for [address redacted]. I am the owner of [address redacted], which is the neighbouring property.

 

A: The information requested:

 

1. The building notice, along with the particulars and plans submitted under Regulation 13(1) and/or Regulation 13(2) of the Building Control Regulations 2010; and

 

2. All documents submitted and information held by the Council in respect of the following parts to Schedule 1 of the Building Regulations 2010 …

 

[Particular classes of information were specified]

 

3. Completion Certificate under Regulation 17 of the Building Control Regulations 2010.

 

3.                  The Council responded on 18 March 2022, refusing to disclose the information requested on the basis that it amounted to the personal data of the adjoining homeowner and citing the Environmental Information Regulations 2004 (‘EIR’), reg 13.

 

4.                  Mr Gwyn took issue with the Council’s response but, following an internal review (which seems to have been the subject of an unreasonable delay), it maintained its position.

 

5.                  Mr Gwyn then complained to the Respondent (‘the Commissioner’). An investigation followed. 

 

6.                  By a decision notice dated 31 January 2013, the Commissioner determined that the Council had correctly applied EIR, reg 13 and Mr Gwyn was not entitled to the disputed information.

 

7.                  By a notice of appeal dated 5 February 2023, Mr Gwyn challenged the Commissioner’s adjudication on a number of grounds.

 

8.                  The Commissioner resisted the appeal in a response dated 3 April 2023.

 

9.                  Mr Gwyn replied to the Commissioner’s response in two replies, the first undated and the second erroneously dated 13 February 2023.

 

10.              The appeal came before us for consideration on the papers, both parties being content for it to be decided without a hearing. We were satisfied that it was just and in keeping with the overriding objective to proceed in that way.

 

 

 

The Statutory Framework

 

EIR

 

11.              EIR, reg 5  includes:

 

(1)           Subject to paragraph (3) … a public authority that holds environmental information shall make it available on request.

…

 

(3)                To the extent that the environmental information requested includes personal data of which the applicant is the data subject, paragraph (1) shall not apply to those data.

 

12.              EIR, reg 12 makes provision for exceptions to the duty to disclose environmental information. It includes:

 

(2)                A public authority shall apply a presumption in favour of disclosure.

 

(3)                To the extent that the information requested includes personal data of which the applicant is not the data subject, the personal data shall not be disclosed otherwise than in accordance with regulation 13.

 

13.              EIR, reg 13 includes:

 

(1)           To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if -

                (a)           the first condition is satisfied …

 

(2A)        The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—

(a)           would contravene any of the data protection principles …

 

14.              The language and concepts of the data protection legislation are translated into the Regulations (reg 2). The exceptions under reg 13 are unqualified and the familiar public interest balancing test has no application.  Rather, the reach of the exceptions is, in some circumstances, limited by the data protection regime.

 

The data protection legislation

 

15.              The data protection regime under the Data Protection Act 2018 (‘DPA 2018’) and the General Data Protection Regulation (‘GDPR’) applies to this case.      

 

16.              DPA 2018, s3 includes:

 

(2)        “Personal data” means any information relating to an identified or identifiable living individual ...

 

(3)        “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to —

(a)        an identifier such as a name, an identification number, location data or an online identifier …

            

(4)        “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as —

…        

(d)        disclosure by transmission, dissemination or otherwise making available …

 

(5)        “Data subject” means the identified or identifiable living individual to whom personal data relates.

 

17.              GDPR, Article 5 sets out the data protection principles. It includes:  

 

Personal data shall be:

1.                   processed lawfully, fairly and in a transparent manner in relation to the data subject …

18.              Article 6, so far as material, provides:

 

1.                   Processing shall be lawful only if and to the extent that at least one of the following applies:

 

…

(f)             processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

 

The Tribunal’s powers

 

19.              The appeal is brought pursuant to the FOIA, s57.  The Tribunal’s powers in determining the appeal are delineated in s58 as follows: 

 

(1)           If on an appeal under section 57 the Tribunal consider -

                               

(a)           that the notice against which the appeal is brought is not in accordance with the law; or

(b)          to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

 

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner, and in any other case the tribunal shall dismiss the appeal.

