Sarwat Jahan v The Information Commissioner & Anor [2026] UKFTT 1197 (GRC)

[2026] UKFTT 01197 (GRC)Case Reference: FT.EA.2024.0284
First-tier Tribunal
(General Regulatory Chamber)
Hearing Heard on the papers: 2 April 2025 and 12 June 2026Date 19 August 2026
Information Rights
Before
TRIBUNAL JUDGE FOSSTRIBUNAL MEMBER COSGRAVETRIBUNAL MEMBER CHAFER
Between
SARWAT JAHANAppellantTHE INFORMATION COMMISSIONERRespondentLONDON BOROUGH OF REDBRIDGERespondentunrepresented for Appellant for First Respondent: Information Commissioner’s Office for Second Respondent: unrepresentedDecision:The Appeal is DISMISSED.REASONS

Background

[1]This is an appeal against Decision Notice Reference: IC-278983-Z8G4 dated 1 July 2024, in which the First Respondent (“the Commissioner”) decided that the Second Respondent (“the Borough”) was entitled to rely on s40(2) of the Freedom of Information Act 2000 (“FOIA”) to withhold information requested by the Appellant relating to a Penalty Charge Notice (“PCN”) issued by the Borough in relation to a parking contravention (“the disputed information”).[2]The parties were agreeable to the determination of the appeal on the papers, that is to say, without an oral hearing.[3]We had before us an OPEN bundle. At our initial deliberations we could not identify any CLOSED material, including the disputed information, and issued directions to the Respondents accordingly.[4]Having obtained the disputed information and then further submissions from the Commissioner and the Borough, we are satisfied, pursuant to Rule 32(1)(b) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009, that we can properly determine the issues without a hearing.[5]It is sufficient for us to issue an OPEN decision only.

The Request

[6]The Request On 21 August 2023, the Appellant requested the following from the Borough (“the Request”): “Copies of all the PCNs issued on 27th & 28th February 2023 by Civil Enforcement Officers in and around Torbitt Way / around William Torbitt Primary School at the following times: 06:00 to 08:30 08:30 to 09:15 09:15 to 15:00 15:00 to 15:45 15:45 to 18:30 Number of PCNs issued in Torbitt Way / around William Torbitt Primary School with PCN numbers and copies of PCNs on 27th & 28th February 2023 in between times mentioned in the table."[7]The Borough responded on 21 September 2023. It said that one PCN had been issued between 15:00-15:45 on 27 February 2023, and two PCNs within the same period on 28 February 2023.[8]The Borough said that it held copies of the PCNs issued but was unable to disclose them to the Appellant as “the information” constituted personal data, which was exempt from disclosure pursuant to s40(2) FOIA.[9]On 24 September 2023, the Appellant sought an internal review of the Borough’s refusal to provide copies of the PCNs. The Appellant said two of the PCNs identified by the Council had been issued to them, of which they retained copies, and what they sought was a copy of the third PCN, issued to someone else, with any personal data therein deleted.[10]On 30 October 2023, the Borough responded, saying simply that it could not disclose the requested information which was withheld pursuant to s40 of the Data Protection Act 2018 (“DPA”). We assume that reference to s40 of the DPA is an error, and that the Borough meant to refer to s40(2) FOIA.[11]On 24 December 2023, the Appellant complained to the Commissioner. In so doing, they explained the following:a. The Appellant had not been at the location shown on the PCN issued to them on 27 February 2023 at the time of issuance of that PCN, having used a “different car” on that date.b. In relation to the first PCN issued on 28 February 2023: the PCN had not been issued “as per law”; the Borough had used the same evidence (pictures of the car) used on 27 February 2023.c. In relation to the second PCN issued on 28 February 2023, “the Council is misleading about this alleged third PCN as it has evidence against the Council. (sic)”.[12]The Commissioner investigated. On 21 March 2024, the Borough explained to the Commissioner that the Borough did not keep copies of PCNs issued and, if it did, such copies would contain information that could be connected/traced to identifiable individuals:
“Once the officers Handheld Computer is downloaded the issued PCNs are deleted from the device and it cannot reprint them.”
[13]The Borough supplied the Commissioner with what it described as generic data “i.e. minus any information that could be used to identify somebody, relating to PCNs issued at the location/time/date in question”: a template of a PCNas a PDF to which the requested data would have been printed. The Borough requested that this not be disclosed as disclosure of the template would enable someone to re-create the Borough’s PCN for fraudulent purposes. The Borough maintained that the disputed information was personal data within the meaning of the Data Protection Act 1998 (we assume the Borough meant to refer to the DPA), and its disclosure would likely cause damage or distress to “the individual”.[14]The Commissioner queried the inconsistency between the Borough’s initial account that it held copies of issued PCNs and its subsequent account that it did not. In response, the Borough confirmed that it retains the data collected but not the PCN itself; the data could be supplied as an excel or csv file, but the Borough could not provide a copy of the withheld PCN as issued.[15]On 4 June 2024, the Commissioner explained to the Appellant that a PCN would contain two broad classes of information: generic information which would be contained in any PCN, and information relating specifically to the incident that resulted in the disputed information. He noted that the Appellant was already in possession of the generic information because they were in possession of two of the three PCNs. In his view, the disputed information, being “the information relating to the circumstances of the third PCN”, would relate to the third party subject to that PCN and would therefore constitute personal data, exempt from disclosure pursuant to s40(2) FOIA.[16]The Commissioner invited the Appellant to confirm whether they required a formal Decision Notice which was likely to confirm his preliminary conclusion. The Appellant sought a review by the Commissioner of his preliminary conclusion. In so doing, they observed as follows:a. The Borough had recently lost a case in the County Court, which it had brought against the Appellant, by forging and falsifying Council records.b. PCN numbers are not personal data.c. Generic information such as “Parked in a residents or shared used parking place or zone without either clearly displaying ticket” is not personal data.d. Locations, times and dates of parking contraventions are not personal data.e. A review of the Commissioner’s decision was essential because “there are various complaints made to the ICO against the London Borough of Redbridge with the evidence of misleading information, distorting, forging and manipulation of official records by the Council in order to fulfil their one point agenda. The agenda is to make our lives more difficult to take revenge by standing against some Council employees, who are involved in illegal and criminal acts.”

