Ashley Smith (for Windrush Against Sewage Pollution) v The Information Commissioner & Anor [2026] UKFTT 121 (GRC)

[2026] UKFTT 00121 (GRC)Case Reference: FT/EA/2024/0425
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 29 October 2025Date 28 January 2026
Information Rights
Heard by Cloud Video Platform
Before
JUDGE STEPHEN ROPERMEMBER ANNE CHAFERMEMBER DR. PHEBE MANN
Between
ASHLEY SMITHAppellant(for Windrush Against Sewage Pollution)AppellantTHE INFORMATION COMMIsSIONERRespondentENVIRONMENT AGENCYRespondentin person for Appellant for First Respondent: did not appear and was not represented for Second Respondent: Aaron Moss of CounselDecision: The appeal is AllowedSubstituted Decision Notice:The Tribunal’s Substituted Decision Notice in case reference FT/EA/2024/0425, set out below, is substituted for Information Commissioner’s Decision Notice reference IC-309325-B0K4, dated 18 September 2024, with regard to the request for information made to the Environment Agency by Ashley Smith dated 11 January 2024.Substituted Decision Notice
[1]The request for information made to the Environment Agency (the “Agency”) by Ashley Smith dated 11 January 2024 (the “Request”) sought declarations of interest forms for the Agency’s staff in the roles of Area Director and Regional Directors. For the purposes of the following (and for the reasons given in the Tribunal’s decision below), references to the role of ‘Deputy Director’ include the role of Area Director and references to the role of ‘Director’ are used rather than the term of Regional Director as referred to in the Request.[2]The Agency is not entitled to rely on section 40(2) of the Freedom of Information Act 2000 (the “Act”) to withhold the requested information, because that section is not engaged (save as provided in paragraph 5 below regarding any personal data of third parties other than Deputy Directors and Directors).[3]Subject to paragraph 5 below, the Agency must:a. disclose the requested information regarding Deputy Directors;b. disclose the requested information regarding Directors, if and to the extent that it has not already done so pursuant to the Information Commissioner’s Decision Notice reference IC-309325-B0K4 (and having regard to paragraph 4 below and the reasons given in the closed annex to this decision).[4]For the avoidance of doubt, the information which must be disclosed pursuant to paragraph 3 above applies to Deputy Directors and Directors which were in post at the date of the Request or which were in post at any time from 1 Jan 2019 to the date of the Request.[5]The Agency may withhold from the requested information any personal data of third parties other than Deputy Directors and Directors pursuant to section 40(2) of the Act. If the Agency wishes to withhold any information pursuant to any other exemption in the Act, then it must cite the applicable exemption and its reasons in its response.[6]Any withholding of information by the Agency pursuant to paragraph 5 above will be subject to the rights given under section 50 of the Act to make a new complaint to the Information Commissioner.[7]The Agency must take the steps set out in paragraph 3 above (and in paragraph 5 above, if applicable) within 35 days of this decision being sent to it, or (if there is an application to appeal this decision) within 28 days after being notified of an unsuccessful outcome to such application or any resulting appeal.[8]Failure to comply with this decision may result in the Tribunal making written certification of this fact pursuant to section 61 of the Act and may be dealt with as a contempt of court. REASONS

Preliminary matters

[1]In this decision (and in the closed annex; see paragraph 3), we use the following terms to denote the meanings shown: Agency: The Environment Agency (the Second Respondent). Balancing Test: The last limb of the Legitimate Interests Test, as referred to in paragraph 38. Commissioner: The Information Commissioner (the First Respondent). Decision Notice: The Decision Notice of the Commissioner dated 18 September 2024, reference IC-309325-B0K4, relating to the Request. Disputed Information: The Requested Information insofar as relating to Relevant Directors. DPA: The Data Protection Act 2018. Duty to Disclose: The duty of a public authority to communicate requested information which it holds, pursuant to section 1(1)(b) (set out in paragraph 27). FOIA: The Freedom of Information Act 2000. Legitimate Interests Basis: The basis for lawful processing of personal data specified in Article 6(1)(f), as set out in paragraph 35. Legitimate Interests Test: The three-part test for establishing the Legitimate Interests Basis, referred to in paragraph 37. Public Interest Test: The test, pursuant to section 2(2)(b) (set out in paragraph 30), as to whether, in all the circumstances of the case, the public interest in maintaining the exemption to the Duty to Disclose outweighs the public interest in disclosing the information. Relevant Directors: Agency staff in the role of Deputy Director/Area Director (see paragraphs 12 and 13) - and references to a ‘Relevant Director’ should be construed accordingly. Relevant Legitimate Interests: As defined in paragraph 46. Request: The request for information made to the Agency by the Appellant dated 11 January 2024, as set out in paragraph 6. Requested Information: The information which was requested by way of the Request. UK GDPR: The General Data Protection Regulation (EU) 2016/679, as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018. Withheld Material: Such of the Disputed Information which was withheld by the Agency and included in the closed bundle in the appeal.[2]Unless the context otherwise requires (or as otherwise expressly stated), references in this decision:a. to numbered paragraphs are references to paragraphs of this decision so numbered;b. to any section are references to the applicable section of FOIA; andc. to any Article are references to the applicable Article of the UK GDPR.[3]There is a closed annex to this decision. The closed annex refers to some specific aspects of the Withheld Material, in support of some of our reasons below. A copy of the closed annex has been sent to the Commissioner and to the Agency. It has been withheld from the Appellant because otherwise it would negate the right of the Agency and the Commissioner to seek to appeal this decision.

