Emyr Gwyn v The Information Commissioner

The Appellant, Mr Emyr Gwyn, lives in Cardiff. In late 2021 or early 2022 his next-door neighbour had some building work carried out, which included the construction of a Dormer extension. It seems that this resulted in some damage to Mr Gwyn’s property.

On 13 February 2022 Mr Gwyn wrote to Cardiff Council (‘the Council’) requesting information in the following terms:

The Council responded on 18 March 2022, refusing to disclose the information requested on the basis that it amounted to the personal data of the adjoining homeowner and citing the Environmental Information Regulations 2004 (‘EIR’), reg 13.

Mr Gwyn took issue with the Council’s response but, following an internal review (which seems to have been the subject of an unreasonable delay), it maintained its position.

Mr Gwyn then complained to the Respondent (‘the Commissioner’). An investigation followed.

By a decision notice dated 31 January 2013, the Commissioner determined that the Council had correctly applied EIR, reg 13 and Mr Gwyn was not entitled to the disputed information.

By a notice of appeal dated 5 February 2023, Mr Gwyn challenged the Commissioner’s adjudication on a number of grounds.

The Commissioner resisted the appeal in a response dated 3 April 2023.

Mr Gwyn replied to the Commissioner’s response in two replies, the first undated and the second erroneously dated 13 February 2023.

The appeal came before us for consideration on the papers, both parties being content for it to be decided without a hearing. We were satisfied that it was just and in keeping with the overriding objective to proceed in that way.

EIR, reg 5 includes:

EIR, reg 12 makes provision for exceptions to the duty to disclose environmental information. It includes:

EIR, reg 13 includes:

The language and concepts of the data protection legislation are translated into the Regulations (reg 2). The exceptions under reg 13 are unqualified and the familiar public interest balancing test has no application. Rather, the reach of the exceptions is, in some circumstances, limited by the data protection regime.

The data protection regime under the Data Protection Act 2018 (‘DPA 2018’) and the General Data Protection Regulation (‘GDPR’) applies to this case.

DPA 2018, s3 includes:

GDPR, Article 5 sets out the data protection principles. It includes:

Article 6, so far as material, provides:

The appeal is brought pursuant to the FOIA, s57. The Tribunal’s powers in determining the appeal are delineated in s58 as follows:

It is well-established that, where they intersect, privacy rights hold pride of place over information rights. Under EIR, the legislative bias in favour of privacy rights over information rights is explicit in the statutory language itself: the presumption in favour of disclosure (reg 12(2)) is subordinated to the absolute prohibition on disclosure of personal data save where reg 13 permits it (reg 12(3)). It is otherwise under the freedom of information statutes, but the law is to the same effect. In Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 HL, Lord Hope reviewed the legislation, including the EU Directive on which the domestic data protection legislation is founded. At para 7 he commented:

It is well-established that case-law under the pre-2018 data protection regime can safely be treated as a guide to interpreting the new law. Three principles are noteworthy in the present context. First, ‘necessary’ means reasonably necessary and not absolutely necessary: South Lanarkshire Council v Scottish IC [2013] UKSC 55. But in order for something to be ‘necessary’ there must be no other reasonable means of achieving it: IC v Halpin [2020] UKUT 29 (AAC). Second, ‘necessity’ is part of the proportionality test and requires the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question: R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin), para 76. Third, it is important to take account of the fact that disclosure under freedom of information legislation would be to the whole world and so, necessarily, free of any duty of confidence: Rodriguez-Noza v IC and Nursing & Midwifery Council [2015] UKUT 449 (AAC), para 23.

The Upper Tribunal has held (also under the pre-1998 data protection legislation) that it is legitimate to consider at the outset the first part of (what is now) the test under Articles 5 and 6 (fair and lawful processing), before addressing (if need be) the remainder of the test (see Farrand v Information Commissioner [2014] UKUT 310 (AAC), para 20). It follows that, if the Tribunal finds that granting a request for personal data would not entail fair and lawful processing, disclosure must be refused without more, and the balancing proviso under Article 6.1(f) does not come into play.

Does the information requested include personal data of which Mr Gwyn is not the data subject? Mr Gwyn rightly did not dispute that it included the personal data of the owner of the adjoining property. It includes, among other identifiers, the name and address of that person.

But Mr Gwyn put forward a different, and surprising, argument. He contended that the information requested was also (or included) his personal data. The fact that it is of interest to him does not make it his personal data. Having regard to DPA 2018, s3(2) and (3)(a), we doubt whether it could have amounted to his personal data. Nor, in any event, could the point avail him. On the contrary, if he was right, the inevitable consequence would be that, in so far as the information sought comprised his personal data, his right to have it disclosed to him through EIR would have been barred by reg 5(3). Our powers are circumscribed by the environmental information jurisdiction and it would be idle for us to speculate as to whether access to the information requested, or any part of it, might be open to him by some other legal route.

