First-tier Tribunal (General Regulatory Chamber)

Neutral citation number: [2024] UKFTT 22 (GRC)

 

 Case Reference: EA/2023/0141

First-tier Tribunal

General Regulatory Chamber

Information Rights

 

Decided without a hearing 

 

On: 19 December 2023

Decision given on: 10 January 2024

 

Before

 

TRIBUNAL JUDGE HAZEL OLIVER

TRIBUNAL MEMBER ANNE CHAFER

TRIBUNAL MEMBER KATE GRIMLEY-EVANS

 

Between

 

DARBARI RACHHPAUL SINGH BEDI

Appellant

and

 

INFORMATION COMMISSIONER

Respondent

 

Decision: The appeal is Dismissed

 

 

REASONS

 

Background to Appeal

 

1.      This appeal is against a decision of the Information Commissioner (the "Commissioner") dated 2 March 2023 (IC-210951-C0T1, the "Decision Notice").  The appeal relates to the application of the Environmental Information Regulations 2004 ("EIR").  It concerns information about a Penalty Charge Notice requested from London Borough of Ealing (the "Council").

 

2.      The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).

 

3.      On 18 January 2021, the Appellant wrote to the Council and requested the following information, with reference to the Freedom of Information Act 20000 (the "Request"):

 

       "Pursuant to the aforesaid Act, I request you to provide me with full and frank disclosure(s) by way of evidence as a matter of urgency, for me to consider my position as the act allows.

 

       1) I request you to forward to me the evidence that there was a valid notice displayed as and when the road layout was altered/amended.

       2) Please confirm that the notice was clearly displayed and was visible with evidence in support.

       3) I request you to forward to me the CD of the alleged offence.

       4)  I request you to forward the application that was made to the Local Authority and or other Authorities to have the prohibition on the said road.

       5) I request you to forward to me a copy of the said Application.

       6) I request you to forward the copy of the Grant of the Application.

       7) I request you to forward the copy of the Notice that was served in accordance with the law.

       8) I request you to forward the copy of the Planning Application.

       9) I request you to forward the Grant of the Application.

       10) Please confirm the date of the service of the said cameras, which allegedly took pictures of my car, allegedly entering [name redacted] Avenue/[name redacted] avenue when prohibited.

       11) Please provide the evidence in support.

       12) Please provide the full name and address of the company who serviced the said camera(s).

       13) Please provide the full name and address of the person who carried out the said service.

       14) Please confirm the relationship of the person who serviced the said camera(s) with the said company who carried out the service on the said camera(s).

       15) Please confirm if the said cameras are compliant with the act.

       16) Please forward the evidence in support.

       17) Please provide the copy of the Calibration Certificate with a Statement of Truth.

       18) Please forward the full name and address of the person who prepared the CD and first obtained the evidence.

       19) Please forward the full name and address of the person who developed the said evidence.

       20) Please forward the full name and address of the company who developed the evidence.

       21) Please confirm the date when these road markings were painted.

       22) Please confirm the name of the company who painted these road markings.

       23) Please confirm if these road markings comply with the Act as allowed.

       24) Please supply the evidence in support of all requests without exceptions

 

4.      The Council responded on 23 March 2021. They treated this as a request under the EIR and answered all of the questions except for 13, 18, 19 and 20.  This information was withheld under regulation 13(1) EIR (personal data).   

 

5.      The Appellant requested an internal review on 6 April 2021.  The Council responded on 8 December 2022.  They answered question 20 but continued to withhold the information requested in questions 13, 18 and 19 under regulation 13(1).

 

6.      The Appellant complained to the Commissioner on 10 December 2022.  The Commissioner decided that the Council had breached the timescale requirements for responding to both the Request and the review.  However, the Council had correctly applied regulation 13(1) EIR. The Commissioner was satisfied that disclosure would not be lawful as it would be in breach of the first data protection principle on the grounds that there was an insufficient legitimate interest to outweigh the data subject's fundamental rights and freedoms. This was on the basis that:

 

a.         The request, in the context whereby the Appellant was already aware of the relevant departmental address, was for the names and personal / home addresses of the employees involved in processing the Penalty Charge Notice

b.         Disclosure under EIR (and to the world at large therefore) is not necessarily the appropriate route to obtain such information.

c.         The data subjects, who are not senior members of staff, would have a reasonable expectation their personal data would not be disclosed to the wider world in response to an EIR request, and such disclosure would be likely to cause them harm or distress.

d.         There is no wider public interest to weigh in favour of disclosure, it is only the Appellant's personal interest in relation to preparing a case against the Council.

