Whyton v Information Commissioner & Anor [2023] UKFTT 518 (GRC)

[2023] UKFTT 518 (GRC)

Venue Neutral citation number: [2023] UKFTT 518 (GRC), Case Reference: EA/2022/0283, First-tier Tribunal, General Regulatory Chamber, Information Rights, Decided without a hearing

Between

Whyton

Information Commissioner & Anor

Date 3 August 2023

[1]This appeal is against a decision of the Information Commissioner (the “Commissioner”) dated 5 September 2022 (IC-149171-Y5D8, the “Decision Notice). The appeal relates to the application of the Environmental Information Regulations 2004 (“EIR”). It concerns information about correspondence relating to a stopping up order requested from Sodbury Town Council (the Second Respondent, “STC”).

[2]The parties opted for paper determination of the appeal. The Tribunal is satisfied that it can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).

[3]On 25 November 2021, the Appellant wrote to STC and requested the following information (the “Request”):

“ This request is being made under the freedom of information act 2020 for all email correspondence relating to the stopping up order for our land along the Badminton Road in Old Sodbury. The request includes all emails, which includes authors and dates sent, as the FOIA specifies that, as a public body, the Town Council is required to provide me with and I am entitled to view under the act.”

[4]STC responded on 21 December 2021 and confirmed they had provided anonymised copies of all correspondence to the Appeallant’s wife, but names and addresses were withheld under section 40(2) of the Freedom of Information Act 2000 (“FOIA”).

[5]The Appellant requested an internal review on 20 January 2022. STC responded on 2 February 2022 and maintained its position. STC also said they had written to the correspondents and asked if they would agree to their personal information being made public, and in all instances objections were received.

[6]The Appellant complained to the Commissioner on 7 January 2022. The Commissioner decided:a. The requested information was environmental and so EIR applied (as it related to evidence submitted to dispute a stopping up order on the Appellant’s land).

b. The names and addresses are clearly personal data.

c. The Appellant’s own private interests in the information could be a legitimate interest, and disclosure was necessary.

d. The data subjects’ rights outweighed the legitimate interests in disclosure. The individuals would not expect their personal data to be disclosed in response to an information request, and disclosure would be disproportionately intrusive. The Appeal and Responses

[7]The Appellant appealed on 28 September 2022. His grounds of appeal are:a. He has been denied the opportunity to provide evidence to support his request under EIR rather than FOIA. STC should have refused his request and then asked him to submit an EIR request.

b. He alleges that the four complainants have been operating under instructions from a councillor who is disgruntled with him, and this is an abuse of power.

c. He requested disclosure to uncover the process under which these individuals are able to complain and “write untruthful and inflammatory statements about me and my family”.

d. He says there has been similar use of anonymous emails in other cases to influence the outcome of decisions, this is undemocratic, and exposure of the complainants would “allow this process to be scrutinised and the abusers held accountable”.

e. There is nothing on STC’s website or in their privacy policy which promises confidentiality.

[8]The Commissioner’s response maintains that the Decision Notice was correct.a. The Appellant has provided no evidence of wrongdoing on the part of STC, it would not be in the reasonable expectation of the data subjects that their name and email address would be disclosed to the world under the EIR, and that disclosure would be disproportionately intrusive to the data subjects.

b. It is open to the Appellant to submit a conduct complaint under STC’s complaints policy, which would interfere less with the privacy of the data subjects and not require the disclosure of personal data to the world at large.

[9]STC was joined as a party to the proceedings. STC’s response agrees with the Commissioner’s response and makes two further points.a. The Clerk sent the Appellant a copy of STC’s complaints policy and a letter advising him to make a formal complaint under the procedure if he wished to pursue to complaint about wrongdoing.

b. The Clerk also contacted the data subjects about the Appellant’s request and in each case the data subject stated that he/she would not consent to such disclosure, and STC is concerned that ordering the disclosure would be likely to deter other members of the public from making contributions on issues which the Council is tasked with deciding.

