Stephen Parker v Information Commissioner & Anor [2025] UKFTT 874 (GRC)

[2025] UKFTT 00874 (GRC)Case Reference: FT/EA/2025/0030
First-tier Tribunal
(General Regulatory Chamber)
Hearing Heard on: 26 June 2025Date 23 July 2025
Information Rights
Heard by Cloud Video Platform
Before
JUDGE HARRISMEMBER CHAFERMEMBER SAUNDERS
Between
STEPHEN PARKERAppellantINFORMATION COMMISSIONERRespondentGUILDFORD BOROUGH COUNCILRespondentMr Parker, representing himself. for Appellant for First Respondent: The First Respondent did not attend and was not represented. for Second Respondent: Mr John FitzsimonsDecision: The appeal is dismissed.REASONS

Background to the appeal

[1]This appeal is against a decision of the Information Commissioner (“the IC”) dated 25 November 2024, reference IC-338947-B9F0. This was in connection with two requests for information made to Guildford Borough Council (“the Council”) by the Appellant, Mr Stephen Parker, relating to a complaint about planning permission being granted in apparent inconsistency with previous policy about roof height, concerning residential houses close to Mr Parker’s home.[2]The appeal followed on from an earlier decision of the IC in relation to the same requests dated 3 May 2024, reference IC 295317-K2B2. The requests were as follows: Request 1 – Council reference: FOI2022/00952[3]On 3 October 2022 Mr Parker wrote to the Council and requested the following information:
“Information on 22/P/01212 including: •Site visits, diary entries and measurements (of roof height and window height etc) during the applications. •Correspondence, advice given on the plans and the process including e-mails, letters, reports, faxes, file notes, notes of phone calls, videos, audio, digital recordings.”
Request 2 – Council reference: FOI2023/00347

Request 2 – Council reference: FOI2023/00347

[4]On 5 April 2023, Mr Parker wrote to the Council and requested the following information:
“1. We have provided evidence of what we believe to be unethical actions on behalf of the Planning Department. We would like all information relating to action taken/ investigated following that evidence being provided in line with the Authority’s code of conduct and governance standards. Please also provide the Authority’s code of conduct, governance standards and complaints process/ procedure which we have been unable to find publicly and have requested from GBC several times. 2. We have been made aware that in the first quarter of 2023 [redacted] guildford.gov email account was not working properly. Please provide information regarding the operation and performance of this email account within the period January to April 2023 (inclusive). 3. On 8 March we requested information from planning services requesting details on procedure for statutory consultees (and clarifying what should happen when both ward councillors are uncontactable, either through illness or a breakdown in the councils email system). This has not been responded to so we would like this provided under FOI along with any internal correspondence related to that request.”
[5]On 10 April 2024, Mr Parker asked the Council to carry out an internal review. He raised concerns that the text of some of the disclosed material was unreadable. He also suggested that the Council had not disclosed all the relevant information that it holds.[6]On 19 April 2024, the Council provided Mr Parker with new versions of the documents in question.[7]On 3 May 2024 the IC issued a Decision Notice to the Council (the “prior DN”), reference IC 295317-K2B2 under the Environmental Information Regulations 2024 (“the EIR”) in relation to a complaint made by Mr Parker about these Requests on 11 November 2023. This Notice required the Council in relation to the two requests to “issue fresh responses whichidentify and disclose information falling within the scope of the request and/or issue a fresh refusal notice under regulation 14 indicating the exceptions under the EIR the council is relying on to withhold information / confirm that information is not held”.[8]On 29 May 2024, the Council provided its new response, which directed Mr Parker to information on the Council’s website, disclosed other information and confirmed that further information was not held. The Council also withheld personal information under Regulation 13.[9]On 29 May 2024, Mr Parker contacted the IC to complain about the way his request for information had been handled by the Council.[10]On 25 November 2024, the IC issued a Decision Notice (the “Decision Notice”) in which it also dealt with the complaint under the EIR. The IC dealt with it under the EIR in both Decision Notices rather than under the Freedom of Information Act 2000 (“FOIA”) because he considered that as the request relates to decisions made in relation to a planning complaint, the information is likely to relate to a “measure” as defined in regulation 2(1)(c) of the EIR.[11]Accordingly, the IC determined that:a. In relation to Request 1: i. the Council had disclosed all the relevant information that it holds and complied with regulation 5(1); and ii. the Council was entitled to withhold some personal information under regulation 13.b. In relation to Request 2 i. the Council had disclosed all the relevant information it holds; and ii. In relation to the requested personal information, regulation 13(5)(a) of the EIR and Section 40(5B)(a)(i) of FOIA provides that the duty to confirm or deny does not apply.[12]In relation to both Requests, the Council disclosed information outside the time for compliance and breached regulation 5(2).[13]The Decision Notice did not require the Council to take any further steps. Abbreviations used in this decision “the Council” means Guildford Borough Council “Decision Notice” means decision notice issued by the IC dated 25 November 2024, reference IC-338947-B9F0 “Data protection principles” means the principles relating to the processing of personal data (as set out in Article 5 of the UK GDPR) “DPA” means the Data Protection Act 2018 “EIR means the Environmental Information Regulations 2004. “FOIA” means the Freedom of Information Act 2000. “IC” or “ICO” means the Information Commissioner, the Respondent “the prior DN” means the decision notice issued by the IC dated 3 May 2024, reference IC 295317-K2B2 “Request 1” means the first request made by Mr Parker to the Council dated 3 October 2022, reference: FOI2022/00952 “Request 2” means the second request made by Mr Parker to the Council dated 5 April 2023, reference: FOI2023/00347 “the Requests” means Request 1 dated 3 October 2022 and Request 2 dated 5 April 2023 taken together. “UK GDPR” means the UK General Data Protection Regulation “UT” means the Upper Tribunal, Administrative Appeals Chamber. Procedural matters relating to the determination of this appeal

