Stephen Masterman v The Information Commissioner

‘Environmental information’ is defined by Regulation 2(1) of the Environmental Information Regulations (‘EIR’) as any information on:

EIR 13 renders information exempt from disclosure to the extent it includes personal data of a third party, and its disclosure would contravene any of the data protection principles (‘DP principles’) relating to the processing of personal data as set out in Article 5 UK GDPR.

The first question is whether the withheld information constitutes personal data under DPA. ‘Personal data’ is defined by s.3(2) DPA as:

Information relates to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.

If the information is personal data, the second question is whether its disclosure would breach any of the DP principles.

Article 5(1)(a) UK GDPR provides that personal data shall be processed ‘lawfully, fairly and in a transparent manner in relation to the data subject’.

‘Processing’ of personal data includes its disclosure in response to a FOIA request: thus information can only be so disclosed if to do so would be lawful, fair and transparent.

Article 6(1) UK GDPR provides that where a public authority is holding personal information as part of its general processing, such processing will be ‘lawful’ if and to the extent that at least one of six conditions applies. These conditions include (most relevantly for the present case):

The equivalent provision to EIR 13 in FOIA is s.40 which is in similar terms for the purposes of this case.

The powers of the Tribunal in determining appeals against the Commissioner’s decisions for the purposes of FOIA are as follows:

Before the hearing, the parties had submitted written evidence. This comprised an Open Bundle of 117 pages (including an Index). The panel also had access to a Closed Bundle.

In summary, Mr Metcalfe, on behalf of the Commissioner, invites the Tribunal to dismiss the appeal for the following reasons:

The HMO register of licences that is required to be published by all councils acting as regulatory authorities should not contain coded information. The register is provided to inform the public that an HMO is compliant. It is useful to potential renters to determine if the property is suitable for them.It is also important to the wider public that the local authority is regulating and ensuring minimum standards are being met.

The Council’s register in this case contains nothing which could be considered a ‘summary of the conditions’ applicable to the licence of the HMO in question: it is merely a list of headings or types.

Mr Masterman made his FOIA request as suggested by the Council’s own Private Sector Housing Manager where she said there was ‘no secret code. If you would like further information about a particular property, you can make a FOIA request…’

The most personal information about this HMO’s landlord – namely their name and address – is clearly stated on the Council’s HMO register. The information he requests is not personal data but business data, reporting the condition of an asset put forward for rental for human habitation. The conditions were simply a snapshot of the property’s condition when presented to the Council for a licence for letting as an HMO.

It would assist both the Council, tenants and potential tenants if the licence conditions were published in plain English. Tenants (and would-be tenants) would be able to tell if the property was kept in good order and the landlord took seriously their compliance with regulations. Landlords would do the necessary works in order to let out their rooms because tenants would be less keen to stay or even take up residence if the works were not done. This would assist compliance without costly intervention by the regulatory body.

Failing to publish the licence conditions in plain English but only in coded form avoids public scrutiny of both the conditions and the Council itself in taking regulatory action. Nobody except the Council itself knows whether the required works have been completed or not.

The Council have convinced the Commissioner that this is about HMO landlords/managers/tenants’ privacy but it is not: HMO licensing is there to ensure that a minimum standard product is available to the public, maintaining compliance with regulations and improving HMO standards.

The Commissioner also accepts the Council’s argument that disclosing the licence conditions would lead to information about convictions and fines but has not explained how. Such information is not required to be on the licence and has not been requested.

At the point of licensing, there should be no tenants (unless it is renewal of an existing licence) so there can be no infringement of their privacy. On renewal, any conditions on the original licence should have been checked for compliance as the maximum time for carrying out any works should be no more than a year, less for safety or security items. If the works have not been completed in time, under the powers given to the regulating authority, an Interim Management Order should have been issued to assess if the required conditions can physically be met and/or the landlord/manager has the financial resources to complete them. If not, then a Final Management Order should be issued and the HMO closed for business.

The Licensing and Management of Houses in Multiple Occupation and Other Houses (Miscellaneous Provisions) (England) Regulations 2006 prescribe in Regulation 11 the particulars to be published under s.232(a) of the Housing Act 2004 in relation to HMO licences. These particulars include:

All the above information must be provided by the HMO owner when they apply for a licence – so they are effectively agreeing to its publication. If they want personal privacy, they can form a holding company for the property as a business which many landlords have done.

The Council has overstepped its authority by not fully disclosing what they should and using s.40 FOIA to avoid scrutiny of the way they are implementing HMO regulations and licensing.