[10]The Appellant submitted a reply which makes the following additional points:a. The Commissioner failed to refer the issue back to STC after identifying that EIR applied, and if they had done so his grounds for the release of the information would have been different and he would have been able to demonstrate suspected foul play from STC.

b. It is irrelevant whether he complained to STC directly or through the Commissioner.

c. STC’s privacy policy does not have a statement asserting that letters sent in by members of the public are to be held as private and confidential or can be recorded as anonymous. The fact they asked for and were granted anonymity suggests collusion, and the argument that the release of information would deter other residents from writing into the council does not have merit as there is no proper expectation of privacy.

d. STC’s Clerk could have simply denied that any of the letters were from current or ex-councillors without breaking any confidence, and none of the letters make comments about anonymity or confidentiality, so he can only assume that this was an afterthought. Applicable law

[13]The relevant provisions of the Environmental Information Regulations 2004 (“EIR”) are as follows. 2(1) …“environmental information” has the same meaning as in Article 2(1) of the Directive, namely any information in written, visual, aural, electronic or any other material form on—(a) the state of the elements of the environment, such as air and atmosphere, water, soil, land, landscape and natural sites including wetlands, coastal and marine areas, biological diversity and its components, including genetically modified organisms, and the interaction among these elements;

(b) factors, such as substances, energy, noise, radiation or waste, including radioactive waste, emissions, discharges and other releases into the environment, affecting or likely to affect the elements of the environment referred to in (a);

(c) measures (including administrative measures), such as policies, legislation, plans, programmes, environmental agreements, and activities affecting or likely to affect the elements and factors referred to in (a) and (b) as well as measures or activities designed to protect those elements; …… 5(1) …a public authority that holds environmental information shall make it available on request. …… 12(3) To the extent that the information requested includes personal data of which the applicant is not the data subject, the personal data shall not be disclosed otherwise than in accordance with regulation 13.

(a) would contravene any of the data protection principles…

[14]Requests for environmental information are expressly excluded from FOIA in section 39 and must be dealt with under EIR, and it is well established that “environmental information” is to be given a broad meaning in accordance with the purpose of the underlying Directive 2004/4/EC. We are satisfied that this request falls within EIR because it relates to correspondence about an issue involving a specific piece of land.

[15]Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (s.3(4)(d) DPA), and so includes disclosure under EIR.

[16]The data protection principles are those set out in Article 5(1) of the General Data Protection Regulation (“GDPR”), and section 34(1) DPA. The first data protection principle under Article 5(1)(a) General Data Protection Regulation (GDPR) is that personal data shall be:

“processed lawfully, fairly and in a transparent manner in relation to the data subject”

. To be lawful, the processing must meet one of the conditions for lawful processing listed in Article 6(1) GDPR. These include where “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” (Article 6(1)(a)). It also includes where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” (Article 6(1)(f)).

[17]This involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner

[2013] UKSC 55

):(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii) Is the processing involved necessary for the purposes of those interests?

(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and GDPR. This should now reflect the words used in the GDPR - whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Issues and evidence

[18]The main issue is whether STC was entitled to withhold the names and addresses of the data subjects under regulation 13(1) EIR. The potentially lawful basis for disclosure is the legitimate interests test, meaning the specific issues are:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

b. Is the processing involved necessary for the purposes of those interests?

c. Are such interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?

[19]By way of evidence and submissions we had the following, all of which we have taken into account in making our decision:a. An agreed bundle of open documents.

b. Witness statements from Catherine Davidson and James Ball. Witness Evidence

[20]We had a detailed witness statement from two witnesses on behalf of STC. The key points from their evidence are as follows.