The Decision Notice

[17]On 1 July 2024, the Commissioner issued the Decision Notice, in which he said that:a. He had examined the disputed information.b. He excluded from consideration two of the three PCNs on the basis that they comprised the personal data of the Appellant.c. He was satisfied that, in relation to the third PCN, “this information quite clearly relates to an identifiable individual” and all of the remaining disputed information comprises third party personal data: “This is because the PCN was generated solely because of an alleged parking contravention involving the person on whom it was issued. The information contained in the PCN clearly relates to that individual, who is clearly identifiable.”d. He noted that the third PCN did contain some generic information, such as the name of the public authority and instructions for payment; “However the Commissioner is mindful that the complainant already has the generic information contained in a PCN by virtue of the fact that they have already been issued with two PCNs. The right of access under FOIA is to information rather than documents, and the complainant has already received the generic information contained in the third PCN via the other two PCNs.”e. In his assessment of whether disclosure of the disputed information would contravene Article 5(1)(a) of the UK GDPR, the Commissioner concluded that: i. There is a legitimate interest in disclosure of information which may hold the Borough to account and promote transparency in relation to its issuing of PCNs. ii. However, disclosure was not necessary to meet that legitimate interest because there were other, less intrusive methods of holding the Borough to account, namely the facility to challenge a PCN through the Borough’s standard procedures. iii. There was, therefore, no lawful basis for disclosure of the disputed information.f. The Borough was entitled to rely on s40(2) FOIA to withhold the disputed information.