Procedural matters relating to the determination of this appeal

[14]The hearing was held remotely by cloud video platform (CVP). The Tribunal was satisfied that it was fair and just to conduct the hearing in this way. There was an OPEN session attended by all the parties and a CLOSED session which was attended only by the Council and its representatives.[15]Having considered all the evidence, the Tribunal’s view was that the reasons for its decision could be properly set out in an OPEN decision and therefore did not prepare a separate CLOSED decision. The Appeal[16]Mr Parker appealed the IC’s decision to the Tribunal on 20 December 2024. The grounds of appeal submitted that the IC’s decision fails adequately to address both the Requests as originally submitted.[17]Mr Parker identified four grounds for appeal:a. Ground 1 – misinterpretation of the need for full disclosureb. Ground 2 – failure to investigate the third-party contractor exemption (Request 1)c. Ground 3 – Incomplete investigation and misapplication of FOIA exemptions (Request 2)d. Ground 4 – Failure to explore available evidence regarding email account functionality (Request 2).[18]In relation to Ground 1, Mr Parker explained that Request 1 relates to information sought in relation to a Judicial Review of a planning decision by Guildford Borough Council. Specifically, this includes information regarding procedural irregularities, unusual levels of redaction and inappropriate use of exemptions to withhold information related to third-party consultants used in the planning process. He said the IC concluded that redacted information, which Mr Parker believes to contain some substance of the procedural irregularities, does not add anything of value and that Mr Parker has alternative remedies. Mr Parker disagreed with this conclusion saying that the information would have been presented in the High Court as part of the Judicial Review had it not been withheld by the Council. In addition, Mr Parker contended that the Council has failed to disclose information it is obligated to retain under the LGA Probity in Planning Guidance.[19]In relation to Ground 2, Mr Parker explained that the Council asserted that documents related to third-party contractors, including correspondence between them, the developer, and the Council, are exempt from FOI requests being “3rd party, internal or not relevant.” He asked the IC to investigate whether this exemption was appropriately applied, but considers that the IC’s investigation did not adequately address this issue, nor did it explain why it chose not to explore the third party exemption in greater detail.[20]In relation to Ground 3, Mr Parker explained that the complaint referred to by the IC as “Request 2” contained four related issues as submitted in one complaint to the IC. The IC seems to have investigated the first issue related to ethical concerns/ code of conduct breaches, but not the other three. He contended that the IC’s investigation investigated the complaint to a limited degree but did not address the core issue related to the email account functionality and performance which is whether the Council was correct to withhold information on the grounds that it constitutes "personal data."[21]Finally, in relation to Ground 4, Mr Parker explained that the IC's investigation and subsequent decision did not explore critical evidence that would demonstrate whether the Council’s email account was functioning properly during the period in question. In response to the investigation, the Council seems to have claimed that no relevant information is available, but that has not been adequately investigated.[22]The relief which Mr Parker sought through the appeal was for the Tribunal to order a comprehensive reinvestigation of the two complaints focusing on the substantive issues raised and that the Tribunal “rectifies the ICO's failure to engage fully with these issues and provides a clearer rationale for the conclusions reached in the Decision Notice.”