 

(2)           On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.

 

Case-law

 

20.              It is well-established that, where they intersect, privacy rights hold pride of place over information rights. Under EIR, the legislative bias in favour of privacy rights over information rights is explicit in the statutory language itself: the presumption in favour of disclosure (reg 12(2)) is subordinated to the absolute prohibition on disclosure of personal data save where reg 13 permits it (reg 12(3)). It is otherwise under the freedom of information statutes, but the law is to the same effect. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded.  At para 7 he commented:

 

In my opinion there is no presumption in favour of release of personal data under the general obligation that FOISA [1] lays out. The references which that Act makes to provisions of [the Data Protection Act] 1998 must be understood in the light of the legislative purpose of that Act, which was to implement Council Directive 95/46/EC. The guiding principle is the protection of the fundamental rights and freedoms of persons, and in particular their right to privacy with respect to the processing of personal data … 

 

This statement of principle is of equal application today, notwithstanding the fact that the Data Protection Act 1998 has been superseded.

 

21.              It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, ‘necessary’ means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be ‘necessary’ there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, ‘necessity’ is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.

 

22.              The Upper Tribunal has held (also under the pre-1998 data protection legislation) that it is legitimate to consider at the outset the first part of (what is now) the test under Articles 5 and 6 (fair and lawful processing), before addressing (if need be) the remainder of the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para 20). It follows that, if the Tribunal finds that granting a request for personal data would not entail fair and lawful processing, disclosure must be refused without more, and the balancing proviso under Article 6.1(f) does not come into play.

 

 

 

 

Analysis and Conclusions

 

Personal data?

 

23.              Does the information requested include personal data of which Mr Gwyn is not the data subject? Mr Gwyn rightly did not dispute that it included the personal data of the owner of the adjoining property. It includes, among other identifiers, the name and address of that person.

 

24.              But Mr Gwyn put forward a different, and surprising, argument. He contended that the information requested was also (or included) his personal data. The fact that it is of interest to him does not make it his personal data. Having regard to DPA 2018, s3(2) and (3)(a), we doubt whether it could have amounted to his personal data. Nor, in any event, could the point avail him. On the contrary, if he was right, the inevitable consequence would be that, in so far as the information sought comprised his personal data, his right to have it disclosed to him through EIR would have been barred by reg 5(3). Our powers are circumscribed by the environmental information jurisdiction and it would be idle for us to speculate as to whether access to the information requested, or any part of it, might be open to him by some other legal route.

 

25.              Accordingly, unless processing of the information would be fair and lawful under GDPR, Article 5, the exception under EIR reg 13(1) applies.   

 

Fairness?

 

26.              Would processing be fair? In our judgment, it would not. We have several reasons. First, we agree with the Commissioner that, in all probability, the adjoining owner would have been confident that his/her Building Control dealings with the Council would not be disclosed to third parties. There is no evidence pointing to any different expectation.

 

27.              Second, that expectation was a wholly reasonable one. There was no suggestion that the Council had said or done anything to cause him/her to perceive any risk to his/her privacy. Its settled practice was not to make Building Control applications public.

 

28.              Third, disclosure of the disputed information would have entailed a substantial interference with the adjoining owner’s right to privacy, extending to information about the dimensions and layout of the property and the nature of the building works. Such information would have been sufficient to support reasoned speculation about the cost of the building work and, possibly, the capital value of the property as a whole. 

 

29.              Fourth, that interference would have been all the more substantial for the fact that disclosure under EIR (and FOIA) is disclosure to the whole world, with no duty of confidence attaching to the immediate recipient of the information or anyone coming into possession of it thereafter.

 

30.              Fifth, the factors considered next in relation to lawfulness also bear on the question of fairness and, in our view, lend additional support to our view that the data processing here sought by Mr Gwyn would not be fair.   

 

Lawfulness?