Introduction

[4]This was an appeal against the Decision Notice, which in summary (for the purposes of the appeal) decided that the Agency was entitled to rely on section 40(2) (personal information) to withhold the Disputed Information.

Background to the Appeal

[5]The background to the appeal is as follows.

The Request

[6]On 11 January 2024, the Appellant (acting on behalf of Windrush Against Sewage Pollution) contacted the Agency and requested information in the following terms: “Please provide copies of the declarations of interest forms submitted by staff in the roles of Area and Regional Director across the Environment Agency from 1. Jan 2019 to the present date. I am referring to financial and other business interests.”.[7]The Agency responded on 8 February 2024. It stated that staff below Executive Director level are not required to publicly disclose their declared interests (with the exception of those who are members of the Pensions Committee). The Agency’s position was therefore that the Requested Information was exempt under section 40(2).[8]The Appellant contacted the Agency on 31 March 2024, requesting an internal review.[9]On 16 May 2024, the Agency responded, upholding its previous position.[10]The Appellant contacted the Commissioner on 26 May 2024 to complain about the Agency’s response to the Request and the Commissioner subsequently issued the Decision Notice.

The Decision Notice

[11]The Commissioner considered that the scope of his investigation of the Appellant’s complaint was to determine whether the Agency was entitled to rely on section 40(2) in order to refuse to disclose the Requested Information.[12]As we have noted, the Requested Information referred to ‘Area Directors’ and ‘Regional Directors’. Paragraph 12 of the Decision Notice recorded the Agency’s views that:a. ‘Area Directors’ sit underneath Directors in parts of the Agency’s structure and that in some areas of the business these roles are referred to as Area Directors and in other areas they are referred to as Deputy Directors;b. ‘Regional Director’ is not a term used in the Agency’s organisational structure but that, as Regional Directors would logically sit above Area Directors, the Agency interpreted this aspect of the Request as seeking information for the roles of Directors.[13]The Decision Notice accordingly referred to the Requested Information as relating to the roles of Directors and Deputy Directors (with the term ‘Deputy Directors’ including Area Directors), rather than the terms Area Directors and Regional Directors as specified in the Request, for consistency with the nomenclature used by the Agency. In this decision (again, for consistency), we also use the terms Directors and Deputy Directors rather than the terminology used in the Request, with references to ‘Deputy Directors’ likewise also including Area Directors. For convenience, where the context requires, references in this decision to ‘Relevant Directors’ apply to any submissions of the Agency or the Appellant which referred only to ‘Area Directors’.[14]In the Decision Notice, the Commissioner concluded (in summary) that:a. the Requested Information was seeking personal data of the Agency’s staff in the roles of Deputy Director and Director;b. in respect of the Legitimate Interests Test, the Appellant was pursuing a legitimate interest for which disclosure of the Requested Information was necessary;c. in respect of the Balancing Test, the rights and freedoms of Agency staff holding the role of Deputy Director prevailed over the Appellant’s legitimate interest and accordingly the exemption in section 40(2) was engaged in respect of such staff;d. the Agency was therefore entitled to rely on that exemption to refuse to disclose the Requested Information relating to the role of Deputy Director;e. in respect of the Balancing Test, the Appellant’s legitimate interest prevailed over the rights and freedoms of Agency staff holding the role of Director (the more senior position) and accordingly the exemption in section 40(2) was not engaged in respect of such staff; andf. the Agency was therefore not entitled to rely on that exemption to refuse to disclose the Requested Information relating to the role of Director.[15]The Decision Notice therefore required the Agency to disclose the Requested Information relating to the role of Director. The appeal The grounds of appeal[16]The Appellant appealed the Decision Notice in respect of its conclusions regarding the Disputed Information. The Appellant did not challenge that the Disputed Information involved the personal data of Relevant Directors.[17]The material aspects of the Appellant’s grounds of appeal were (in essence) that, given the Agency’s job descriptions for Relevant Directors, they are individuals who are at risk of conflicts given the nature of their role and accordingly there is a need for transparency in respect of their declarations of interest forms. The Appellant also contended that it was necessary to disclose the Disputed Information in order to reassure the public that Relevant Directors comply with the Seven Principles of Public Life (the ‘Nolan Principles’).

The Tribunal’s powers and role

[18]The powers of the Tribunal in determining this appeal are set out in section 58, as follows: “(1) If on an appeal under section 57 the Tribunal considers—(a) that the notice against which the appeal is brought is not in accordance with the law, or(b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may Review any finding of fact on which the notice in question was based.”.[19]In summary, therefore, the Tribunal’s remit for the purposes of this appeal was to consider whether the Decision Notice was in accordance with the law. In reaching its decision, the Tribunal may review any findings of fact on which the Decision Notice was based and the Tribunal may come to a different decision regarding those facts. Essentially, the Tribunal is empowered to undertake a ‘full merits review’ of the appeal before it (so far as the Decision Notice is concerned).