The IC’s Response to the appeal

[23]The IC responded to the appeal by a response dated 7 March 2025 and opposed the appeal.[24]In relation to Ground 1, the IC maintained his view in paragraph 45 of the DN that the Council has met the legitimate interest in transparency by disclosing a great deal of information already, and as disclosure under EIR must be the least intrusive means of achieving the legitimate aim in question, disclosing the redacted information would not add much more to what is already disclosed and to disclose it would be disproportionately intrusive, so disclosure is not necessary. He went on to state “the processing is unwarranted in this case by reason of prejudice to the rights and freedom or the legitimate interest of the data subjects. This is particularly so as, whilst some planning permission documents are publicly available for anyone to see, the third party who made the planning application and the Council staff who corresponded with them would not expect their personal data to be disclosed especially in a situation where the Appellant is unhappy with the planning decision…the legitimate interests does not outweigh the rights, freedoms and expectations of the data subjects involved and so, as the condition is not met the personal data still wouldn’t be disclosed regardless of what the Judge said and regardless of FOIA being the only avenue available.”.[25]He argued that personal data can only be disclosed if one of the conditions of lawful processing in Article 6(1) GDPR is met. The IC identified the most relevant basis being Article 6(1)(f) (legitimate interests) and concluded that the processing did not meet the second aspect of the 3-part test (necessity). He deferred to the Council in relation to the LGA Probity in Planning Guidance.[26]In relation to Ground 2, the IC stated that it was not entirely clear what information Mr Parker believes is missing from the Council and invited Mr Parker to clarify this further in his Reply.[27]In relation to Ground 3, the IC noted that it had relayed Mr Parker’s concern about further information to the Council, which had confirmed that no further information was held. The IC stated “It appears in Ground 3 that the Appellant mistakenly believes the Council are withholding information in scope of part 2 of Request 2 under the personal data exception but this is incorrect. The Commissioner concluded the Council should have applied regulation 13(5)((a) EIR to the information in scope of part 1 of Request 2. Ground 3, based on a misreading of the DN, can therefore be dismissed”.[28]In relation to Ground 4, the IC argued that the EIR only applies to information that the Council actually holds in recorded form at the time of the request. The IC concluded that, on the balance of probabilities no further information is held by the Council within the scope of Request 2