 

31.              We now turn to the question under GDPR, Articles 5 and 6 of lawful processing.  Was processing necessary (ie reasonably necessary) for the purposes of any legitimate interest pursued by the Council or any third party (including Mr Gwyn)? We are satisfied that it was not. Again, we have several reasons. In the first place, while we fully accept that Mr Gwyn had (and has) a legitimate interest in protecting his property from damage and in protecting his financial wellbeing, we have been careful to remind ourselves of the scope and nature of the data processing here under contemplation. It is concerned with the Building Control regime. What is notably lacking is an allegation (express or even implicit) that that regime has somehow malfunctioned, let alone evidence of any malfunction. Rather, what seems to underlie these proceedings is a desire on the part of Mr Gwyn for information to inform an assessment as to whether some sort of claim or remedy may be open to him. In these circumstances, it seems to us that there are obvious difficulties in getting his case on necessity off the ground.

 

32.              Second and in any event, the Building Control regime comes with an enforcement mechanism attached. It is open to the citizen to press the Council to operate the mechanism where the applicable regulations have been, or are believed to have been, contravened. If need be, the citizen may invoke the Council’s complaints procedure to that end. Beyond that, judicial review may serve as an alternative remedy if it is said that the Council has failed to perform any of its statutory functions.   

 

33.              Third, as the Commissioner points out, aggrieved citizens may also have recourse to the Public Service Ombudsman for Wales, provided that their concerns fall within the scope of that office. Like the complaints procedure, this represents a much less intrusive measure than the relief which Mr Gwyn seeks. As noted above, to be ‘necessary’, disclosure must be ‘the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question’. We see no reason to dismiss the available machinery as inadequate to address a clear and coherent complaint, if one is made.

 

34.              Fourth, if any actionable damage has been done to his property, Mr Gwyn may in principle have a good claim against his neighbour at common law. There seems to be no ground for supposing that any such claim, if contemplated (none has been intimated), would be materially affected by the information which he has requested. But in any event, any relevant Building Control documents would be disclosable in such civil proceedings. (And such disclosure would not be to the whole world, but subject to the rules limiting the use of disclosure given in civil proceedings.)  

 

35.              Fifth, Mr Gwyn mentioned the Party Wall Act 1996. It is not our place to comment on matters outside our jurisdiction. That legislation may (or may not) provide a means of resolving his concerns. But we do not see that this possibility has any bearing upon the appeal before us and, in particular, the ‘necessity’ point which we are here addressing.    

 

36.              Sixth, we readily accept that there is a strong social interest in ensuring high standards in the discharge by local authorities of their statutory duties.  Many means exist by which proper scrutiny is applied. And since 2000 those means have included the right of citizens to probe local authorities through freedom of information requests. But disclosure of the material under consideration in this appeal could do nothing to serve the wider social interest to which we have referred.

 

37.              Seventh, nor would we acknowledge any wider social need for public disclosure of Building Control information generally. We share the Commissioner’s view that, by and large, such information is treated by local authorities as private and managed in a confidential way. We agree that public trust and confidence would be undermined if the system was otherwise. By contrast, planning applications, which often have a greater impact on the local environment, are rightly treated as matters of general interest and published accordingly.  It seems to us that the different treatment of these two forms of control strikes a sensible balance between privacy and information rights within localities.    

 

38.              Accordingly, it is clear to us that, at the time of the refusal, the disclosure contended for was not reasonably necessary, or indeed necessary at all,

 

Outcome

 

39.              For all of these reasons, we conclude that the data processing for which Mr Gwyn contends would be neither fair nor lawful.

 

40.              It follows that the exception under EIR, reg 12(3) read with reg 13(1)(a) is engaged. The Council was prohibited from disclosing the information requested. The Commissioner’s decision was correct.  

 

 

 

 

 

Disposal

 

41.              The appeal must be dismissed. 

 

 

 

 

 

(Signed)        Anthony Snelson

 

Judge of the First-tier Tribunal

 

Dated: 30 August 2023

 

Promulgated: 04 September 2023