Mode of hearing

[20]The proceedings were held by the cloud video platform. The Tribunal Panel, the Appellant and Mr Moss (for the Agency) joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.[21]The Commissioner did not attend the hearing and was not represented, having previously indicated that he would rely on the Decision Notice, his written submissions and other documentary material if there was an oral hearing.[22]There were no interruptions of note during the hearing.

The evidence and submissions

[23]The Tribunal read and took account of an open bundle of evidence and pleadings, as well as a closed bundle. The open bundle included a copy of the Agency’s organogram (which is also published online) and which we understand was similar to the version seen by the Commissioner during his investigation of the Appellant’s complaint. The closed bundle contained some Disputed Information (the Withheld Material) and some comments regarding the nature of such material.[24]We heard oral submissions from the Appellant and from Mr Moss on behalf of the Agency.[25]During the hearing, the Tribunal held a closed session (which excluded the Appellant). A gist of the closed session, approved by Mr. Moss during it, was provided to the Appellant at the resumed open hearing.[26]All of the contents of the bundles, including all of the submissions of the parties (as well as the submissions of the Appellant and Mr Moss during the hearing), were taken into account, even if not directly referred to in this decision. The relevant statutory framework General principles

The relevant statutory framework

[27]Section 1(1) provides individuals with a general right of access to information held by public authorities. It provides: “Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.”.[28]In essence, under section 1(1), a person who has requested information from a public authority is entitled to be informed in writing whether it holds that information. If the public authority does hold the requested information, that person is entitled to have that information communicated to them. However, those entitlements are subject to the other provisions of FOIA, including some exemptions and qualifications which may apply even if the requested information is held by the public authority. Section 1(2) provides: “Subsection (1) has effect subject to the following provisions of this section and to the provisions of sections 2, 9, 12 and 14.”.[29]Accordingly, section 1(1) does not provide an unconditional right to be told whether or not a public authority holds any information, nor an unconditional right of access to any information which a public authority does hold. The rights contained in that section are subject to certain other provisions of FOIA, including section 2.[30]Section 2(2) addresses potential exemptions to the Duty to Disclose. That section provides: “In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—(a) the information is exempt information by virtue of a provision conferring absolute exemption, or(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.”.[31]The effect of the above is that some exemptions which are set out in Part II of FOIA are absolute and some are subject to the Public Interest Test. Section 2(3) explicitly lists which of those exemptions are absolute (and, pursuant to that section, no other exclusions are absolute). Section 40(2) is included in that list, so far as relating to cases where the first condition referred to in that section is satisfied.[32]Accordingly, in summary, the exemption to the Duty to Disclose in section 40(2) is an absolute exemption only in cases where that first condition is satisfied, otherwise the exemption is subject to the Public Interest Test.

Section 40 – personal information

[33]So far as is relevant for the purposes of the appeal, section 40 provides: “…(2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1), and(b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles…”.[34]Section 40(7) sets out applicable definitions for the purposes of section 40, by reference to other legislation, the applicable parts of which are as follows:a. Section 3(2) of the DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (section 3(4)(d) of the DPA) and so includes disclosure under FOIA.b. The “data protection principles” are those set out in Article 5(1) and section 34(1) of the DPA.c. The first data protection principle, in Article 5(1)(a), is that personal data shall be: “processed lawfully, fairly and in a transparent manner in relation to the data subject”.d. A “data subject” is defined in section 3 of the DPA and means “the identified or identifiable living individual to whom personal data relates”.[35]To be lawful, the processing must meet one of the bases for lawful processing set out in Article 6(1). One such basis is where “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” (Article 6(1)(f)).[36]Article 6(1) goes on to include an exception to the Legitimate Interests Basis, stating that it does not apply to processing carried out by public authorities in the performance of their tasks. However, section 40(8) provides that such exception is to be omitted for the purposes of section 40, meaning that the Legitimate Interests Basis can be taken into account in determining whether the first data protection principle would be contravened by the disclosure of information by a public authority under FOIA.

The Legitimate Interests Test

[37]The Legitimate Interests Basis is the only basis for lawful processing listed in Article 6(1) which contains a built-in balance between the rights of a data subject and the need to process the personal data in question. There is a test which must be undertaken in order to determine whether or not the Legitimate Interests Basis can apply in any relevant scenario. This test involves consideration of three questions, as set out by Lady Hale in the Supreme Court’s judgment in the case of South Lanarkshire Agency v Scottish Information Commissioner [2013] UKSC 55, paragraph 18 : “(i) Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? (ii) Is the processing involved necessary for the purposes of those interests? (iii) Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?”.[38]The wording of question (iii) is taken from the Data Protection Act 1998, which has been superseded by the DPA and the UK GDPR. Accordingly, that question should now reflect the wording used in the UK GDPR such that the third question should now be:
‘Are those interests overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?’
. This last limb of the Legitimate Interests Test specifically addresses the balance between the rights of a data subject and the need to process the personal data in question.[39]It may be helpful to make it clear that the relevant test here (the Legitimate Interests Test) is different from the Public Interest Test; the Legitimate Interests Test applies only in respect of the assessment of the lawfulness of processing of personal data for the purposes of the Legitimate Interests Basis.[40]The question in the first limb of the Legitimate Interests Test must be satisfied before the second limb can be considered. Likewise, the question in the second limb of the Legitimate Interests Test must be satisfied before the third limb (the Balancing Test) can be considered.[41]For the purposes of the second limb of the Legitimate Interests Test, case law has established that the term “necessary” means something which is more than desirable but less than an indispensable or absolute necessity. Therefore the test is one of “reasonable necessity”. The test of reasonable necessity itself involves the consideration of alternative measures – consequently, the relevant processing of the personal data in question is not necessary if the legitimate interest being pursued could be achieved by something less (so the processing must be the “least restrictive” means of achieving the legitimate interest in question). Discussion and findings Preliminary points