The Appeal

[18]By Notice of Appeal dated 25 July 2024 the Appellant appeals against the Decision Notice. Their grounds of appeal broadly reiterate the points they made to the Commissioner, in summary, that the information they seek is not personal data.[19]By a Response to the appeal dated 28 August 2024, the Commissioner submits, in summary, that the Appellant already possesses the generic information they seek and has not explained in any detail why the remaining information is not personal data.[20]By a Reply to the Commissioner’s Response, dated 9 September 2024, the Appellant maintains that they are not seeking personal data, and the Borough’s reliance on s40(2) FOIA is accordingly misplaced.[21]The Appellant makes further, extensive submissions in the appeal relating to a wider course of dealings between the Borough and the Appellant, which we have read carefully, but do not raise any issue for determination by us in this appeal. For the purposes of our decision, we need only note that the Appellant submits that:a. The PCN issued to the Appellant on 27 February 2023 is forged by the Borough, which assumed that the Appellant was using the same car on 27 February 2023 as they use for their daily school runs, whereas the Appellant was using a different car on 27 February 2023.b. The PCN issued on 28 February 2023 to a person other than the Appellant, does not exist.c. The Borough has recently lost a case in another matter of an unlawful PCN, in which the Borough had deliberately submitted misleading information against the Appellant in the Northampton County Court and “submitted a false witness statement to continue their agenda”; Northampton County Court has now revoked a Warrant of Control used to enforce its rights against the Appellant at their home.[22]By written submissions dated 17 December 2024, the Borough submits that:a. Two of the three PCNs responsive to the Request are already in the Appellant’s possession, so that the Borough is not required to disclose the personal data therein to the Appellant.b. In relation to the generic information in those two PCNs, the Borough relies on s21 FOIA (information accessible by other means).c. Consequently, the appeal turns on a relatively simple question: does the third PCN contain information other than that which is(a) generic to all PCNs and(b) personal information. If it does contain such information, then that information can be disclosed. If it does not contain such information, then there is no reason to depart from the Council’s original refusal.[23]By its submissions, the Borough states that it does not retain copies of PCNs once they are issued:
“The Council’s parking officers are issued with handheld computers. These are used to record the PCN which are issued and the information contained within that PCN. The Council maintains a record of this information but not in the form of a copy of the PCN.”
[24]The Borough relies on CLOSED evidence before the Tribunal as follows:a. A PDF file of a pro forma PCN, which the Borough says “contains all of the generic information found in PCN issued by the Council. The information which is specific to the subject of the PCN (which is personal information) is added to the pro forma before it is issued.”b. The information contained in the third PCN which falls within the scope of the Request.c. A table showing the PCNs which were issued in respect of vehicles parked in the relevant location on 27 and 28 February 2023. The table contains nine entries presented in groups of three. The Borough explains that, in fact, each group constitutes a single notice, the details of which have simply been duplicated.[25]By further submissions dated 6 March 2026, the Commissioner submits that:a. One or any combination of the indirectly identifying information contained in the disputed information is capable of identifying a living individual with complete certainty and therefore falls within the definition of personal data under s3(2) DPA: i. PCN No – this is a unique reference number. Those in possession of a PCN and the relevant records or database will be able to identify the name of the recipient of the PCN, the address the PCN was sent to, the car involved and the data and time of the alleged contravention. ii. Vehicle Registration Number - a VRM could allow a person to be indirectly identifiable, when linked to other information about the registration (e.g. from the DVLA). iii. Make and colour of vehicle. iv. “Was Seen in”. v. Location. vi. Timings. vii. Date. viii. Reason for contravention.b. The data listed at i. to viii. above is the personal data of the person to whom the PCN was issued.c. The number of the Civil Enforcement Officer who issued the PCN is the personal data of that officer as it appears to be a reference unique to that officer.[26]By further submissions dated 5 May 2026, the Borough submits that:a. The date, time of contravention, location and offence code in the withheld PCN constitute personal data because they allow indirect identification of the subjects of the PCN. To the extent that it may be argued that such words are not personal data because they form part of the pro forma PCN, they are nevertheless important contextual information “and so part of the personal information.” If the Tribunal does not accept this submission, then the Borough accepts that the words “data” We assume reference to “data” is intended to be to “date”. , “time”, “location” and “offence code” are not personal data.b. The proper test is not whether the Appellant can identify the data subject, but, bearing in mind that disclosure pursuant to FOIA is disclosure to the world, whether it would be possible for any person to identify them.c. The disputed information allows the identification of cars, thus allowing someone who knows which cars were parked in the relevant location at the relevant time to know that they were subject to a PCN: “This information is publicly available. It was apparent to anyone present at the relevant time, anyone with access to CCTV, or anyone with a “Ring” doorbell (or equivalent) which covers the relevant area.”d. If the vehicle which is subject to the withheld PCN can be identified, then the owner of the vehicle and thus the person subject to the PCN can be identified: i. a Vehicle Registration Number can be personal data because it can be linked to other information held about the registration (e.g. by the DVLA) to indirectly identify the owner of that vehicle.” ii. the person who owns the vehicle can also be identified from observation of that vehicle.e. Given the above, it is possible to identify (from other available information) the natural persons who are subject to the withheld PCN.