The Appellant’s Reply to the IC’s Response

[29]Mr Parker filed a Reply to the IC’s response dated 21 March 2025.[30]In relation to Ground 1, Mr Parker disagreed with the IC’s conclusion that disclosure is not necessary to meet the legitimate interest identified in the request. He states “The personal data in question, particularly regarding procedural irregularities in the planning decision, is critical to the public interest in transparency and accountability in local government processes”.[31]In relation to Ground 2, Mr Parker repeated his concerns that the IC’s failure fully to consider this aspect of his complaint has resulted in an incomplete investigation.[32]In relation to Ground 3, Mr Parker disagreed with the IC’s conclusion that the Council should have applied regulation 13(5)(a) EIR. He notes that theDecision Notice did not conclude that confirming or denying the existence of data related to the operation and performance of the Council’s email account would itself contravene data protection principles.Mr Parker again asked the Tribunal to reconsider whether the IC’s investigation into this issue was sufficient and whether the Council has fully disclosed all relevant information.[33]On Ground 4, Mr Parker maintained that there were other records, such as email logs, server logs, or bounce-back notifications, which could provide insight into the email account’s functionality during the specified period. The failure to explore this possibility further leaves the investigation incomplete. He said that the IC has not provided any reasoning to explain how it concluded on balance of probabilities that the Council does not hold further information. The Council’s Response[34]The Council filed a Response to the Appeal dated 11 April 2025.[35]In relation to Ground 1, the Council stated that in relation to the question of whether it was necessary to disclose the personal data in scope of Request 1, the key question for the Tribunal to consider is whether despite the legitimate interest in transparency being pursued by the Appellant, it remains necessary to redact the personal data held by the Council. The Council stated that it does not consider it is necessary for the pursuit of those legitimate interests for the personal data in question to be disclosed. In light of the test of necessity in Goldsmith (see below) requiring the least intrusive means of achieving the legitimate aim in question, the Council did not consider that the redacted personal information of third parties and council officers would add more to that already disclosed and so it is not necessary.[36]The Council argued that disclosure would be disproportionately intrusive on the legitimate privacy interests of the individuals in question and the processing is unwarranted in this case by reason of prejudice to the rights and freedoms of those data subjects.[37]In relation to the documents which Mr Parker says should have been disclosed but have not been, the Council’s position is that “appropriate searches have been carried out in response to Request 1 and that all information within the scope of Request 1 has been identified and disclosed subject to applicable exemptions”.[38]The Council stated that having reviewed the LGA Probity in Planning Guidance, it cannot identify any particular documents or information that are considered in that guidance which have not been provided to Mr Parker or which are not publicly available.[39]In relation to Ground 2, the Council invited Mr Parker to clarify his position on this ground. It noted that the material disclosed in redacted form to Mr Parker on 12 March 2024 or 29 May 2024 was not redacted on the basis of a particular exemption (other than the personal data exemption) but rather was redacted on the basis that some of the information in question did not fall within the scope of Request 1.[40]In relation to Ground 3, the Council’s primary position is that it has not redacted personal data in relation to its response concerning the email account functionality. Even if this were wrong “it is not necessary for this to be disclosed to meet the legitimate interests of the Appellant and even if it were necessary, such disclosure would be an unwarranted infringement of the rights of individuals.”[41]Finally, on Ground 4, the Council understood this to relate to the fact that a particular Councillor’s email account at a Guildford.gov.uk email address was not said to be working properly in early 2023. The Council’s position is that no further information is held in relation to this limb of Request 2, bearing in mind the searches that have been carried out and the legal test of whether information is said to be held. It notes the “issue for the Tribunal is not what should have been recorded and retained but what was recorded and retained.” The Appellant’s Reply to the Council’s Response[42]Mr Parker filed a reply to the Council’s response dated 29 April 2025. In this he repeated many of his previous points and maintained that the substantive issues originally raised in the complaints remain unaddressed by both the IC and the Council.[43]In relation to Ground 1 and the redaction of personal data, Mr Parker said “The Council suggests that it has determined this information was not necessary or material for the High Court proceedings. The Appellant respectfully submits that a party accused of misconduct is not the appropriate body to make unilateral judgments on the relevance of evidence”. He emphasised the importance this has in terms of transparency and lawfulness in public authority conduct.

Legal Framework

[44]Regulation 5(1) of the EIR provides:
“(1)…a public authority that holds environmental information shall make it available on request”
[45]Regulation 12(4)(a) provides that: “a public authority may refuse to disclose information to the extent that – (a) It does not hold that information when an applicant’s request is received”.[46]It is not in dispute either that the Council is a public authority for the purposes of this appeal or that the information provided was environmental information.[47]The right of access to information under the EIR is qualified, among other things, by regulation 13 EIR. This provides, as far as relevant, that: “(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if— (a) the first condition is satisfied, or … (2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—would contravene any of the data protection principles …”.[48]Regulation 13 EIR refers to “personal data”. Article 5(1) of Regulation (EU) 2016/679, the General Data Protection Regulation (“the GDPR”) defines this as “any information relating to an identified or identifiable living individual”.[49]It is sometimes possible to redact what would otherwise be personal data to preserve data subjects’ anonymity, taking the data outside the definition. But redaction will not always achieve this result. In particular, information may sometimes be combined with other information in the hands of the recipient, or in the public domain, to allow a data subject to be identified (Morton v IC & Wirral Borough Council [2018] UKUT 295 (AAC), per Judge Markus QC at [44]).[50]Where the information requested includes personal data, then by regulation 13 EIR it is necessary to consider whether its disclosure would contravene any of the data protection principles in the GDPR. The IC contends that that Article 5(1)(a) GDPR may be engaged. Article 5(1)(a) says that: “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.[51]Article 6(1) GDPR sets out various grounds for the lawful processing of personal data. In particular, Article 6(1)(f) provides that processing will be lawful if it: “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”.[52]The word “necessary” here “carries with it connotations from the European Convention on Human Rights, including the proposition that a pressing social need is involved” (South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55, [2013] 1 WLR 2421, per Lady Hale at [19]).[53]The law on necessity was further summarised in Goldsmith International Business School v Information Commissioner and Home Office [2014] UKUT 563 (AAC), which held at [39] that the test “involves the consideration of alternative measures”, so “a measure would not be necessary if the legitimate aim could be achieved by something less”; accordingly, the measure must be the “least restrictive” means of achieving the legitimate aim in question. Hence, in Corporate Officer of the House of Commons v Information Commissioner & Others [2008] EWHC 1084 (Admin), the Court considered whether “the legitimate aims pursued by the applicants can be achieved by means that interfere less with the privacy of the [data subjects]” (ibid, [60]).[54]Regulation 13(5A), taken together with regulation 13(5B) and section 40(5B) of FOIA, provides that a public authority may respond to a request by neither confirming or denying whether such information exists and is held by the public authority, to the extent that giving a member of the public the confirmation or denial would contravene any of the data protection principles.