Discussion and findings

[42]We start by noting that the positions of both the Agency and the Commissioner were largely aligned. The Agency also supported the conclusions reached in the Decision Notice, save as noted in paragraph 47.[43]Consequently, partly for convenience and partly because of the Agency’s representation in person at the hearing, the remainder of this decision generally refers only to the position or views of the Agency, but this should be taken as including reference to the Commissioner’s position or views to the extent applicable - and no disrespect to the Commissioner is intended by this approach. The issues in

The appeal

[44]The overall issue for the Tribunal to determine was whether the Commissioner was correct to determine in the Decision Notice that the Agency was entitled to rely on section 40(2) to withhold the Disputed Information.[45]As we have noted, the Appellant did not dispute that the Disputed Information involved the personal data of Relevant Directors.[46]The Agency did not challenge the Decision Notice’s conclusion that, in respect of the first limb of the Legitimate Interests Test, the Appellant was pursuing legitimate interests in seeking disclosure of the Disputed Information (the “Relevant Legitimate Interests”).[47]In his response to the appeal, the Commissioner stated that the “substantive question” in the appeal was whether or not the Balancing Test favoured the withholding or disclosure of the Disputed Information and he relied on the Decision Notice setting out his findings and the reasons for those findings. In its response to the appeal, the Agency stated that it agreed with the conclusions in the Commissioner’s response. However, the Agency’s response also stated that the Agency considered that disclosure of the Disputed Information was not necessary for the purposes of the second limb of the Legitimate Interests Test (which, of course, differed from the Commissioner’s response and the findings in the Decision Notice) and it went on to address matters in respect of the Balancing Test.[48]The Appellant disagreed with the views of both the Commissioner and the Agency regarding the outcome of the Balancing Test.[49]Accordingly, the relevant issues which we needed to determine were:a. whether disclosure of the Disputed Information was necessary for the purposes of the second limb of the Legitimate Interests Test;b. if the Tribunal concluded that such disclosure was necessary, whether (in respect of the Balancing Test) the Relevant Legitimate Interests were overridden by the interests or fundamental rights and freedoms of the Relevant Directors; andc. if the Tribunal concluded that the Relevant Legitimate Interests prevailed over the rights and freedoms of the Relevant Directors, whether (in respect of the first data protection principle) it would be fair and transparent for the Disputed Information to be disclosed.[50]Before we turn to those issues, we consider that it is appropriate to briefly set out our comments on certain other points (set out below) regarding the application of section 40(2) to the Disputed Information, even though those other points were not challenged by the parties.[51]We also consider it necessary to first address the scope of the Request and the nature of the Disputed Information, for the reasons we refer to below.

The scope of the Request and the nature of the Disputed Information

[52]During the hearing, some issues were raised regarding the scope of the Request. This in turn gave rise to an issue regarding the nature of the Disputed Information. In summary:a. the Agency had originally construed the Request as seeking the declarations of interest made over a period of time by staff holding the role of Deputy Director and Director at the time of the Request (therefore not former staff);b. the Agency had since understood (during the course of the appeal proceedings) that the Appellant was seeking the declarations of interest made by relevant staff at any time during the period specified in the Request, whether or not they were in post at the time of the Request (therefore including former staff);c. the Appellant confirmed that such understanding was correct;d. the Appellant contended that the Request sought copies of the actual declarations of interest forms which were submitted by the relevant Agency staff; ande. the Appellant challenged the nomenclature used by the Agency in respect of relevant staff.[53]The Request was plainly seeking information regarding the declarations of interest submitted by Agency staff who held the relevant roles within the period covering 1 Jan 2019 to the date of the Request. In our view, it is therefore evident from the wording of the Request that it was seeking such information regardless of whether the staff in question were still employed by the Agency at the time of the Request. We therefore consider that there was no basis for the Agency to interpret the Disputed Information as being limited only to staff members who were currently in post at the time of the Request.[54]We also note that the Agency did not offer advice and assistance to the Appellant, pursuant to section 16, to clarify its interpretation of the Request. Given our view that there was no basis for the Agency to interpret the Request in the narrow way that it did, we consider that it was remiss of the Agency not to do so.[55]The Agency submitted that, following its understanding that the Request sought declarations made by relevant staff whether or not they were in post at the time, the Withheld Material accordingly comprised information which was responsive to the Request (in respect of the Relevant Directors), covering not only those staff who were currently in post, but also former staff (within the date range specified in the Request). We address the content of the Withheld Material further below.[56]In respect of the Appellant’s contention that the Request sought copies of the actual declarations of interest forms, we agree with the Agency’s submission that FOIA only gives an entitlement to ‘information’ which is held by a public authority (as opposed to any specific ‘documents’ which it holds). Accordingly, the Appellant is not entitled to see copies of the actual forms submitted by the Relevant Directors.[57]We consider that the Appellant’s point regarding the nomenclature used by the Agency to refer to relevant staff is immaterial for current purposes. Essentially, the Agency accepted that the Request, in referring to ‘Area Director’, covered both the role of Area Director and the role of Deputy Director and this was reflected in the Decision Notice (see our comments in paragraphs 12 and 13).

