Annette Carrabino v Information Commissioner

These reasons should be read together with open reasons. We do not repeat the facts, arguments or legal principles.

In our open reasons we cited paragraph 27 of the Decision Notice, in which the Commissioner held that revealing the redacted name would not indicate whether or not inappropriate intervention as envisaged by the complainant actually occurred, or inform the public as to how the council handled the noise complaint. We disagree. The following facts are relevant:

We agree that it was reasonable for Mrs Carrabino, and indeed anyone else, to draw the inference at (c) above. The Commissioner recognised this in a letter from a Senior Case Officer on 16 December 2022:

“Mrs Carrabino says that she has been given the name of the neighbour in response to previous requests, and therefore concludes that in this instance the name is of a third party, thus supporting her suspicion of wrongdoing. On that basis I would ask the Council to reconsider disclosing the name to Mrs Carrabino. It appears to me that the e-mail is relatively anodyne, and disclosure may provide assurance that there was no wrongdoing. In any event it would bring this particular complaint to a close, which would be beneficial to all parties.”

This was in response to RBKC’s argument that:

“… as this was a complaint by the data subject made to the Council, we are of the few that the data subject would have a strong and reasonable expectation that their name would remain confidential and would not be disclosed into the public domain. Further, because of the data subject's close involvement in this matter, disclosing this information has the potential for distress to be caused to them if this information was to be disclosed to the public.”

In many, perhaps most, noise complaint cases RBKC would be right. In the circumstances of this case, its position is absurd. Ms Allen’s name was already in the public domain. As the complainant, it was entirely unobjectionable for her to be copied into the email from Mr Mehaffy and to be kept updated; Mrs Carrabino does not suggest otherwise.

We accept that the request pursued a legitimate interest. RBKC’s conduct of the dispute raised legitimate questions as to its motivations, of concern to both the requester personally and to the public. Disclosure of documents to the world at large where an identity was withheld despite Ms Allen’s identity already being in the public domain was always bound to give rise to suspicion that someone else was involved, and that RBKC had something to hide. Redaction has increased the weight carried by the legitimate interest rather than, as would usually be the case, helped to meet it.

That suspicion and legitimate interest having been raised, it could only be dispelled by disclosure of Ms Allen’s identity. It was not enough to do as the Commissioner understandably sought to do, and provide a vague reassurance that having seen the withheld information there was nothing to worry about. There being no obvious reason to conceal Ms Allen’s name, we agree with Mrs Carrabino that a third party was likely to be named. The Decision Notice would more likely be read as finding that a third party was involved, but not inappropriately; that was something that Mrs Carrabino and the public were entitled to decide for themselves. For someone seeking to reassure themselves as to RBKC’s conduct, the email stands as a real clue in a sea of circumstantial evidence. Contrary to the Commissioner’s view, debunking it does “inform the public as to how the Council handled the noise complaint”.

We are mindful that protection of personal data does not depend on any prejudice to the data subject from disclosure. As held in Kol v Information Commissioner and Reigate and Banstead Borough Council [2022] UKUT 74 (AAC):

“28.

Even if the rights and freedoms of the officer were relevant, Ms Kol’s argument about them was misconceived. She argued that disclosing the information she wanted would do no harm to the officers and cause them no distress. That may well be true, but it is not the point. The starting point for data protection law is this: a person’s data is protected from disclosure except in accordance with the legislation. There is no precondition that it is protected if, and only if, disclosure would have some particular effect on the data subject. It is protected just because it is a person’s data. A simple illustration will make the point. Suppose someone has arthritis. That is information about themselves. It is not embarrassing for others to know about it. Most people would not be ashamed or distressed if others found out about it. But it is subject to protection under GDPR. In fact, it is given stronger protection than other data because, as it is about the person’s health, it is classified as sensitive. To reduce it to its simplest: personal data is protected just because it is personal data. That is what the first preamble to GDPR says. Just to be clear, I am not saying that the effect of disclosure on the data subject is irrelevant. It is relevant, but only if it is necessary to resolve a conflict between the interests of the person who requested the information and the person to whom it relates.”

In resolving this conflict between the interests pursued by Mrs Carrabino and the interests of Ms Allen, it is obviously relevant that the latter will suffer no conceivable prejudice whatsoever from having her name disclosed. Nor is there any risk to the integrity of withholding such names in other situations, this being a case which depends to a great extent on its own unusual facts.

We are entirely satisfied that disclosure of Ms Allen’s identity is necessary to meet the legitimate aim pursued, and that this outweighs any prejudice to Ms Allen from having it confirmed (again) that she was the complainant.