The Role of the Tribunal

[55]The Tribunal’s remit is governed by s.58 FOIA. This requires the Tribunal to consider whether the decision made by the Commissioner is in accordance with the law or, where the Commissioner’s decision involved exercising discretion, he should have exercised it differently. The Tribunal may receive evidence that was not before the Commissioner and may make different findings of fact from the Commissioner.

The evidence

[56]The Tribunal considered an OPEN bundle of documents (692 pages). The Tribunal had the benefit of skeleton arguments from Mr Parker and the Council.[57]The Tribunal also considered a CLOSED bundle of withheld documents (227 pages). This consisted of unredacted copies of the information which appeared in the open bundle in a redacted form. This was received from the Council the day before the appeal due to misunderstanding between the IC and the Council as to who was preparing the bundle and was received by the panel shortly before the hearing. The Council provided additional unredacted CLOSED material to the Tribunal totalling 23 pages in the course of and after the CLOSED session.[58]Prior to the hearing an application under rule 14 of the Tribunal Rules had been made as regards the withheld material. In accordance with our duty under Browning we considered whether it was necessary to withhold the information in the closed bundles from the appellant. We were satisfied that it was necessary to withhold the information from Mr Parker in order to avoid defeating the purposes of the proceedings.[59]We heard OPEN and CLOSED evidence from Mr Ciaran Ward, Information Governance Officer and Data Protection Officer at the Council. Mr Ward was cross-examined by Mr Parker.[60]The following gist of the CLOSED session was prepared by Mr. Fitzsimons and approved by the Tribunal, before being provided to Mr Parker prior to the end of the OPEN session:
“The panel began the CLOSED hearing at 12.10 and considered the closed bundle of information in respect of both requests, alongside further unredacted information that was emailed to the Tribunal today. The panel asked questions about the CLOSED material to ascertain whether the personal data exception in Regulation 13 EIR had been properly applied. The panel also heard submissions from Mr Fitzsimons and from Mr Ward about the contents of the CLOSED materials and went through some materials highlighted by Mr Parker in the OPEN hearing on a line by line basis. Mr Ward also explained that where an application is outsourced to external planning consultants, all the materials they used to reach their decision would be returned to the Council and retained by it. The panel heard further submissions about how some of the redacted information was redacted because it fell outside the scope of the requests. The CLOSED hearing concluded at 1pm.”
Issues