Whether the Disputed Information encompasses personal data

[58]Whilst this was not disputed in the appeal (as we have noted), we find that the Disputed Information does encompass the personal data of the Relevant Directors (in accordance with the definition of ‘personal data’ set out in paragraph 34). Whilst the Request sought copies of declarations of interest forms submitted by Relevant Directors and (as we have noted) the Appellant is not entitled to copies of the actual forms, we find that an integral aspect of the Disputed Information is the names of the Relevant Directors.[59]If, contrary to our finding above, the Disputed Information did not include the names of the Relevant Directors, we consider that (to some extent at least) this would negate the purpose of the Request. As we address below (and as concluded by the Commissioner in the Decision Notice), the Request involved the pursuit of a legitimate interest in seeking to identify whether relevant staff at the Agency have any conflicts of interest. In order to know if a Relevant Director has a conflict of interest, it is necessary to know the identity of that Relevant Director.[60]Incidentally, if the names of the individuals were not within the scope of the Disputed Information (again, contrary to our finding above) then, for the reasons given in paragraph 61, some of the Disputed Information would not constitute personal data and would therefore fall outside of the exemption in section 40(2) relied on by the Agency in any event. However, this is immaterial for current purposes, given our finding that the names of the Relevant Directors was an integral aspect of the Disputed Information.[61]Whilst the Agency’s position was that the Disputed Information did encompass the personal data of the Relevant Directors (consistent with our finding above), we find that not all aspects of the Withheld Material comprise the personal data of the Relevant Directors. This is because that not all of the Relevant Directors are identifiable based on the content of the Withheld Material. We explored this in the closed session and the Agency submitted that individuals were identifiable because of the ‘jigsaw effect’ and/or applying the ‘motivated intruder’ test. We agree with that submission in respect of some, but not all, of the Withheld Material, for the reasons given in point 1 of the closed annex to this decision.[62]For clarity, our finding that not all aspects of the Withheld Material comprise the personal data of the Relevant Directors does not affect our conclusion that the Disputed Information includes the names of the Relevant Directors.[63]We also consider that the Agency holds further information within the scope of the Disputed Information, beyond the Withheld Material, because of our finding that not all aspects of the Withheld Material comprise the personal data of the Relevant Directors (and that the identity of the Relevant Directors is within the scope of the Request) and for the additional reasons given in point 2 of the closed annex to this decision.[64]Given our finding that the Disputed Information encompasses the personal data of the Relevant Directors, the first limb of section 40(2) is satisfied – namely the information in question constitutes personal data which is not the personal data of the person making the Request (the Appellant), as specified in section 40(2)(a).[65]Turning to the second limb of section 40(2) – namely, section 40(2)(b) - in order for the Disputed Information to be exempt from disclosure, the first, second or third condition referred to in that section must be satisfied. In our view, the first condition is relevant for the purposes of the appeal (which was not disputed) and the most relevant data protection principle is the first data protection principle (which was also not disputed).[66]In considering whether the processing of the personal data in question is lawful, in our view the most applicable lawful basis for processing is the Legitimate Interests Basis (which was also not disputed). Consequently, the Legitimate Interests Test is applicable, which we now address.