 

The Appeal and Responses

 

7.      The Appellant appealed on 11 March 2023.  His grounds of appeal are:

 

a.         The provision of names and an address for service is for a legitimate purpose and necessary to the effective preparation of his case against the Council.

b.         His legitimate interests outweigh the rights and freedoms of the data subjects.

c.         There is no evidence from the Council of:

i.      any negative consequence against the data subjects,

ii.     the data subjects' reasonable expectations and how these would be adversely affected by disclosure,

iii.    the likely damage caused,

iv     how the information and the circumstances in which it was obtained justifies non-disclosure, and

iv.    how the FOIA principles of transparency and accountability are violated by disclosure.

 

8.      The Commissioner's response maintains that the Decision Notice was correct.  The Commissioner now takes the position that disclosure of the data subjects' names and addresses under EIR is not reasonably necessary, as well as maintaining that there was an insufficient legitimate interest to outweigh the data subjects' fundamental rights and freedoms.

 

Applicable law

 

9.      The relevant provisions of the Environmental Information Regulations 2004 ("EIR") are as follows.

 

       2(1)          ..."environmental information" has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on—

                        (a)   the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

                        (b)  factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in (a);

                        (c)  measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in (a) and (b) as well as measures or activities designed to protect those elements;

       ......

       5(1)           ...a public authority that holds environmental information shall make it available on request.

       ......

       12(3)         To the extent that the information requested includes personal data of which the applicant is not the data subject, the personal data shall not be disclosed otherwise than in accordance with regulation 13.

       ......

       12(4)         ...a public authority may refuse to disclose information to the extent that –

(a)  it does not hold that information when an applicant's request is received.

       ......

       13(1)         To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if— (a) the first condition is satisfied...

       ......

       13(2A)      The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations— (a) would contravene any of the data protection principles...

      

10.   Requests for environmental information are expressly excluded from the Freedom of Information Act 2000 ("FOIA") in section 39 and must be dealt with under EIR, and it is well established that "environmental information" is to be given a broad meaning in accordance with the purpose of the underlying Directive 2004/4/EC.  Although the Request was made under FOIA, we are satisfied that this request falls within EIR.  We also note that the test for withholding personal data due to contravention of any of the data protection principles is the same under the EIR as under FOIA.

 

11.   Section 3(2) of the Data Protection Act 2018 ("DPA") defines "personal data" as "any information relating to an identified or identifiable living individual".   The "processing" of such information includes "disclosure by transmission, dissemination or otherwise making available" (s.3(4)(d) DPA), and so includes disclosure under EIR.

 

12.   The data protection principles are those set out in Article 5(1) of the General Data Protection Regulation ("GDPR"), and section 34(1) DPA.  The first data protection principle under Article 5(1)(a) General Data Protection Regulation (GDPR) is that personal data shall be: "processed lawfully, fairly and in a transparent manner in relation to the data subject".  To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) GDPR.  These include where "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." (Article 6(1)(f)).

 

13.   This involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):

(i)         Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii)        Is the processing involved necessary for the purposes of those interests?

(iii)      Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and GDPR.  This should now reflect the words used in the GDPR - whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

 

14.   In Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC), Upper Tribunal Judge Wikeley set out eight propositions taken from case law as to the approach to answering these questions.  These include: "necessity" carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity; the test is one of "reasonable necessity", reflecting European jurisprudence on proportionality; and this involves the consideration of alternative measures, so the measure must be the least restrictive means of achieving the legitimate aim in question.

 

Issues and evidence

 

15.   The issue is whether the Council was entitled to rely on regulation 13(1) EIR to withhold the names and addresses requested in questions 13, 18 and 19 of the Request.

 

16.   By way of evidence and submissions we had an agreed bundle of documents, which included the appeal and response.  We have read this and have taken it into account in making our decision.

 

Discussion and Conclusions

 

17.   Personal data must not be disclosed under EIR if this would contravene any of the data protection principles.  We have considered whether processing of this data through disclosure under EIR would be lawful under Article 6(1)(f) GDPR.

 

18.   Having considered question 13 in the context of the Council's overall response to the Request, it appears that the Council does not actually hold this information.  Question 13 asks for the full name and address of the person who carried out the service of cameras which took pictures of the Appellant's car.  The answers to questions 10, 11 and 12 indicate that no such annual service took place as it was a mobile camera.  The response to the review request also confirms that mobile cameras are not serviced.   It therefore appears that request 13 could have been refused under regulation 12(4), on the basis the information was not held.  There can be no public interest in disclosure where the information is not held at all.  We therefore find that the Council was entitled to refuse to reply to question 13 as the requested information was not held by them at the time of the Request.

 

19.   We have gone on to consider the exception for personal data for questions and 18 and 19, as it appears that information is held which relates to employees of the Council.

 

20.   Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?  The Appellant says that he has a legitimate purpose - obtaining names and addresses for service so that individuals can be called as witnesses in civil litigation.  The Commissioner says there is a very limited legitimate interest in obtaining the full name and home addresses of the data subjects, when it is the Council that ultimately bears responsibility, and any liability, in respect of the issuing of the Penalty Charge Notice and the actions of its employees.

