Roger Bird v The Information Commissioner

The Appellant represented a number of residents of Valleydene, a road in Southampton, in a dispute with the Hythe and Dibden Parish Council (“the Council”) over responsibility for maintenance of an underground sewer pipe. The Appellant is not a resident, but he has experience of and has campaigned about “riparian rights”, the legal interests of the owners of land on the bank of a natural watercourse.

A “private” meeting was arranged between the Council and residents to discuss the issue on 26 August 2021. Ten councillors attended with council officers and their solicitors, the Appellant and a number of Valleydene residents. The Council informed those present that it was recording the meeting.

On 27 August 2021, the Appellant made a request for information to the Council as follows:

“Under Article 15 of the GDPR the controller shall provide a copy of the personal data undergoing processing.

Please provide a copy of the recording of the meeting held with the Valleydene residents on 26th August 2021. As this request is made by electronic means the information should be provided in a commonly used electronic form.

Please provide confirmation as to whether or not personal data concerning are being processed, and, where that is the case, access to the personal data and the following information:

1.

the purposes of the processing;

2.

the categories of personal data concerned;

3.

the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

4.

where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

5.

the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

6.

the right to lodge a complaint with a supervisory authority;

Please pass this request on to the data controller if necessary. I should point out that there is a requirement to identify the data controller both on your website and your emails. The website does not contain the required link to the privacy notice on the home page and the link provided in the email footnote doesn't work.”

This request for information will be referred to in this Decision as the “Request”.

The Council responded to the Request on 27 August 2021 directing the Appellant to its privacy notice. The Council did not disclose the recording to the Appellant on the basis that it did not contain his personal data.

The Appellant made a second request to the Council in October 2021 for the legal advice they had received about the sewer pipe issue. That request was refused on 10 November 2021 on the basis that the information was exempt under section 42 Freedom of Information Act 2000 (“FOIA”) as subject to legal professional privilege.

The Appellant made a single complaint to the Commissioner about the Council’s responses to both requests on 8 December 2021.

The Commissioner wrote to the Council and the Appellant on 21 December 2021 about the Request, using reference IC-144995-X0X8. They advised the Council that the Request should be treated as a request for information under FOIA and directed it to carry out an internal review.

The Council upheld their refusal to disclose information in response to the Request on internal review on 31 January 2022. They stated that no information would be provided under the UK General Data Protection Regulation (“UK GDPR”) because the recording contained no personal data of the Appellant “other than his name”. The Request was also refused under FOIA on the basis that the recording contained personal information of the Valleydene residents. As the internal review had upheld the refusal to disclose, the Commissioner’s investigation continued.

The Appellant’s complaint in relation to his request for the Council’s legal advice was given a different reference by the Commissioner, IC-144936-F0L3. On 17 June 2022, the Appellant withdrew that complaint.

On 1 July 2022, the Commissioner issued Decision Notice IC-144995-X0X8 in relation to the Request. The Commissioner upheld the Council’s refusal to disclose the recording under section 40(2) FOIA on the basis that it was personal data of the individuals who attended the meeting. There was a legitimate interest in disclosing the information and disclosure was necessary to meet that interest; however, the legitimate interest was outweighed by the fundamental rights and freedoms of the individuals who attended the meeting. Those individuals had a “strong and reasonable expectation that the information they provided during the meeting will remain confidential” [paragraph 15].

On the same day, the Appellant responded to the Commissioner, protesting that he had withdrawn his complaint in relation to the Request. He was advised that the Decision Notice could only be withdrawn if he appealed, and he therefore appealed to the Tribunal on the grounds that the Request had been wrongly treated as a request for information under FOIA and not as a subject access request under UK GDPR.

In its Response, the Commissioner relied on its Decision Notice.

In Reply, the Appellant complained about the consequences of the publication of the Decision Notice on his relationship with the Council and submitted that:

In reaching its decision, the Tribunal took into account all the evidence before it. The Tribunal had before it an open bundle of 85 pages and a closed bundle of 4 pages. Our findings were made on the balance of probabilities.

The Tribunal did not have a copy or transcript of the recording of the meeting on 26 August 2021.