[21]Catherine Davidson - Town Clerk for STC:a. The background to the matter involved a report that an area of land had been unlawfully claimed by the Appellant. After two council meetings STC passed two resolutions that the action on the land was agreed, and it supported a request for a stopping up order on the land (which was the responsibility and decision of South Gloucestershire Council, “SGC”).

b. Four members of the public wrote to STC to express concerns about the land claiming action and STC’s support for the stopping up order. STC does not have an official process for inviting correspondence from members of the public. If correspondence needs to be referred to the full council, the Clerk will circulate redacted copies (with identities removed) to all councillors in advance of the meeting at which the issue raised will be considered. Mrs Davidson did so in this case.

c. After this meeting, seven councillors sent a notice to Mrs Davidson asking for the issue of the stopping up order to be brought back to the council for review, in light of advice from the National Association of Local Councils. At a full council meeting a resolution was passed to take a neutral position on the stopping up order. Mrs Davidson informed SGC of this verbally. SGC subsequently declined to grant the order.

d. On 13 October 2021 the Appellant’s wife asked for copies of the correspondence. Mrs Davidson sent copies with dates and identities redacted on 1 November. She was then asked for dates, and she sent copies with dates included on 10 November.

e. STC does not have an official policy on confidentiality of correspondence received from the public, but her view from years of experience as Town Clerk is that individuals would have expected their identities would be kept confidential.

f. After receiving the Appellant’s request for a review of the decision not to disclose the information, Mrs Davidson wrote to the authors of the correspondence to ask whether they agreed to their names being made public. In each case the individual concerned advised her that he/she did not consent to disclosure of his/her identity.

g. STC asked to be joined to the appeal because it feels it is an important principle that members of the public should be able to contact them without their personal information being disclosed to third parties and/or made public, particularly because STC covers a village setting.

h. Mrs Davidson was not asked whether any of the letters were from current or ex-councillors, and would have taken legal advice if she had been asked to consider such a request.

i. The Appellant has not produced any evidence to suggest foul play or collusion, and a complaints policy was sent to the Appellant but he has not made such a complaint. Mrs Davidson denies that she has been involved in wrongdoing or collusion of any nature regarding this matter.

[22]James Ball - Chairman of STCa. Mr Ball initially voted in favour of the stopping up order.

b. After the first resolution, several STC councillors came forward to state they had not fully understood the context and felt they had voted without fully understanding the consequences of the order being granted. They tabled a motion to reconsider STC’s stance on this issue. Mr Ball then chaired the meeting which passed a resolution adopting a neutral position on the order.

c. The redacted correspondence was circulated to the councillors in advance of this October meeting, but in his view this was a minor contributory factor in the decision by some councillors to change their mind.

d. Mr Ball has not seen the unredacted correspondence. This is only seen by the Town Clerk. Mr Ball believes that anonymity for members of the public who write to STC is paramount because otherwise they would not see the whole picture of local feelings on matters on which STC is tasked with making decisions. They may be deterred from expressing their opinions due to possible repercussions.

e. Mr Ball has no knowledge of wrongdoing or collusion between councillors and members of the public regarding this issue and is shocked the Appellant has made these allegations. Discussion and Conclusions

[23]We have considered the issues in turn.

[24]Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? Legitimate interests are being pursued by the Request. The Appellant has a personal interest in the information, as he wishes to uncover how individuals were able to send what he says are untruthful statements to STC. He also alleges that there has been wrongdoing by a councillor who encouraged individuals to send the correspondence, and says this is an abuse of power. He says that anonymous letters have been used in this way before. If correct, it would be in the public interest to uncover wrongdoing.

[25]Is the processing involved necessary for the purposes of those interests? The Commissioner found that the processing was necessary for the purposes of these interests. This was so that the Appellant could find out who was making false accusations against him. We do not agree. The Appellant has the full content of the letters. He also says that he is aware of who wrote them in his appeal grounds - “ It is clear to me who these people are, and I can put a name to each letter. ..”. It is not clear why disclosure of the identity of the authors to the world at large under EIR would be reasonably necessary for the purposes of his personal interests in the information. We also do not find that disclosure of the identity of the authors would be reasonably necessary for the wider public interests in uncovering potential wrongdoing. The content of the letters is publicly available, and STC has a complaints process that could be used by the Appellant or others to query what happened in this case. The Appellant says that he is unable to address the issues and hold the individuals accountable, but the complaints process is a mechanism for doing so without simply releasing their identities to the world at large under EIR. This is a separate process from any request under EIR or FOIA.