 

21.   We accept the Appellant has a legitimate interest in obtaining names and addresses of individuals involved in issuing the Penalty Charge Notice for the purposes of a claim against the Council.  Although not necessarily needed for the purposes of his claim, it is possible that the Claimant might want to call them as witnesses in the proceedings.

 

22.   Is the processing involved necessary for the purposes of those interests?  The Appellant says that obtaining names and addresses for service is necessary for the effective preparation of his case against the Council.  The Commissioner says that there is no pressing social need warranting the disclosure of the data subjects' name and addresses under EIR, free from any duty of confidentiality and in turn available to the world or any other requestor. The Commissioner also says that this would not be the least restrictive means of achieving the Appellant's interest in the information.  To the extent the data subjects' names and addresses are relevant to any litigation, they could be obtained by way of an application to the Court that could determine the merits of any such application and impose appropriate restrictions.

 

23.   We have considered whether disclosure is reasonably necessary for the purposes of the Appellant's legitimate interests in the names and addresses.  We find it is not.  In relation to personal addresses for the purpose of service of court documents and/or requests for witness statements or witness orders, this is not necessary because the individuals are employees of the Council and so could be contacted at the Council's address.  It is also unclear whether and to what extent individual witnesses from the Council would need to be contacted or served with court paperwork by the Appellant in circumstances where any claim is against the Council, not the individuals.  There is the less restrictive alternative means of obtaining appropriate orders from the court if this is genuinely required, which would not involve disclosing names and personal addresses to the world at large under EIR.

 

24.   Are such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?  Although we have found that disclosure would not be reasonably necessary, we have gone on to consider this issue as well. 

 

25.   The Appellant says that in this instance his legitimate interest outweighs the rights of the individuals.  As set out above, he says that the Council has failed to provide relevant evidence. The Commissioner says there is no wider public interest in the matters and the data subjects would not reasonably expect their names and addresses to be disclosed under EIR in response to a personal dispute the Appellant has with the Council over the issuing of a Penalty Charge Notice.  The Commissioner says that no evidence is required to substantiate this as it is a clearly a reasonable expectation that anyone in the shoes of the data subjects would expect. The Commissioner also says that it is entirely reasonable to envisage the data subjects suffering distress as a result, with reference to a separate decision of the Commissioner that parking operatives are a necessary requirement when it comes to parking enforcement and they should be able to go about their work without intimidation.

 

26.   We find that any legitimate interests in disclosure are overridden by the fundamental rights and freedoms of the data subject which require protection of personal data.  The interests here are personal only, there is no wider public legitimate interest.  The request involves very personal information of names and what must be home addresses (as the Appellant already knows the Council address for service).  These individuals would have no reasonable expectation of disclosure of this information to the world at large under EIR.   The context of their role working in the Parking Services department is relevant to this expectation. The Commissioner has referred to the context of parking enforcement where individuals are at risk of potential intimidation and/or retaliation.  We note from the content of the Request that this issue does not appear to be about parking, but rather a road driving offence.  Nevertheless, a similar point applies.  Individuals working in traffic enforcement may be particularly vulnerable to intimidation or retaliation if their names and addresses are released publicly in the context of their professional role.  They carry out a necessary role which may nevertheless be unpopular with certain members of the public.

 

27.   The Appellant has complained about a lack of evidence from the Council.  We note the Council's letter to the Commissioner during the investigation into the complaint (at page D83 in the bundle). This letter explains that disclosure would provide details that the individual works in parking services and their home address, leading to a risk of threats and intimidation. We agree with the Commissioner that further evidence is not required to substantiate the reasonable expectation of these individuals that their name and home address will not be released to the world at large in connection with their role.  This expectation is obvious in the context of their work.

 

28.   We therefore find that disclosure of the requested names and addresses would contravene the data protection principles because there is no lawful condition for processing under Article 6 GDPR.  The Council was entitled to rely on regulation 13(1) EIR to withhold the names and addresses requested in questions 18 and 19 of the Request.  They could also have relied on regulation 13(1) in relation to question 13 if the information was held.  However, as explained above it appears that the information was not held and so they could have relied on regulation 12(4) for question 13.

 

29.   The Appellant also complains that the Commissioner ought to have responded to four other concerns/matters (a previous contempt of court issue, the timing of when the Council produced a CD, the number of complaints against the Council, and his right to claim compensation with costs).  The Tribunal is not able to consider these issues.  Our role is limited to deciding whether the Commissioner's decision that the Council was entitled to rely on regulation 13(1) EIR was in accordance with the law.  We do not have power to consider the way in which the Commissioner reached his decision or procedural matters that the Appellant says the Commissioner should have addressed.

 

30.   We dismiss the appeal for the reasons explained above.

 

 

 

Signed: Judge Hazel Oliver                                                                Date:      7 January 2024