Peter Whyton v Information Commissioner & Anor
[2022] UKFTT 518 (GRC)
Annette Carrabino v Information Commissioner
28 August 2024
[2024] UKFTT 775 (GRC)
First-tier Tribunal
Someone complained about a council's handling of a noise complaint, and wanted to know who else the council was talking to about it. The council refused to say, but a judge said the council *had* to reveal this information because the public's right to know how the council acted outweighed the person's privacy rights. The council has to tell who they were secretly talking to.
Key Facts
- •Annette Carrabino requested information from the Royal Borough of Kensington & Chelsea (RBKC) under the Environmental Information Regulations 2004 (EIR) regarding a noise dispute involving her son's piano practice.
- •The dispute involved complaints from a neighbour, leading to legal action and significant costs for RBKC.
- •The remaining issue concerned the identity of a recipient redacted from an email between RBKC officials and a councillor.
- •RBKC refused to disclose the identity, citing the protection of third-party personal data.
- •The Information Commissioner upheld RBKC's refusal.
- •Carrabino appealed to the First-tier Tribunal (General Regulatory Chamber).
Legal Principles
The Tribunal exercises a full merits appellate jurisdiction, reviewing the Commissioner's decision and applying the provisions of the Act.
Information Commissioner v Malnick [2018] UKUT 72 (AAC)
EIR presumes disclosure of information unless the information includes personal data of which the applicant is not the data subject.
Environmental Information Regulations 2004, Regulation 12(2) and (3)
Disclosure of personal data is permitted under Article 6(1)(f) of UK GDPR if necessary for the purposes of legitimate interests, unless overridden by the data subject's interests or rights.
UK GDPR, Article 6(1)(f)
Outcomes
The appeal is allowed.
The Tribunal found that Carrabino was pursuing a legitimate interest in transparency and accountability regarding RBKC's handling of the noise dispute. Disclosure of the redacted name was deemed necessary to meet this interest, and this outweighed the data subject's rights.
RBKC must disclose the requested information within 35 days.
The Tribunal determined that Article 6(1) of UK GDPR provides a lawful basis for disclosure and that Regulation 12(3) of EIR does not apply.