Issues

[61]The IC and the Council agreed in their responses that there were three issues for the Tribunal to consider. They are:a. Has the council disclosed all relevant information it holds across both requests?b. In relation to Request 1, was the council entitled to withhold some information under Regulation 13 on the basis it was personal data of the neighbour and council staff?c. In relation to request 2, was the council entitled to rely on regulation 13(5A) EIR to neither confirm nor deny holding information in scope of Request 2 which related to whether or not a complaint or concerns were raised about a specific individual?[62]We have adopted the issues identified by the IC and the Council, because it appears to us that these encapsulate the legal questions which the Tribunal needs to decide in this appeal in order to reach a decision on the grounds advanced by Mr Parker. Issue 1 – has the Council disclosed all relevant information it holds across both requests?[63]It is well established that the test to be applied when considering whether a public authority holds information is whether the public authority holds it on the balance of probabilities: Bromley v Information Commissioner & the Environment Agency (EA/2006/0072). The test was set out in more detail in Preston v Information Commissioner v West Yorkshire Police [2022] UKUT 344 (AAC) at §§29-30 where it was held that: “When determining whether or not information is held, the Commissioner and Tribunal should apply the normal civil standard of proof – the balance of probabilities. The FTT, in Linda Bromley v the Information Commissioner and the Environment Agency (EA/2006/0072; 31 August 2007), held that in determining a dispute as to whether information is ‘held’: ‘There can seldom be absolute certainty that information relevant to a request does not remain undiscovered somewhere within a public authority’s records. This is particularly the case with a large national organisation like the Environment Agency, whose records are inevitably spread across a number of departments in different locations. The Environment Agency properly conceded that it could not be certain that it holds no more information. However, it argued (and was supported in the argument by the Information Commissioner) that the test to be applied was not certainty but the balance of probabilities. This is the normal standard of proof and clearly applies to Appeals before this Tribunal in which the Information Commissioner’s findings of fact are reviewed. We think that its application requires us to consider a number of factors including the quality of the public authority’s initial analysis of the request, the scope of the search that it decided to make on the basis of that analysis and the rigour and efficiency with which the search was then conducted. Other matters may affect our assessment at each stage, including, for example, the discovery of materials elsewhere whose existence or content point to the existence of further information within the public authority which had not been brought to light. Our task is to decide, on the basis of our review of all of these factors, whether the public authority is likely to be holding relevant information beyond that which has already been disclosed. ([13])’[64]The Tribunal has consistently applied the balance of probabilities when approaching this question: see, for example, Malcolm v Information Commissioner EA/2008/0072 at [24]; Dudley v Information Commissioner EA/2008/008 at [31], and Councillor Jeremy Clyne v IC and London Borough of Lambeth EA/2011/0190 at [21] – [22]. Importantly in Clyne v IC and London Borough of Lambeth the Tribunal held that the ‘issue for the Tribunal is not what should have been recorded and retained but what was recorded and retained.’ ([38]). The Tribunal was satisfied that a gap in the public authority’s documentary records reflected ‘inconsistent and poor administrative practice’, but this did not amount to a breach of FOIA.[65]Mr Ward’s evidence was clear that the Council had made appropriate searches to identify and locate material responsive to the Requests. He had worked closely with the planning team to identify all relevant documents including searching email archives using key terms such as planning reference numbers and dates.[66]There was no evidence before the Tribunal that indicated that the IC’s finding that the Council had disclosed all relevant information across both Requests was not in accordance with the law.[67]To the extent that documents were provided in a redacted form because the Council considered that the content of those documents fell outside the scope of the Requests, the Tribunal examined the unredacted documents in question. We were satisfied on balance of probabilities that the content of these documents indeed was outside the ambit of the Requests, so the information did not fall to be disclosed. Issue 2 - In relation to Request 1, was the council entitled to withhold some information under Regulation 13 on the basis it was personal data of the neighbour and council staff?[68]Regulation 13 of the EIR provides that information is exempt from disclosure if it is the personal data of an individual other than that of the requester and where one of the conditions listed in regulation 13(2A), 13(2B) or 13(3A) is satisfied. In this case, the relevant condition is contained in regulation 13(2A). This applies where the disclosure of the information to any member of the public would contravene any of the principles relating to the processing of personal data (‘the DP principles’), as set out in Article 5 of the UK General Data Protection Regulation (‘UK GDPR’)[69]The first step for the Tribunal, standing in the shoes of the IC, is to determine whether the withheld information constitutes personal data as defined by the Data Protection Act 2018 (DPA). If it is not personal data then regulation 13(2A) of the EIR cannot apply. Secondly, and only if the Tribunal is satisfied that the requested information is personal data, it must establish whether disclosure of that data would breach any of the DP principles.[70]As the IC explained in the Decision Notice, section 3(2) of the DPA defines personal data as:
“any information relating to an identified or identifiable living individual”
. There are two parts to this, which are that the information must relate to a living person and that the person must be identifiable, which means they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual. Information will relate to a person if it is about them, linked to them, has biographical significance for them, is used to inform decisions affecting them or has them as its main focus.[71]The Council asserted that any communication between it and third party members of the public (e.g. planning applicants) who are private citizens is by definition personal data - even though the planning application itself is in the public domain. The Council has stated that the planning applicant in this case is a private citizen and has not given consent for the Council to pass their personal information, personal opinions or email communications to any third parties.[72]The IC in the Decision Notice accepted that the planning application in question relates to an individual and, specifically, their place of residence, and the information relates to activities which have been carried out (or not carried out) in relation to a property that they are considered to be responsible for. Further, it was satisfied that that if only names and addresses were to be redacted, the remaining information would still allow individuals residing at the relevant address to be identified, at the very least by the individual making the request. It therefore concluded that this information was personal data.[73]We reviewed the unredacted content of the documents where information was redacted because the Council considered that it was personal data.[74]We found that the redacted information was personal data.[75]Mr Parker asked the Tribunal in particular to consider during the CLOSED session the unredacted versions of documents which appear in the OPEN bundle in redacted form at pages 368 to 372. We considered that these documents ought to be more lightly redacted than they appear to be in the bundle to reflect a correct interpretation of the exemption for personal data. However, we noted that the OPEN bundle does contain some duplication and that accordingly the same documents already appear in an appropriately (and more lightly) redacted form at pages 78 and 79 of the bundle. We therefore made no further order as to their disclosure.[76]The next step is to consider whether disclosure of this personal data would be in breach of any of the data protection principles.

