Peter Wailes v The Information Commissioner
[2023] UKFTT 778 (GRC)
Cambridgeshire County Council v The Information Commissioner & Anor
4 April 2024
[2024] UKFTT 269 (GRC)
First-tier Tribunal
A council refused to reveal the names of people who gave feedback on a public consultation. The Information Commissioner said they should release the names of those in public roles (like councilors). The court agreed, saying transparency is important and those in public roles shouldn't expect total privacy when giving public feedback.
Key Facts
- •Cambridgeshire County Council (Council) appealed a decision notice requiring disclosure of names of individuals who responded to a public consultation on behalf of electoral constituents or public bodies.
- •The request concerned a consultation on active travel schemes.
- •The Council withheld information relying on section 40(2) of the Freedom of Information Act 2000 (FOIA) and section 22 (information intended for future publication).
- •The Information Commissioner (Commissioner) found that the withheld information was personal data but disclosure was justified for those in public-facing roles, such as Councillors, due to the legitimate interest in transparency and accountability.
- •The Council argued that a data protection statement in the consultation reassured respondents about the non-publication of personal details.
Legal Principles
Section 40(2) FOIA: Exemption for personal data where disclosure would contravene data protection principles.
Freedom of Information Act 2000
Article 5(1)(a) UK GDPR: Personal data shall be processed lawfully, fairly and in a transparent manner.
UK GDPR
Article 6(1)(f) UK GDPR: Processing is lawful if necessary for the legitimate interests of the controller, unless overridden by the data subject's interests.
UK GDPR
Three-part test for Article 6(1)(f): (1) Legitimate interest pursued; (2) Processing necessary; (3) Interests not overridden by data subject's rights.
Case law on Article 6(1)(f)'s predecessor (South Lanarkshire Council v Scottish Information Commissioner)
Outcomes
Appeal dismissed.
The Tribunal found a legitimate interest in disclosing the names of those in public-facing roles who responded to the consultation, as it was necessary for transparency and accountability. The data protection statement did not create a reasonable expectation of privacy for those individuals.
Council must comply with the Commissioner's order within 42 days.
This follows from the dismissal of the appeal and the affirmation of the Commissioner's decision.