[26]Are such interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data? Although we have found that disclosure under EIR is not reasonably necessary, we have gone on to consider the balancing of interests. We find that any interests in disclosure are overridden by the data subjects’ privacy rights. This is because the data subjects had a reasonable expectation that their identities would not be disclosed under EIR or FOIA, and in addition they had all informed STC that they did not consent to this information being disclosed.

[27]The Appellant points out that STC’s privacy policy does not say that letters sent in by members of the public are to be held as private, confidential or anonymous. We have taken account of the evidence from Mrs Davidson about the fact that all correspondence is anonymised by the Town Clerk before being passed onto the councillors. Although there is no explicit public statement from STC about confidentiality, there is also no published policy that warns people that their identity may be made public if they contact STC. We accept that there is a reasonable expectation that members of the public would not have their identities published to the world at large if they write to STC.

[28]We have also taken account of the evidence from Mr Ball that otherwise members of the public may be deterred from expressing their opinions due to possible repercussions. The Appellant says that there would not be a deterrent effect because there is no proper expectation of privacy. We disagree. We accept that individuals would be deterred from contacting STC if they thought their names would be published. That is particularly the case where there is correspondence about a contentious issue in a small community, where individuals may know each other and could be subject to retaliation. This would affect the quality of decision-making at STC. The risk of repercussions in a small com munity is an additional reason why individuals writing to STC would want their identity to be kept confidential, and so reinforces the expectation of privacy in relation to this correspondence.

[29]We have also taken into account the fact that STC asked the authors of the correspondence whether they agreed to their names being made public, and they all said they did not consent to disclosure of their identity. In some cases, it may be lawful to disclose a person’s identity even where they have asked this to remain confidential. However, good reasons would be needed to override an individual’s request for confidentiality. The lack of consent in this case strengthens the individuals’ expectations of privacy.

[30]The Appellant says that the requests for anonymity suggest collusion. We do not agree. As discussed above, there are reasons why individuals in a small community may not want their identities revealed to the public which do not relate to collusion or wrongdoing. The Appellant also suggests that the requests for anonymity were an afterthought because they are not included in the letters themselves. It is correct that they were not expressly asked for consent until STC was reviewing its decision. However, this does not mean that they did not have an expectation of privacy from the beginning.

[31]Even if disclosure was reasonably necessary for the purposes of the identified legitimate interests, we find that these interests have limited weight. The Appellant says he already knows the identities of the individuals, and the complaints process provides a way of challenging what happened without the identities being disclosed. The Appellant has also provided no evidence of wrongdoing. STC’s witnesses have denied wrongdoing and have explained that the correspondence was only a minor factor in STC’s change of decision. We find that the individuals had a clear expectation that this information would not be disclosed to the public. We also find that there would be potential harm and/or distress caused to the individuals by the disclosure, due to the risk of repercussions in the context of a contentious matter in a small community. Having balanced the interests and rights, we find that the data subjects’ privacy rights override the legitimate interests in disclosure.

[32]This means that there was not a lawful condition for disclosure of the personal data under EIR. Disclosure would breach the data protection principles, and STC was entitled to withhold the names and addresses of the data subjects under regulation 13(1) EIR.

[33]Use of EIR rather than FOIA . The Appellant has also expressed concern that the ICO did not come back to him or to STC after deciding that EIR rather than FOIA applied to the Request. He says that his grounds for release of the information would have been different, and he would have been able to demonstrate suspected foul play from STC.

[34]The Appellant has not explained how his grounds would have been different. He has not argued new grounds in his appeal. We also note that the Commissioner sent the Appellant a preliminary findings letter on 4 August 2022 which stated the Commissioner’s opinion that the Request should have been handled under EIR. The Appellant challenged this preliminary finding by requesting a formal decision notice, but he did not challenge the application of EIR rather than FOIA. In any event, the exception in EIR relating to personal data is the same as the equivalent exemption in FOIA. Our decision would be the same whether EIR or FOIA was applied to the Request. In both cases, personal information should not be disclosed unless it is lawful to do so under the DPA and GDPR.

[35]We dismiss the appeal for the reasons explained above. Signed: Judge Hazel Oliver Date: 10 August 2023