The Legitimate Interests Basis

[67]It may be helpful to reiterate the Legitimate Interests Basis. It provides:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data...”
. Translating that language to the context of the appeal: a. the disclosure of the Disputed Information would be ‘processing’; b. the Appellant is the ‘third party’; and c. the Relevant Directors (as the individuals to which the Disputed Information applies) are the ‘data subjects’.[68]As we have noted, the Commissioner’s conclusion in the Decision Notice regarding the first limb of the Legitimate Interests Test was not disputed by the parties. However, it may be helpful if we nevertheless briefly set out our comments in that regard. We agree with the findings of the Decision Notice that the Appellant, in making the Request, was pursuing legitimate interests in wanting to ascertain if relevant staff at the Agency have any conflicts of interest and that any conflicts of interest they do have are resolved and managed appropriately. This was particularly pertinent in connection with the role of the Agency in investigating water and sewerage companies and any potential conflicts of interest relevant to such investigations. The Agency also accepted that there was a legitimate interest in transparency and accountability in how Relevant Directors perform their roles, including with regard to any potential conflicts of interest. We find that the Appellant’s aims in seeking the Disputed Information were legitimate and, as reflected in the Decision Notice, had a wider public interest (rather than being limited to any personal interest of the Appellant). Accordingly we find that there were legitimate interests being pursued by the Appellant by way of the Request (the Relevant Legitimate Interests).[69]Turning to the second limb of the Legitimate Interests Test, the Commissioner’s findings in respect of that were not disputed by the Appellant but (we have noted) the Agency asserted in its response to the appeal that disclosure of the Disputed Information was not necessary to meet the Relevant Legitimate Interests.[70]The second limb of the Legitimate Interests Test involves ascertaining whether the relevant processing is necessary for the purposes of the Relevant Legitimate Interests. As we have noted, this test of ‘reasonable necessity’ must be met before the Balancing Test can be considered and the test of ‘reasonable necessity’ involves the consideration of whether the Relevant Legitimate Interests could be achieved by something less.[71]The Decision Notice recorded the Commissioner’s view that there was no less-intrusive way of achieving the Relevant Legitimate Interests, given that there was no information in the public domain on the declared interests of Relevant Directors (other than any members of the Pensions Committee). The Commissioner concluded that disclosure of the Disputed Information was therefore necessary to meet the Relevant Legitimate Interests.[72]The Appellant agreed with the Commissioner’s view that disclosure of the Disputed Information was necessary to meet the Relevant Legitimate Interests, including for the reasons given in his grounds of appeal.[73]In contrast, the Agency’s position was that disclosure of the Disputed Information was not necessary on the basis that (in essence) the Agency had in place robust internal procedures to record and manage any perceived or actual conflicts arising from the declarations of interest of Relevant Directors.[74]The Agency submitted that these procedures were well documented and internally enforceable, including with regard to consideration and risk assessment by staff senior to the Relevant Directors and that there were penalties for non-compliance with the requirement to give declarations, in the form of potential disciplinary action. Part of the Agency’s rationale related to Relevant Directors being less senior than Directors within the Agency’s hierarchy. The Agency therefore contended that disclosure of Relevant Directors’ interests to senior management (Directors) was a ‘lesser measure’ which satisfied the Relevant Legitimate Interests, such that it was not necessary to disclose the Disputed Information.[75]We disagree with the Agency’s position. We acknowledge and accept that the Agency has procedures in place to manage any Relevant Director’s perceived or actual conflict. However, they are internal procedures and in our view the Relevant Legitimate Interests are not fully satisfied by the existence and use of such procedures, primarily for the following two reasons (but we also address further below related points regarding the status and role of Relevant Directors in respect of the Balancing Test).[76]First, this is because part of the Relevant Legitimate Interests relates to identification of whether relevant staff at the Agency have any conflicts of interest. Knowing that the Agency has procedures to identify any conflicts of interest is not the same as knowing that any given Relevant Director has an actual or potential conflict and what that conflict is.[77]The second reason is that the Relevant Legitimate Interests include a wider public interest in transparency and accountability with regard to any potential conflicts of interest. We consider that such transparency is not achieved simply by the public knowing that the Agency has internal procedures to identify and manage any conflicts of interest. Also, linked to the first reason, there could be no meaningful public accountability if the procedures are implemented, and relevant conflicts managed, only internally.[78]One of the Agency’s arguments was, in essence, that disclosure of the Disputed Information would deter full and candid disclosure by Relevant Directors in their declarations of interest in the future. We do not consider that to be a material factor weighing against disclosure, particularly given that the Agency submitted that:a. employees are under an obligation to complete an annual declaration and that failure to declare an interest could result in disciplinary action;b. it was also in employees’ interests to declare any actual or potential conflicts of interest, as doing so would protect them against allegations of conflicts of interest; andc. guidance applicable to all employees makes it clear that if an employee is in doubt whether an interest could be a conflict, the interest should be declared.[79]We therefore consider that the Agency’s internal procedures do not sufficiently meet the Relevant Legitimate Interests. Accordingly, we find that the Decision Notice correctly concluded that the relevant processing (by way of disclosure of the Disputed Information) is reasonably necessary and proportionate for the purposes of the Relevant Legitimate Interests.[80]Having determined that disclosure of the Disputed Information was necessary for the purposes of the second limb of the Legitimate Interests Test, we therefore now turn to the Balancing Test.