The Council has since provided to Mr Masterman what they call the conditions ‘in long hand’. However, these do still not meet the requirements of the regulations.

It is not for the Council to decide who can see what with regard to HMO licences: the legislation says what is to be published and that needs to be in English. If the Council is concerned that what they think to be personal information will be released, they can inform applicants for HMO licences how their anonymity could be achieved.

The panel first went on to consider the possible unfairness of withholding certain information from Mr Masterman, namely the licence conditions he seeks. This information has been provided to the Tribunal on the basis that it is withheld from both Mr Masterman and the public pursuant to GRC Rule 14.

For the purposes of the hearing, the panel was provided with a Closed Bundle containing the withheld information. The panel takes account of the Tribunal’s Practice Note on Closed Material. This explains that, where disclosure of the disputed information would defeat the object of the exercise, the law permits the Tribunal to deviate from the normal rule about all material seen by the Tribunal being available to all parties. However, such deviation is permissible only so far as is necessary to ensure that the purpose of the proceedings is not defeated.

The panel accepts that there is inevitably someprejudice in material being withheld from a party requesting it, but considers that this prejudice is mitigated by:

the Tribunal’s expertise, and exercise of an investigatory rather than adversarial function;

In this case, the Commissioner considers that the withheld information includes personal data, a characterisation which Mr Masterman disputes and which he does wish to be disclosed.

Having considered all these matters and having carefully read the withheld information, the panel is satisfied that withholding the requested information was and remains necessary to ensure the purpose of the proceedings is not defeated. Moreover, the prejudice to Mr Masterman’s position – mitigated as described above – is justified in the interests of justice overall.

Though mentioned in passing in the final paragraph of the DN, there is no discussion in the DN whether the information sought in this case falls within the definition of ‘environmental information’.

Although we have been unable to find any direct authority on the point – nor have any authorities been drawn to our attention – in the panel’s view the information sought in this case is covered by the definition cited in paragraph 16 above namely EIR2(1), ‘(f)…conditions of human life…inasmuch as they are or may be affected by …any of the matters referred to in … (c)’.

Our reasoning is that ‘conditions of human life’ in EIR 2(1)(f) includes conditions in which human beings live, in this case in a registered HMO property. Moreover, those conditions ‘are or may be affected by measures or policies’ in EIR 2(1)(c) such as, in this case, HMO licensing conditions which determine amongst other things density of occupation of HMOs, rubbish recycling and means of escape. These in turn affect elements of the environment such as water and land in EIR2(1)(a) and factors likely to affect elements of the environment such as energy and noise in EIR2(1)(b).

Though there are differences between requests under FOIA and EIR such as time limits for responding, for the purposes of this case we consider the only significant difference between the two regimes is the presumption of disclosure under EIR.

Overall, therefore, our fact-finding and other discussion below applies similarly– apart from that one difference – to both EIR and FOIA regimes.

Having established the above matters, the panel went on to consider the relevant facts of this case. Based on all the evidence the panel has seen and heard, the panel has made the following findings of fact:

Having made the above findings of fact, the remaining issues for the panel in this case are (a) whether the Commissioner made any error of law in the DN and (b) whether the Commissioner ought to have exercised his discretion differently.

The panel considers that the Commissioner made an error of law in regarding the applicable regime for dealing with Mr Masterman’s request as FOIA rather than EIR. Having said that, however, the panel recognises that both regimes contain similar provisions for withholding third party personal data - in the case of FOIA the exemption in s.40(2) - and in the case of EIR the exception in Regulation 13. Thus analysis in the DN is largely applicable to the EIR regime as well as FOIA.

Mr Masterman argues that the Commissioner made an error of law in finding that the licence conditions he seeks are ‘personal data’.

However, the panel is satisfied that the information sought in this case does constitute personal data. This is because the licence conditions clearly relate to a property owned by the HMO licence-holder whose name and address are published on the Council’s register of HMO licences. Those conditions are therefore clearly linked to that individual who is both living and identifiable.

On the second question whether disclosure of the requested information would contravene any DP principles, the panel agrees with the Commissioner that the most relevant DP principle in this case is Article 5(1)(a) cited in paragraph 21 above.

The panel also accepts the Commissioner’s analysis in paragraphs 23 to 34 in the DN about lawful processing of personal data under Article 6(1)(f) of the UK GDPR, including:

The panel does not accept the Commissioner’s conclusion that the landlord of the property in this case would have a reasonable expectation that this particular personal data would not be disclosed to the wider world.