(a) which states:

“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”
In the case of an EIR request, the personal data is processed when it is disclosed in response to the request. This means that the information can only be disclosed if to do so would be lawful, fair and transparent.[77]The Tribunal must consider whether there is a legitimate interest in disclosing the information, whether disclosure of the information is necessary, and whether these interests override the rights and freedoms of the individuals whose personal information it is. In so doing we recognise that such legitimate interest(s) can include broad general principles of accountability and transparency for their own sakes, as well as case specific interests.[78]The IC found that Mr Parker is pursuing a legitimate interest in transparency regarding how the Council is acting in respect of a planning decision. We understood how important accountability and transparency are to Mr Parker in the context of this appeal, so gave this appropriate weight.[79]We then turn to consider the question of necessity. “Necessary” means more than desirable but less than indispensable or absolute necessity. Accordingly, the test is one of reasonable necessity which involves the consideration of alternative measures, and therefore disclosure would not be necessary if the legitimate aim could be achieved by something less. Disclosure under the EIR must therefore be the least intrusive means of achieving the legitimate aim in question.[80]We agreed with the IC that disclosure of the redacted personal information under the EIR was not necessary to meet these legitimate interests. The Council’s position is that it has already met the interest in transparency regarding this matter by disclosing the majority of the requested information to Mr Parker. We therefore agreed with the IC that disclosure of additional personal information to the world at large under the EIR is not necessary and would not add anything to the substance of Mr Parker’s stated concerns. Other ways are available to challenge planning decisions which do not involve the disclosure of personal information or other disclosures under the EIR.[81]We therefore found that as disclosure of the redacted personal data in the material provided to Mr Parker under the EIR is not necessary to meet the legitimate interests test, there is no legal basis for the Council to disclose personal data and to do so would be in breach of principle (a). We therefore agree with the IC’s decision that the Council is entitled to rely on regulation 13 of the EIR to withhold the personal information to the extent that it is personal data within the meaning of the DPA. Issue 3 - In relation to request 2, was the council entitled to rely on regulation 13(5) (a) EIR to neither confirm nor deny holding information in scope of Request 2 which related to whether or not a complaint or concerns were raised about a specific individual?[82]This did not form part of Mr Parker’s initial complaint, but in the Decision Notice, the IC decided to determine the point because it considered that the Council was at risk of disclosing personal data without a lawful basis for doing so. The IC decided it was appropriate for him to proactively apply the relevant sections of the EIR/FOIA. In this case, having considered the nature of the requested information, which relates to potential disciplinary action in relation to a specific Council officer, the IC considered whether it was appropriate for the Council to confirm or deny whether the information was held.[83]Regulation 13(5)(a) of the EIR, and section 40(5B)(a)(i) of the FOIA, provides that the duty to confirm or deny whether information is held does not arise if it would contravene one of the principles relating to the processing of personal data (as set out in Article 5 of the General Data Protection Regulation - UK GDPR) to provide that confirmation or denial.[84]In order to rely on regulation 13(5) of the EIR, or section 40(5B) of the FOIA, and to refuse to confirm or deny whether there is information falling within the scope of the request, the following two criteria must be met:• Confirming or denying whether the requested information is held would constitute the disclosure of a third party’s personal data; and,• Providing this confirmation or denial would contravene one of the data protection principles. The IC considered that (f) was the most applicable here and we agree with this analysis.[85]The IC accepted that there may be some legitimate interest in the Council being open and transparent about the information that it holds regarding complaints about conduct and how it handles such matters on a case by case basis to show it is acting properly and fairly in each instance. He also accepted disclosure to be necessary in order to meet the wider public interest in transparency in relation to how it handles complaints about officers.[86]In order to balance the legitimate interests in confirming whether or not the requested information is held against the data subject’s interests, fundamental rights and freedoms, the Tribunal must consider the impact of the confirmation or denial.