The Balancing Test

[81]We recognise that, when considering potential disclosure of personal data under FOIA, the guiding principle (as confirmed by case law) is the protection of privacy with respect to the processing of personal data. However, there is a balancing exercise to be undertaken regarding the rights of a data subject and the need to process the personal data in question.[82]The Agency accepted that its employees (at all levels) should be beyond reproach and should always follow the Nolan Principles in undertaking their roles, especially given its status as the environmental regulator for England. The Agency considered that the more senior the employee, the greater the need for the public to be reassured in that regard. However, the Agency’s position was that this can be demonstrated by reference to its internal procedures outlined above.[83]Consequently, in a similar vein to its arguments in respect of the second limb of the Legitimate Interests Test, the Agency contended in respect of the Balancing Test that disclosure of the Disputed Information was not necessary. In particular, the Agency’s position was that Relevant Directors’ rights in respect of their personal data outweighed the public interest in disclosure.[84]Part of the Agency’s argument related to the status of Relevant Directors. The Agency argued, in essence, that the publication of the declarations of interest of the more senior roles (Directors and the Agency’s Chief Executive), together with its internal procedures outlined above, was appropriate to satisfy the Relevant Legitimate Interests. Fundamentally, the Agency considered that the declarations of interest which the Relevant Directors were duty-bound to provide and the reporting structure within the Agency meant that the senior roles could effectively deal with any potential or actual conflicts.[85]The Agency therefore agreed with the Commissioner’s view (in paragraph 39 of the Decision Notice) to the effect that the Relevant Legitimate Interests in transparency regarding actual or potential conflicts of interest was lower for the less-senior roles of Relevant Directors which carried lesser responsibility and lesser decision-making powers compared with Directors.[86]The Agency accordingly also argued that (consistent with the Commissioner’s conclusion in paragraph 40 of the Decision Notice) that the Relevant Directors did not have an expectation that their declarations of interest would be publicly disclosed. In support of its position (and related to its arguments on fairness in respect of the first data protection principle, which we address below), the Agency submitted that its privacy notice did not reference how Relevant Directors’ declarations of interest will be processed.[87]The rationale for the Commissioner’s conclusion (in paragraph 40 of the Decision Notice) that the Relevant Directors did not have an expectation that their declarations would be publicly disclosed was, essentially, that (as stated in paragraph 39 of the Decision Notice) the role of Relevant Director carried lesser responsibility and lesser decision-making powers compared with Directors. Given paragraphs 36 to 38 (inclusive) of the Decision Notice, it appears to us that the Commissioner based this view largely on the general structure of the Agency’s hierarchy, including with reference to the Agency’s organogram, rather than by consideration of the actual role of Relevant Directors.[88]The Appellant’s grounds of appeal set out the following two extracts from the job descriptions of Relevant Directors (to which we have added some emphasis):
“From handling major incidents to enabling continuous improvement and innovation, you’ll be accountable for the delivery of targets and outcomes in your Area and for working with your peers to ensure delivery across the country. Your political acumen will enable you to manage the reputation of the Environment Agency at a local level by building productive relationships with influential stakeholders, including politicians, local government bodies, communities, and third-sector organisations. You’ll be a highly experienced leader, with excellent communications skills, good judgement, strengths in collaboration and facilitation. These positions require a level of diplomacy commensurate with a high profile role in public policy and senior relationship management. Alongside these responsibilities you’ll be rewarded with a level of trust and inclusion in guiding the Agency successfully through some of the biggest challenges – and opportunities facing environment, economy and society.”
[89]The Agency did not dispute those extracts of the job descriptions. Also, the Agency’s response to the appeal set out further details of the nature of the role of Relevant Director and of the responsibilities and required attributes of Relevant Directors, including the following (also with emphasis added by us):
“The responsibilities of [Relevant] Directors cover a wide remit including administrating a diverse set of regulatory powers. [Relevant] Directors are at the heart of the organisation, overseeing teams of hundreds of employees delivering geographically based positive outcomes, with partners, for communities and nature across England. They are accountable for harnessing multi-million-pound budgets and developing plans to enhance the environment for some of the most at-risk parts of the country in terms of flood risk, social deprivation and economic growth. They lead teams responsible for asset management, regulation, incident management, evidence and monitoring and environment, place and infrastructure.” “The ability to understand a range of information to enable decision making. The ability to understand, develop and influence high level complex relationships with external partners and to translate strategy in action within own areas as part of an Operations leadership team. Experience of managing a team across a complex organisation and matrix management to deliver a technical and professional service. Ability to influence senior internal and external customers plus sound political acumen. Excellent communications skills and being confident to articulate environmental issues to political and technical groups and individuals. Ability to make decisions that can appear unpopular.” “Maintain financial accountability for large budgets, ensuring delivery is in within resources or bids for more made effectively, including sourcing and securing external funding to progress projects.” “Lead on risk management of the Area including Identifying and managing risks…” “Lead on significant change management and continuous improvement and innovation…” “Lead major incident management and resolution in the Area…” “Lead on the delivery of large programmes of work and large projects and portfolios on behalf of the EA.”
[90]Moreover, the Agency also submitted in its response that the role of Relevant Director is “key” to how the Agency operates and regulates at an Area level and that it also brings an Area perspective to how the Agency operates on a national level. The Agency also stated that in the ‘Area hierarchy’ the Relevant Director is “the most senior role” and “is accountable to national leaders, stakeholders and the public for environmental regulation in a geographical area”. During the hearing, the Agency also accepted that Relevant Directors could be the decision-makers in respect of important matters, including (potentially) issues of national significance.[91]In our view, it is clear from the above that Relevant Directors actually hold relatively senior positions with significant responsibilities and decision-making powers.[92]We turn now to the expectations of Relevant Directors regarding the potential disclosure of their declarations of interest. As we have noted, the Agency submitted that its privacy notice did not reference how Relevant Directors’ declarations of interest will be processed. However, the Agency did not provide a copy of its privacy notice as evidence in the appeal and therefore we could not substantiate that assertion. The Agency also did not provide any witness statement setting out the views of a Relevant Director in respect of their expectations for the potential disclosure of their declarations. Consequently, we find that the Agency did not demonstrate that the Relevant Directors would have an expectation that their declarations would not be disclosed.[93]In contrast, we consider that the following factors weigh against the Agency’s argument that Relevant Directors would have an expectation that their declarations would not be made publicly available:a. first, given our view that Relevant Directors occupy relatively senior positions with significant responsibilities and decision-making power, we consider that this is indicative of a potential expectation of disclosure, for essentially the same reasons given in the Decision Notice regarding the Directors’ roles;b. secondly, given that the Agency is a public authority subject to FOIA, we consider that its staff at a certain level (including Relevant Directors, given the nature of their role) should at least have an awareness of the possible disclosure pursuant to FOIA;c. thirdly (and linked to some extent to the two preceding points), as we noted in paragraph 90, the Agency accepted that part of the Relevant Directors’ role involved accountability to the public (and others); andd. fourthly, the names of the Relevant Directors were published publicly, by way of the Agency’s organogram. Therefore some of their personal data, including their identity, was already in the public domain as a result of the roles that they occupy within the Agency.[94]Taking into account the combination of those factors and our finding that the Agency did not demonstrate that the Relevant Directors would have an expectation of privacy, we find that the Decision Notice erred in concluding that the Relevant Directors would have an expectation that their declarations would not be made publicly available.[95]We also do not consider that disclosure of the Disputed Information would be likely to result in unwarranted damage or distress to the Relevant Directors. This is linked to our above comments in respect of their expectations, but again the Agency did not adduce any evidence regarding any such potential damage or distress. Likewise, the Agency did not adduce any evidence that Relevant Directors expressed concern regarding the potential disclosure of the Disputed Information.[96]For all of the above reasons, in respect of the Balancing Test we find that the Relevant Legitimate Interests were not overridden by the interests or fundamental rights and freedoms of the Relevant Directors. Accordingly, we conclude that disclosure of the Disputed Information would be lawful pursuant to the Legitimate Interests Basis.