On the contrary, the Housing Act and the 2006 Regulations regulate – by means of mandatory licensing - HMO properties occupied by five persons or more people living in two or more households. This regulated activity is designed to raise the standard of accommodation available in the private rented sector. It is aimed at providing greater protection to the health, safety and welfare of the occupants of such residential properties. These occupants are often vulnerable individuals such as students, benefit claimants and those on low incomes who cannot afford to rent self-contained properties.

HMOs are subject not only to licensing with conditions – many of which are mandatory and set down in regulations – but also to publication of a summary of such conditions on a register established and maintained by the relevant local housing authority.

This statutory regime was designed in part to ensure that renters, would-be renters and the public would be protected from ‘poor’ landlords seeking to avoid the licensing requirements of larger HMOs by focussing their operations on smaller HMOs. In addition, the legislation was aimed at tackling defects and deficiencies that might give rise to hazards in such residential accommodation – and enabling prospective tenants and others in the community easily to identify properties run by reputable landlords by using the register of licences maintained in consistent form by all local housing authorities.

Against this backdrop, far from expecting licencing conditions to remain private, we conclude that the data subject (the landlord of the HMO property in this case) must have anticipated that the essence of the licence conditions would be published on the Council’s register of licensed HMOs.

Had the Council published a summary of the HMO licence conditions in accordance with Regulation 11 of the 2006 Regulations, it seems unlikely that Mr Masterman would have needed to make his request at all.

In this case, however, the Council published the types of licensing conditions, not a summary of them. In light of the statutory framework and in particular the requirement for a public register to publish a summary of conditions, we do not accept the Commissioner’s submissions that the contents of the conditions – as opposed to the types of conditions – were not to be made public because HMOs are private residences and therefore the information is undisclosable personal data.

Likewise, we reject the ‘particular’ weight the Commissioner placed on the fact that the contents of the conditions would reveal details about the condition and layout of a property used as a private residence by multiple individuals and hence those individuals’ personal data. In the first place, at the time the licence was issued, no such individuals should have been in occupation as an HMO licence was required first. Secondly, those HMO occupants – unlike the licence holder who is named – would not be identifiable from disclosure of the licence and its conditions to the wider world. Hence we do not consider that the licence conditions are linked to the HMO occupiers (other than the licence holder) so as to comprise their personal data.

The panel does not understand the Council’s argument, accepted by the Commissioner, that because breach of licence conditions is a criminal offence which could lead to prosecution and punishment by a fine, this too renders the conditions ‘private’ or ‘personal’ information. This appears to us to be too tenuous and hypothetical – and even were a licence-holder to be prosecuted and fined for breach of the conditions, that information would not appear on the licence conditions themselves which is all that Mr Masterman is requesting.

Overall, the panel concludes that processing of personal data (by disclosing information in response to Mr Masterman’s FOIA request) is necessary (being the only means of obtaining the information) for the purposes of legitimate interests pursued by Mr Masterman. Those legitimate interests include not only Mr Masterman’s as occupier of a neighbouring property but also those of owners and occupiers of other nearby properties, occupiers of the HMO itself, members of the public contemplating occupation of accommodation within the HMO, and the wider community.

Further, the panel considers that these legitimate interests are not overridden by the interests, fundamental rights and freedoms of the landlord as the data subject. In view of the relevant legislation regulating the activity of managing a HMO, that landlord must be taken to have a reasonable expectation that the HMO licence conditions, albeit in summary form rather than in full, would be published on the Council’s register of HMO licences.

For the reasons set out above, the panel finds that the Commissioner’s DN was wrong in law in applying the FOIA rather than EIR regime, though in practice little turns on this apart from the latter’s presumption of disclosure. This decision’s reasoning applies equally to both regimes save that the legitimate interests referred to in paragraph 69 above weigh even more strongly if EIR applies due to the presumption in favour of disclosure.

Further, the panel finds that the Commissioner ought to have exercised his discretion differently, namely in favour of the requester’s pursuit of legitimate interests rather than the data subject’s interests, fundamental rights and freedoms.

Accordingly, the appeal is allowed and a substituted decision notice is included in the annex to this decision.

The substituted decision notice specifies the information which the panel has determined must be disclosed within 35 days from promulgation of this decision. To preserve a meaningful right of appeal, however, the information (contained in the closed bundle provided to the Tribunal) remains confidential under GRC Rule 14 until disclosed as required by this decision or, if later, until the outcome of any appeal of this decision.