The Legal Framework

[27]The relevant provisions of FOIA are as follows: Section 1 General right of access to information held by public authorities. (1) Any person making a request for information to a public authority is entitled- (a) To be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) If that is the case, to have that information communicated to him.[28]The general right of access, is, however, subject to certain exemptions set out in Part 2 of FOIA. Relevant to this appeal are s21 FOIA and s40 FOIA.[29]S21 FOIA provides as follows: Section 21 Information accessible to applicant by other means.(1) Information which is reasonably accessible to the applicant otherwise than under section 1 is exempt information.(2) For the purposes of subsection (1)— (a) information may be reasonably accessible to the applicant even though it is accessible only on payment, and (b) information is to be taken to be reasonably accessible to the applicant if it is information which the public authority or any other person is obliged by or under any enactment to communicate (otherwise than by making the information available for inspection) to members of the public on request, whether free of charge or on payment.(3) For the purposes of subsection (1), information which is held by a public authority and does not fall within subsection (2)(b) is not to be regarded as reasonably accessible to the applicant merely because the information is available from the public authority itself on request, unless the information is made available in accordance with the authority’s publication scheme and any payment required is specified in, or determined in accordance with, the scheme.[30]S40 FOIA provides as follows: Section 40 Personal information(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.(2) Any information to which a request for information relates is also exempt information if— (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles ...[31]S3(2) of the DPA defines personal data as “any information relating to an identified or identifiable living individual.”[32]The “processing” of personal data includes disclosure by “transmission, dissemination or otherwise making available” (s3(4)(d) DPA).[33]The first data protection principle under Article 5(1)(a) of the UK GDPR is that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject”. “Lawful” entails disclosure meeting one of the conditions of lawful processing listed in Article 6(1) UK GDPR.[34]The applicable condition in this case is Article 6(1)(f) UK GDPR, namely that the disclosure “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.[35]Section 40(2) FOIA, so far as relating to the first condition under s40(3A) FOIA, is an absolute exemption, and not, therefore, subject to a public interest test.[36]S58 FOIA provides that:(1) If on an appeal under section 57 the Tribunal considers- (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.(2) On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based.[37]The import of s58 FOIA is that the right of appeal to the First-tier Tribunal involves a full merits consideration of whether, on the facts and the law, the public authority’s response to the Request is in accordance with Part 1 of FOIA (Information Commissioner v Malnick and ACOBA [2018] UKUT 72 (AAC); the Tribunal has jurisdiction to decide, de novo on the merits, whether the Commissioner’s decision is in accordance with the law.