The appeal came before us for determination on the papers. The Appellant stated in his Notice of Appeal that he wanted his appeal decided on the papers, and the Commissioner agreed. The Appellant subsequently, in his Reply, “invited the Tribunal to consider” whether an oral hearing would be appropriate “in view of the complexity of the case”, but did not withdraw his consent to a paper determination.

The Tribunal therefore considered whether to adjourn for an oral hearing and/or to direct the parties to provide a copy or transcript of the meeting. In doing so, we are required to apply the overriding objective in Rule 2 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2008 which is to deal with cases fairly and justly. Rule 2(1)(e) requires us to avoid delay so far as compatible with proper consideration of the issues and Rule 2(1)(a) requires us to deal with cases in ways which are proportionate to the importance of the issues, avoiding unnecessary formality and seeking flexibility.

It appears that neither party to the proceedings has a copy of the recording. In order to obtain a copy, the Commissioner would have to be directed to obtain the recording from the Council, or the Council would have to be joined as a party. A Rule 14 Order would then have to be made and a closed bundle created. A further session would have to be arranged for the Tribunal with either a completely new panel or at a time when all three members of the current panel were available, causing further delay. All in circumstances where the discussions between the Council and residents about the sewer pipe have moved on and the Appellant had intended to withdraw his complaint over six months ago, before the Decision Notice was even issued.

The Tribunal decided on balance taking these factors into account that we had sufficient information to properly determine the issues without an oral hearing and without a copy or transcript of the recording, and that it was fair and in the interests of justice to do so.

For the reasons set out in paragraphs 33-34 below, the Tribunal found that the Environmental Information Regulations 2004 (‘EIR’) applied to the Request and not FOIA.

Regulation 2(1) EIR provides that:

Regulation 5 EIR provides that:

Regulation 12(3) EIR provides:

Regulation 13 EIR provides:

The first data protection principle in Article 5(1)(a) UK GDPR is that personal data shall be:

Article 6(1) UK GDPR provides that:

Article 4(11) UK GPDR provides that consent means:

For the purposes of EIR and UK GDPR, personal data is defined in Section 3 of the Data Protection Act 2018 (“the DPA” as follows:

The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA, as follows:

The Tribunal stands in the shoes of the Commissioner and takes a fresh decision on the evidence before us. The Tribunal does not undertake a review of the way in which the Commissioner’s decision was made.

This issue for the Tribunal in this appeal is whether Decision Notice IC-144995-X0X8 is in accordance with the law and whether the Council were entitled to refuse to disclose the recording of the meeting of 26 August 2021.

Although the Tribunal did not have a copy or transcript of the recording, we were able to make the following findings about its content on the balance of probabilities and based on the evidence before us:

The Tribunal found that the information requested by the Appellant was ‘environmental information’ as defined in Regulation 2(1) EIR. The requested information is a recording of a meeting which discussed responsibility for maintenance of an underground sewer pipe and flooding to residents’ properties.

The Tribunal was satisfied that this was information in a material form on water and land which are elements of the environment under Regulation 2(1)(a). The recording was also likely to concern factors affecting the elements of water and land, such as the release of sewage and flooding, under Regulation 2(1)(b), and measures affecting those elements and factors, such as legal responsibility and agreements in relation to the maintenance of the sewer pipe to manage flooding, under Regulation 2(1)(c).

The wording of the relevant provisions in relation to ‘personal data’ are the same under EIR as under FOIA (see for example the Commissioner’s Guidance Note on ‘Personal Information (section 40 and regulation 13)’ 20201124 Version 2.4).

The Tribunal found based on our findings about the content of the recording in paragraph 32 above that information in the recording relates to the Appellant and that he is either identified or identifiable from it, for the following reasons:

The Tribunal therefore concluded, applying section 3(2) and (3) DPA, that the recording contains personal data of the Appellant.

The recording also contains personal data of a number of Valleydene residents. Neither of the parties nor the Council disputes this. The residents give their names and addresses and discuss the impact of the sewer pipe and flooding on their lives and homes. They are identified and identifiable and the information relates to them.

The Tribunal had insufficient information to decide whether or not the recording contained personal data of other attendees at the meeting, such as the councillors, Council officers and solicitors, but found that it was not necessary for us to make a decision about that in order to decide this appeal.

The recording therefore contains both personal data of the Appellant, which the Council was entitled to refuse to disclose under Regulation 5(1) in reliance on Article 5(3) EIR, and third party personal data of the Valleydene residents.