[87]As the IC noted in the Decision Notice, there may be situations in which giving the confirmation or denial to a requester would not necessarily contravene data protection principles because the requester might already know, or suspect, that the public authority holds the information. However, it is important to note that a disclosure under the EIR or FOIA is a disclosure to the public at large, and therefore to any person (and not just to the requester).[88]The IC found that an employee would have a very firm expectation that personnel issues and, in particular, disciplinary matters would remain private between themselves and their employer. They would have no expectation that such information would be shared with their peers or disclosed to the wider public. The IC considered that that even confirming or deny whether information relating to such matters is held would reveal personal, biographical information and would be intrusive and likely to cause distress.[89]This approach was supported by the Tribunal in the case of Rob Waugh v Information Commissioner and Doncaster College (E/2008/0038, 29 December 2008) in which it found that, “ … there is a recognised expectation that the internal disciplinary matters of an individual will be private.”[90]We agreed with the IC that an individual would have no reasonable expectation that the Council would confirm or deny to the world at large under the EIR or the FOIA whether they were, or were not, subject to a disciplinary complaint / investigation and that to do so may cause that individual damage and distress.[91]We therefore agreed with the IC that there is insufficient legitimate interest in this case to outweigh the data subject’s fundamental rights and freedoms. This means there is no Article 6 basis for processing, and disclosure of personal information in this instance would not be lawful.[92]We agreed with the IC that the Council should have cited 13(5)(a) of the EIR and/or section 40(5B)(a)(i) of the FOIA to neither confirm nor deny holding information within the scope of the request, as it could not confirm or deny that it held the information without disclosing personal information relating to the individual to whom the request relates. Discussion and conclusions[93]Having considered the issues before the Tribunal, we now turn to apply these to the grounds of Mr Parker’s appeal. The relief which Mr Parker sought through the appeal was for the Tribunal to order a comprehensive reinvestigation of the two complaints focusing on the substantive issues raised and that the Tribunal “rectifies the ICO's failure to engage fully with these issues and provides a clearer rationale for the conclusions reached in the Decision Notice.”[94]As an overarching point, under section 58 of FOIA, the Tribunal’s power on hearing an appeal is that if it finds the notice against which the appeal is brought is not in accordance with the law, or to the extent that the notice involved an exercise of discretion by the IC, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the IC and in any other case the Tribunal shall dismiss the appeal. The Tribunal is therefore concerned only with the lawfulness of the Decision Notice.[95]The Tribunal does not have power on an appeal under section 57 to find that the IC’s investigation was inadequate or to direct it to investigate in a different way; this would be a matter for the Administrative Court on judicial review. Ground 2 of Mr Parker’s appeal must fail, because this is concerned with the adequacy of the investigation carried out by the IC, not its issuance of the Decision Notice. Insofar as Grounds 3 and 4 concern the adequacy of the IC’s investigation, these must fail for the same reasons.[96]The Tribunal therefore is unable to order a reinvestigation by the IC of Mr Parker’s complaints.[97]We note Mr Parker’s contention that Request 2 contained four rather than three limbs and that the Decision Notice does not deal with the fourth which concerns the impact of stress and the mental health of particular individuals on the performance of the Council’s planning service. This was not submitted with the original Request 2, and Mr Parker’s witness statement at paragraph 46 makes it clear that it was submitted some weeks later. The following wording in Mr Parker’s email dated 12 May 2023 on this topic also suggests that this is a separate request:
“We have another FOI request and hopefully this will be the last one we need to raise”
. We found therefore that this did not form part of Request 2. Even if we are wrong to decline to order reinvestigation, then this issue would not fall to be determined by the Tribunal because it does not, as a matter of fact, form part of the Decision Notice under consideration.[98]Having found that the Council has disclosed all relevant information it holds across both requests, was entitled to withhold some information under Regulation 13 on the basis it was personal data of the neighbour and council staff and was entitled to rely on regulation 13(5A) EIR to neither confirm nor deny holding information in scope of Request 2 which related to whether or not a complaint or concerns were raised about a specific individual, it appears to us that the remaining grounds of Mr Parker’s appeal must also fail.[99]The Tribunal therefore dismisses the appeal.