Analysis

[38]Analysis We should say at the outset that it is no part of our jurisdiction to determine any alleged error, deceit or malfeasance on the part of the Borough in relation to the PCNs which are the subject of this appeal. Our jurisdiction is only to determine whether the Borough is entitled to refuse to disclose the three PCNs it issued within scope of the Request, by reference to s21 FOIA or s40(2) FOIA.[39]We are satisfied that the Borough does not retain copies of the three PCNs as actually issued. What it retains, and has shown us in relation to two of the three PCNs issued, is the data population of the PCNs, which it has included in the Borough’s pro forma PCN so as effectively to reconstitute the PCNs in question.[40]We have reviewed:a. A reconstitution of what we shall term PCN No. 1: issued to Vehicle A which was seen in parking contravention on 27 February 2023 at a specific location in Torbitt Way at a time within scope of the Request.b. A reconstitution of what we shall term PCN No. 2: issued to Vehicle B which was seen in parking contravention on 28 February 2023 at a specific location in Torbitt Way at a time within scope of the Request.c. A copy of the PCN as issued to the Appellant which we shall term PCN No. 3: issued to Vehicle A which was seen in parking contravention on 28 February 2023 at a specific location in Torbitt Way at a time within scope of the Request.[41]PCN No. 1 and PCN No. 3 were both issued to a vehicle of the same Vehicle Registration Number which we understand to be that of the Appellant. We are told that the data population of PCN No. 2 is the disputed information, that is to say, it is the data in the PCN which was issued to a person other than the Appellant.[42]We find that the Borough is entitled to rely on s21 FOIA to refuse disclosure of the data in the PCNs it issued to the Appellant. That data has already been made available to the Appellant by virtue of the Borough having issued them with the PCNs which contain that information.[43]As regards the disputed information, the Appellant says that they do not seek disclosure of the personal data in that population, only the generic information in it, including the parking contravention described.[44]The information in the data population of the reconstituted PCNs Nos. 1 and 2 is identical in these respects: the address of Torbitt Way, the number of the Civil Enforcement Officer, the parking contravention description and contravention code, and information about the sum of the penalty charge, and the requirements for and means of its payment.[45]The information in the data population of the reconstituted PCNs Nos. 1 and 2 is different in these respects: the PCN number, the vehicle registration number, the make and colour of the vehicle, the precise location of where the vehicle was seen in Torbitt Way, and the time and date of the contravention.[46]In our view, the following data in reconstituted PCN No. 2 which was contained in the original PCN No. 2 as issued to a person other than the Appellant is personal data: the PCN number, the vehicle registration number, the make and colour of the vehicle, the precise location of where the vehicle was seen in Torbitt Way, the time and date of the contravention, the parking contravention description and contravention code, and the sum of the penalty charge.[47]We consider that all that data, that is to say the data in PCN No. 2 which is different from that in PCN No. 1, is personal data in that it relates to an identifiable living individual, predominantly the person to whom the PCN was issued, but also, in the form of their identification number, to the Civil Enforcement Officer who issued the PCN.[48]In relation to the person to whom the PCN was issued: disclosure under FOIA, which is effectively disclosure to the world, would enable someone who was present at the time of the issue of the PCN to know that a PCN had been issued to the vehicle in question. If the vehicle is identifiable, so too is its owner (being one and the same person to whom the PCN was issued) because it may be linked to other information held about the registration, for example, information held by the DVLA. Its disclosure would indirectly identify the owner of the vehicle. The owner could also be identified from observation of the vehicle. By at least those means, it would be possible to identify the natural person to whom PCN No. 2 was issued.[49]In relation to the Civil Enforcement Officer, the disclosure under FOIA of their number would, linked to other publicly available information, make them identifiable.[50]As regards that information in reconstituted PCN No. 2 which we determine to be personal data, we must determine whether its disclosure under FOIA would contravene Article 6(1)(f) UK GDPR: specifically, would disclosure be lawful, fair and transparent?[51]Dealing with the first requirement of lawfulness: resolving that issue involves consideration of three questions (South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55) [18]:a. Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?b. Is the processing involved necessary for the purposes of those interests?c. is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?[52]Question c. above was framed by reference to the Data Protection Act 1998, which is now replaced by the DPA and the UK GDPR. It should therefore now reflect the words used in the UK GDPR - whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.[53]Dealing first with legitimate interest: we accept that there is a legitimate interest in the accountability and transparency of the Borough’s operations to address parking contraventions, and that, specifically, the Appellant is pursuing a legitimate interest in attempting to establish whether the PCNs issued to her were issued in accordance with the law.[54]Dealing next with necessity: the word “necessary’ in this context must be interpreted consistently with its interpretation in EU jurisprudence, from which the concept derives in the GDPR and carries over into the UK GDPR. There it has a specific meaning: reasonable necessity rather than strict or absolute necessity. The processing to which the word “necessary” applies must be proportionate to the aim pursued by that processing and entail the minimum interference with the privacy rights of the data subject that will achieve the aim in question (R (Ali & another) v Minister for the Cabinet Office & another [2012] EWHC 1943 (Admin) [76]). It requires the consideration of alternative measures, so the measure must be the least restrictive means of achieving the legitimate aim in question (Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC)) [39] and South Lanarkshire [27]. For something to be necessary, there must be no other reasonable means of achieving it: Information Commissioner v Halpin [2020] UKUT 29 (AAC).[55]We do not consider that disclosure of the personal data we have identified is necessary to satisfy the legitimate interests we have identified. If the Appellant considers that the PCN issued to them is fictitious, disclosure of the personal data in PCN No. 2 would not, of itself, establish that issue. A less intrusive means of identifying any error, deceit or malfeasance on the part of the Borough would be by the issue of appropriate proceedings against the Borough, eliciting its substantive, formal response and relevant disclosure in such proceedings in due course.[56]Given that we have found that disclosure is not necessary to satisfy the legitimate interests we have identified, it is not necessary for us to determine whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.[57]The information in reconstituted PCN No. 2, which we do not determine to be personal data, that is to say, the pro forma data, is found in the following words:a. “Copy of Penalty Charge Notice”b. “It is a criminal offence for an unauthorised person to remove or interfere with this notice.”c. “London Borough of Redbridge”d. “PENALTY CHARGE NOTICE (PCN) Traffic Management Act 2004”e. “PCN No:”f. “Date of Service of this Notice:”g. “Vehicle Registration Number:”h. “Make:”i. “Was seen in:”j. “Location:”k. “from:”l. “to:”m. “By Civil Enforcement Officer (number):”n. “who had reasonable cause to believe that the following parking contravention had occurred:”o. “Contravention Code:”p. “Please see overleaf for details of how to pay and what to do if you think that this PCN should not have been issued.”q. “DO NOT PAY THE CIVIL ENFORCEMENT OFFICER”r. “Detach here”s. “Payment Slip”t. “Notice No:”u. “Date:”v. “Veh. Reg:”w. “FOR INSTRUCTIONS ON PAYMENT SEE OVERLEAF”x. “If payment is made by post please detach this slip and return it with your payment to the address shown overleaf”.[58]The Appellant already has this information in the form of the PCNs which were issued to them. The Borough is entitled to refuse to disclose that information in reliance on s21 FOIA.

Conclusion

[59]Conclusion There is no error of law in the Decision Notice.[60]The Appeal must be dismissed.