The Commissioner suggests in Guidance that Regulation 5(3) will also apply if the third party personal data is “inextricably linked” to the Appellant’s personal data in the recording and cannot be “clearly differentiated” (ICO Guidance on “Personal data of both the requester and others (section 40 FOIA and regulations 5(3) and 13 EIR)” 20201124 Version 2.1). While this Guidance is not binding on the Tribunal, we accept and adopt the approach suggested by the Commissioner which we find to be helpful and consistent with the relevant law.

The positions of the Appellant and the Council differ on the question of whether the Appellant’s personal data and the residents’ personal data is “inextricably linked” in the recording.

The Appellant submits in his Reply that the part of the recording containing his personal data did not contain any personal data of the residents. He says that the residents were only involved for the “final part of the recording” and that this part could be deleted in order to deal with the Request under UK GDPR.

By contrast, the Council said in the internal review that “many residents… spoke throughout the meeting”. It also seems likely that the Appellant would have made reference to the residents and their experiences of flooding in his submissions, from which it might have been possible to identify them.

The Tribunal was unable to make a definitive finding on this issue without hearing the recording or seeing a transcript. However, we concluded that the outcome of the appeal would be the same, regardless of whether or not the Appellant’s personal data is “inextricably linked” with that of the residents, for the following reasons:

The Tribunal was satisfied that disclosure of any part of the recording which contains the residents’ personal data would contravene the first data protection principle in Article 5(1)(a) UK GDPR.

The first data protection principle requires that personal data is processed lawfully, fairly and in a transparent manner in relation to the data subject. The relevant “processing” in this case is the disclosure of the residents’ personal data under EIR. Disclosure under EIR is free of any duty of confidence and potentially to the world, not only to person requesting the information.

The Appellant submitted that the residents had consented to the processing under Article 6(1)(a) UK GDPR. The open bundle contained an email from an individual identified as the Chairman of the Valleydene and Highlands Way Residents Association confirming that “all the individuals identified in the recording had agreed that the recording should be released”. However, there was no evidence that any officer of the Residents Association had authority to give such consent on behalf of the residents, nor that the residents understood that they were giving consent for the recording to be disclosed to the world at large and not only to the Appellant. Applying Article 4(11) UK GDPR, the Tribunal found that the residents had not given “specific, informed and unambiguous indication” of their wishes, and therefore Article 6(1)(a) did not apply.

The Tribunal also found that there was no lawful basis for processing under Article 6(1)(f). The Tribunal agrees with the Commissioner that there was a legitimate interest in disclosure of the recording, in relation to the public interest in transparency of the Council’s actions and the environmental issues of flooding and release of sewage. We accepted that disclosure was reasonably necessary to achieve that interest.

However, applying the balancing test in Article 6(1)(f), the Tribunal found that the legitimate interest was overridden by the interests and fundamental privacy rights of the residents who attended the meeting. This was a private meeting with the Council concerning a “very sensitive and contentious” issue (see the Council’s internal review). The residents shared personal details about how their properties and lives had been affected by flooding. Some became upset and tearful. By contrast, while there is a legitimate interest, it primarily concerns a relatively small geographical area and small number of individuals and properties. In this context, the Tribunal found that the fundamental right of the residents to keep the recording of what they said at the meeting private, and not have it published to the world at large, overrode the legitimate interests. Article 6(1)(f) did not apply.

None of the other lawful bases in Article 6 UK GDPR applied.

The first condition in Regulation 13(2A) EIR is therefore satisfied and applying Regulation 13(1), the Council must not disclose to the Appellant under EIR any part of the recording which contains the residents’ personal data.

The Tribunal therefore concluded that:

The Decision Notice issued by the Commissioner was therefore not in accordance with the law because it was based on section 40(2) FOIA. The appeal is allowed and a new Decision Notice is substituted as set out at the head of this Decision. However, no steps are required because the Council is entitled to refuse to disclose the recording.

To the extent that the Council refused to disclose the recording under Regulation 5(3) EIR, it should have then dealt with the Request as a subject access request under Article 15 UK GDPR, as the Appellant has submitted from the very start. However, the Tribunal has no jurisdiction in relation to how the Council deals with the Request under UK GDPR.