Accordingly, unless processing of the information would be fair and lawful under GDPR, Article 5, the exception under EIR reg 13(1) applies.

Would processing be fair? In our judgment, it would not. We have several reasons. First, we agree with the Commissioner that, in all probability, the adjoining owner would have been confident that his/her Building Control dealings with the Council would not be disclosed to third parties. There is no evidence pointing to any different expectation.

Second, that expectation was a wholly reasonable one. There was no suggestion that the Council had said or done anything to cause him/her to perceive any risk to his/her privacy. Its settled practice was not to make Building Control applications public.

Third, disclosure of the disputed information would have entailed a substantial interference with the adjoining owner’s right to privacy, extending to information about the dimensions and layout of the property and the nature of the building works. Such information would have been sufficient to support reasoned speculation about the cost of the building work and, possibly, the capital value of the property as a whole.

Fourth, that interference would have been all the more substantial for the fact that disclosure under EIR (and FOIA) is disclosure to the whole world, with no duty of confidence attaching to the immediate recipient of the information or anyone coming into possession of it thereafter.

Fifth, the factors considered next in relation to lawfulness also bear on the question of fairness and, in our view, lend additional support to our view that the data processing here sought by Mr Gwyn would not be fair.

We now turn to the question under GDPR, Articles 5 and 6 of lawful processing. Was processing necessary (ie reasonably necessary) for the purposes of any legitimate interest pursued by the Council or any third party (including Mr Gwyn)? We are satisfied that it was not. Again, we have several reasons. In the first place, while we fully accept that Mr Gwyn had (and has) a legitimate interest in protecting his property from damage and in protecting his financial wellbeing, we have been careful to remind ourselves of the scope and nature of the data processing here under contemplation. It is concerned with the Building Control regime. What is notably lacking is an allegation (express or even implicit) that that regime has somehow malfunctioned, let alone evidence of any malfunction. Rather, what seems to underlie these proceedings is a desire on the part of Mr Gwyn for information to inform an assessment as to whether some sort of claim or remedy may be open to him. In these circumstances, it seems to us that there are obvious difficulties in getting his case on necessity off the ground.

Second and in any event, the Building Control regime comes with an enforcement mechanism attached. It is open to the citizen to press the Council to operate the mechanism where the applicable regulations have been, or are believed to have been, contravened. If need be, the citizen may invoke the Council’s complaints procedure to that end. Beyond that, judicial review may serve as an alternative remedy if it is said that the Council has failed to perform any of its statutory functions.

Third, as the Commissioner points out, aggrieved citizens may also have recourse to the Public Service Ombudsman for Wales, provided that their concerns fall within the scope of that office. Like the complaints procedure, this represents a much less intrusive measure than the relief which Mr Gwyn seeks. As noted above, to be ‘necessary’, disclosure must be ‘the minimum interference with the privacy rights of the data subject that will achieve the legitimate aim in question’. We see no reason to dismiss the available machinery as inadequate to address a clear and coherent complaint, if one is made.

Fourth, if any actionable damage has been done to his property, Mr Gwyn may in principle have a good claim against his neighbour at common law. There seems to be no ground for supposing that any such claim, if contemplated (none has been intimated), would be materially affected by the information which he has requested. But in any event, any relevant Building Control documents would be disclosable in such civil proceedings. (And such disclosure would not be to the whole world, but subject to the rules limiting the use of disclosure given in civil proceedings.)

Fifth, Mr Gwyn mentioned the Party Wall Act 1996. It is not our place to comment on matters outside our jurisdiction. That legislation may (or may not) provide a means of resolving his concerns. But we do not see that this possibility has any bearing upon the appeal before us and, in particular, the ‘necessity’ point which we are here addressing.

Sixth, we readily accept that there is a strong social interest in ensuring high standards in the discharge by local authorities of their statutory duties. Many means exist by which proper scrutiny is applied. And since 2000 those means have included the right of citizens to probe local authorities through freedom of information requests. But disclosure of the material under consideration in this appeal could do nothing to serve the wider social interest to which we have referred.

Seventh, nor would we acknowledge any wider social need for public disclosure of Building Control information generally. We share the Commissioner’s view that, by and large, such information is treated by local authorities as private and managed in a confidential way. We agree that public trust and confidence would be undermined if the system was otherwise. By contrast, planning applications, which often have a greater impact on the local environment, are rightly treated as matters of general interest and published accordingly. It seems to us that the different treatment of these two forms of control strikes a sensible balance between privacy and information rights within localities.

Accordingly, it is clear to us that, at the time of the refusal, the disclosure contended for was not reasonably necessary, or indeed necessary at all,

For all of these reasons, we conclude that the data processing for which Mr Gwyn contends would be neither fair nor lawful.

It follows that the exception under EIR, reg 12(3) read with reg 13(1)(a) is engaged. The Council was prohibited from disclosing the information requested. The Commissioner’s decision was correct.

The appeal must be dismissed.