The first data protection principle

[97]Given our finding that disclosure of the Disputed Information would be lawful pursuant to the Legitimate Interests Basis, we therefore turn to the question of whether such disclosure would be fair and transparent for the purposes of the first data protection principle.[98]As we have noted, the Agency argued that its privacy notice for employees did not reference how declarations of interest will be processed. The Agency’s position was therefore that disclosure of the declarations of interest for Relevant Directors would be neither fair nor transparent, linked to its arguments regarding the expectations of Relevant Directors.[99]As a public authority, we consider that that Agency’s privacy notice should cater for the potential disclosure of its employees’ personal data under FOIA (and the Environmental Information Regulations 2004). As we were not provided with a copy of its privacy notice, we cannot say to what extent this was covered and whether or not it addressed specifically the potential disclosure of the Relevant Directors’ declarations of interest.[100]If and to the extent there are any deficiencies in the Agency’s privacy notice in that regard, we do not consider that this should be a material factor weighing in favour of concluding that the processing or disclosure of the Disputed Information would be unfair or not transparent. Otherwise, a public authority could always rely on section 40(2) to withhold personal data by simply having an inadequate privacy notice which does address the potential disclosure of personal data under FOIA and then asserting that such disclosure would be unlawful (as not being fair or transparent) on the basis that it was not addressed in the privacy notice. This could, of course, effectively circumvent FOIA in respect of requests involving third-party personal data. Also, given that the approach to assessing whether the potential processing would contravene the data protection principles (which are enshrined in the DPA and the UK GDPR, as opposed to FOIA), it follows that a relevant consideration ought to be whether a public authority, as part of its compliance under the DPA and the UK GDPR, has in place a privacy notice which caters for the potential disclosure of personal data under FOIA.[101]Our comments in the preceding paragraph are not material to our conclusions, however. Of more relevance is the following. As we have noted, the Agency has not demonstrated that processing by way of disclosure of the Disputed Information would be contrary to its staff privacy notice but merely submitted that it would. Moreover, the Agency did not dispute the findings of the Decision Notice in respect of Directors and consequently accepted that disclosure of their declarations would be fair and transparent, despite its argument that disclosure of the declarations was not covered in the privacy notice.[102]We therefore do not accept the Agency’s argument that disclosure of the Disputed Information would not be fair or transparent on the basis that it was not covered in its privacy notice, when the Agency has accepted that disclosure would be fair and transparent for Directors subject to the same privacy notice.[103]The only material difference between the Agency’s position in respect of the fairness and transparency of disclosure of declarations for Directors and Relevant Directors related to the individuals’ expectations. However, for the reasons we have given, we do not accept that Relevant Directors would have an expectation that their declarations would not be disclosed. Summary[104]For all of the above reasons (and subject to our comments in paragraphs 105 and 106), we find that section 40(2) was not engaged in respect of the Disputed Information and accordingly that the Agency cannot rely on that section to refuse to disclose the Disputed Information.

Other issues

[105]We should comment that the Disputed Information may contain personal data of third parties (namely, other than Relevant Directors). This is because, in providing declarations of interest, Relevant Directors may (for example) refer to jobs held by their relatives or friends. Our findings above regarding the Legitimate Interests Test (including expectations of privacy and related matters) and the first data protection principle apply only to Relevant Directors and not others.[106]Consequently, if and to the extent that any such third parties are not Relevant Directors, then it may be permissible for the Agency to withhold the personal data of such third parties in disclosing the Disputed Information and accordingly this is reflected in the Substituted Decision Notice we set out above.

Final conclusions

[107]For all of the reasons we have given, we find that the Decision Notice erred in concluding that section 40(2) was engaged in respect of the Disputed Information and that the Agency was therefore entitled to rely on that exemption to refuse to disclose it.[108]We therefore allow the appeal and we make the Substituted Decision Notice as set out above. Signed: Stephen Roper Date: 22 January 2026 109. Judge of the First-tier Tribunal