“RBKC has also redacted the name of one of the recipients of an email to the RBKC councillor, Cllr Husband. I asked RBKC if this recipient is a third person other than the complainant in the piano dispute, Mr Baptista or his then-wife Ms Allen. RBKC responded that they would not disclose this because it is third party information. RBKC has disclosed many items of information containing Mr Baptista's and Ms Allen's name and involvement in the dispute, therefore it seems likely this third person is someone else who intervened on the Baptistas' behalf. The email in question is attached.”
“Mrs Carrabino says that she has been given the name of the neighbour in response to previous requests, and therefore concludes that in this instance the name is of a third party, thus supporting her suspicion of wrongdoing. On that basis I would ask the Council to reconsider disclosing the name to Mrs Carrabino. It appears to me that the e-mail is relatively anodyne, and disclosure may provide assurance that there was no wrongdoing. In any event it would bring this particular complaint to a close, which would be beneficial to all parties.”
“… as this was a complaint by the data subject made to the Council, we are of the few that the data subject would have a strong and reasonable expectation that their name would remain confidential and would not be disclosed into the public domain. Further, because of the data subject's close involvement in this matter, disclosing this information has the potential for distress to be caused to them if this information was to be disclosed to the public.”
“28. Even if the rights and freedoms of the officer were relevant, Ms Kol’s argument about them was misconceived. She argued that disclosing the information she wanted would do no harm to the officers and cause them no distress. That may well be true, but it is not the point. The starting point for data protection law is this: a person’s data is protected from disclosure except in accordance with the legislation. There is no precondition that it is protected if, and only if, disclosure would have some particular effect on the data subject. It is protected just because it is a person’s data. A simple illustration will make the point. Suppose someone has arthritis. That is information about themselves. It is not embarrassing for others to know about it. Most people would not be ashamed or distressed if others found out about it. But it is subject to protection under GDPR. In fact, it is given stronger protection than other data because, as it is about the person’s health, it is classified as sensitive. To reduce it to its simplest: personal data is protected just because it is personal data. That is what the first preamble to GDPR says. Just to be clear, I am not saying that the effect of disclosure on the data subject is irrelevant. It is relevant, but only if it is necessary to resolve a conflict between the interests of the person who requested the information and the person to whom it relates.”